kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
e11726a9a4
boringssl/ssl/ssl_test.cc

3492 lines
126 KiB
C++
Raw Normal View History

Fix magic SSL reason codes. SSL reason codes corresponding to alerts have special values. Teach make_errors.go that values above 1000 are reserved (otherwise it will assign new values in that namespace). Also fix all the existing reason codes which corresponded to alerts. Change-Id: Ieabdf8fd59f4802938616934e1d84e659227cf84 Reviewed-on: https://boringssl-review.googlesource.com/1212 Reviewed-by: Adam Langley <agl@google.com>
2014-07-16 19:37:51 +01:00
/* Copyright (c) 2014, Google Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
#include <stdio.h>
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
#include <string.h>
Never use the internal session cache for a client. The internal session cache is keyed on session ID, so this is completely useless for clients (indeed we never look it up internally). Along the way, tidy up ssl_update_cache to be more readable. The slight behavior change is that SSL_CTX_add_session's return code no longer controls the external callback. It's not clear to me what that could have accomplished. (It can only fail on allocation error. We only call it for new sessions, so the duplicate case is impossible.) The one thing of value the internal cache might have provided is managing the timeout. The SSL_CTX_flush_sessions logic would flip the not_resumable bit and cause us not to offer expired sessions (modulo SSL_CTX_flush_sessions's delay and any discrepancies between the two caches). Instead, just check expiration when deciding whether or not to offer a session. This way clients that set SSL_SESS_CACHE_CLIENT blindly don't accidentally consume gobs of memory. BUG=531194 Change-Id: If97485beab21874f37737edc44df24e61ce23705 Reviewed-on: https://boringssl-review.googlesource.com/6321 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 20:18:55 +01:00
#include <time.h>
Fix magic SSL reason codes. SSL reason codes corresponding to alerts have special values. Teach make_errors.go that values above 1000 are reserved (otherwise it will assign new values in that namespace). Also fix all the existing reason codes which corresponded to alerts. Change-Id: Ieabdf8fd59f4802938616934e1d84e659227cf84 Reviewed-on: https://boringssl-review.googlesource.com/1212 Reviewed-by: Adam Langley <agl@google.com>
2014-07-16 19:37:51 +01:00
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
#include <algorithm>
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
#include <string>
Use more C++11 features. Finally, we can stick ScopedFOO in containers. Change-Id: I3ed166575822af9f182e8be8f4db723e1f08ea31 Reviewed-on: https://boringssl-review.googlesource.com/6553 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-11-21 08:00:50 +00:00
#include <utility>
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
#include <vector>
Do a cursory conversion of a few tests to GTest. For now, this is the laziest conversion possible. The intent is to just get the build setup ready so that we can get everything working in our consumers. The intended end state is: - The standalone build produces three test targets, one per library: {crypto,ssl,decrepit}_tests. - Each FOO_test is made up of: FOO/**/*_test.cc crypto/test/gtest_main.cc test_support - generate_build_files.py emits variables crypto_test_sources and ssl_test_sources. These variables are populated with FindCFiles, looking for *_test.cc. - The consuming file assembles those variables into the two test targets (plus decrepit) from there. This avoids having generate_build_files.py emit actual build rules. - Our standalone builders, Chromium, and Android just run the top-level test targets using whatever GTest-based reporting story they have. In transition, we start by converting one of two tests in each library to populate the three test targets. Those are added to all_tests.json and all_tests.go hacked to handle them transparently. This keeps our standalone builder working. generate_build_files.py, to start with, populates the new source lists manually and subtracts them out of the old machinery. We emit both for the time being. When this change rolls in, we'll write all the build glue needed to build the GTest-based tests and add it to consumers' continuous builders. Next, we'll subsume a file-based test and get the consumers working with that. (I.e. make sure the GTest targets can depend on a data file.) Once that's all done, we'll be sure all this will work. At that point, we start subsuming the remaining tests into the GTest targets and, asynchronously, rewriting tests to use GTest properly rather than cursory conversion here. When all non-GTest tests are gone, the old generate_build_files.py hooks will be removed, consumers updated to not depend on them, and standalone builders converted to not rely on all_tests.go, which can then be removed. (Unless bits end up being needed as a malloc test driver. I'm thinking we'll want to do something with --gtest_filter.) As part of this CL, I've bumped the CMake requirements (for target_include_directories) and added a few suppressions for warnings that GTest doesn't pass. BUG=129 Change-Id: I881b26b07a8739cc0b52dbb51a30956908e1b71a Reviewed-on: https://boringssl-review.googlesource.com/13232 Reviewed-by: Adam Langley <agl@google.com>
2017-01-20 00:05:47 +00:00
#include <gtest/gtest.h>
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
#include <openssl/base64.h>
#include <openssl/bio.h>
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
#include <openssl/cipher.h>
Deprecate SSL_library_init. It just calls CRYPTO_library_init and doesn't do anything else. If anything, I'd like to make CRYPTO_library_init completely go away too. We have CRYPTO_once now, so I think it's safe to assume that, if ssl/ ever grows initialization needs beyond that of crypto/, we can hide it behind a CRYPTO_once and not burden callers. Change-Id: I63dc362e0e9e98deec5516f4620d1672151a91b6 Reviewed-on: https://boringssl-review.googlesource.com/6311 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 04:39:22 +01:00
#include <openssl/crypto.h>
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
#include <openssl/err.h>
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
#include <openssl/hmac.h>
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
#include <openssl/pem.h>
Add a unit test for SSL_CTX_set_retain_only_sha256_of_client_certs. Change-Id: I5addfb1e8ec97fc426ae8ca39769120856470451 Reviewed-on: https://boringssl-review.googlesource.com/8780 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:22:54 +01:00
#include <openssl/sha.h>
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
#include <openssl/ssl.h>
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
#include <openssl/rand.h>
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
#include <openssl/x509.h>
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
Splitting SSL session state. To prevent configuration/established session confusion, the handshake session state is separated into the configured session (ssl->session) and the newly created session (ssl->s3->new_session). Upon conclusion of the handshake, the finalized session is stored in (ssl->s3->established_session). During the handshake, any requests for the session (SSL_get_session) return a non-resumable session, to prevent resumption of a partially filled session. Sessions should only be cached upon the completion of the full handshake, using the resulting established_session. The semantics of accessors on the session are maintained mid-renego. Change-Id: I4358aecb71fce4fe14a6746c5af1416a69935078 Reviewed-on: https://boringssl-review.googlesource.com/8612 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-06-27 21:34:59 +01:00
#include "internal.h"
Adding ARRAY_SIZE macro for getting the size of constant arrays. Change-Id: Ie60744761f5aa434a71a998f5ca98a8f8b1c25d5 Reviewed-on: https://boringssl-review.googlesource.com/10447 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 21:56:14 +01:00
#include "../crypto/internal.h"
Make key exchange strength available. This change stores the size of the group/modulus (for RSA/DHE) or curve ID (for ECDHE) in the |SSL_SESSION|. This makes it available for UIs where desired. Change-Id: I354141da432a08f71704c9683f298b361362483d Reviewed-on: https://boringssl-review.googlesource.com/5280 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 14:07:26 +01:00
#include "../crypto/test/test_util.h"
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
#if defined(OPENSSL_WINDOWS)
/* Windows defines struct timeval in winsock2.h. */
OPENSSL_MSVC_PRAGMA(warning(push, 3))
#include <winsock2.h>
OPENSSL_MSVC_PRAGMA(warning(pop))
#else
#include <sys/time.h>
#endif
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
struct ExpectedCipher {
unsigned long id;
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
int in_group_flag;
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
};
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
struct CipherTest {
// The rule string to apply.
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
const char *rule;
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
// The list of expected ciphers, in order.
std::vector<ExpectedCipher> expected;
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
// True if this cipher list should fail in strict mode.
bool strict_fail;
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
};
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
Implement SSL_CTX_set1_curves_list() This function is used by NGINX to enable specific curves for ECDH from a configuration file. However when building with BoringSSL, since it's not implmeneted, it falls back to using EC_KEY_new_by_curve_name() wich doesn't support X25519. Change-Id: I533df4ef302592c1a9f9fc8880bd85f796ce0ef3 Reviewed-on: https://boringssl-review.googlesource.com/11382 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-28 21:04:25 +01:00
struct CurveTest {
// The rule string to apply.
const char *rule;
// The list of expected curves, in order.
std::vector<uint16_t> expected;
};
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
static const CipherTest kCipherTests[] = {
// Selecting individual ciphers should work.
{
"ECDHE-ECDSA-CHACHA20-POLY1305:"
"ECDHE-RSA-CHACHA20-POLY1305:"
"ECDHE-ECDSA-AES128-GCM-SHA256:"
"ECDHE-RSA-AES128-GCM-SHA256",
{
{TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// + reorders selected ciphers to the end, keeping their relative order.
{
"ECDHE-ECDSA-CHACHA20-POLY1305:"
"ECDHE-RSA-CHACHA20-POLY1305:"
"ECDHE-ECDSA-AES128-GCM-SHA256:"
"ECDHE-RSA-AES128-GCM-SHA256:"
"+aRSA",
{
{TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// ! banishes ciphers from future selections.
{
"!aRSA:"
"ECDHE-ECDSA-CHACHA20-POLY1305:"
"ECDHE-RSA-CHACHA20-POLY1305:"
"ECDHE-ECDSA-AES128-GCM-SHA256:"
"ECDHE-RSA-AES128-GCM-SHA256",
{
{TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// Multiple masks can be ANDed in a single rule.
{
"kRSA+AESGCM+AES128",
{
{TLS1_CK_RSA_WITH_AES_128_GCM_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// - removes selected ciphers, but preserves their order for future
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
// selections. Select AES_128_GCM, but order the key exchanges RSA,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
// ECDHE_RSA.
{
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
"ALL:-kECDHE:"
"-kRSA:-ALL:"
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
"AESGCM+AES128+aRSA",
{
{TLS1_CK_RSA_WITH_AES_128_GCM_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
// Unknown selectors are no-ops, except in strict mode.
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
{
"ECDHE-ECDSA-CHACHA20-POLY1305:"
"ECDHE-RSA-CHACHA20-POLY1305:"
"ECDHE-ECDSA-AES128-GCM-SHA256:"
"ECDHE-RSA-AES128-GCM-SHA256:"
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
"BOGUS1",
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
{
{TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
true,
},
// Unknown selectors are no-ops, except in strict mode.
{
"ECDHE-ECDSA-CHACHA20-POLY1305:"
"ECDHE-RSA-CHACHA20-POLY1305:"
"ECDHE-ECDSA-AES128-GCM-SHA256:"
"ECDHE-RSA-AES128-GCM-SHA256:"
"-BOGUS2:+BOGUS3:!BOGUS4",
{
{TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 0},
},
true,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// Square brackets specify equi-preference groups.
{
"[ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES128-GCM-SHA256]:"
"[ECDHE-RSA-CHACHA20-POLY1305]:"
"ECDHE-RSA-AES128-GCM-SHA256",
{
{TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 1},
{TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0},
Remove old ChaCha20-Poly1305 AEAD. Before RFC 7539 we had a ChaCha20-Poly1305 cipher suite that had a 64/64 nonce/counter split (as DJB's original ChaCha20 did). RFC 7539 changed that to 96/32 and we've supported both for some time. This change removes the old version and the TLS cipher suites that used it. BUG=chromium:682816 Change-Id: I2345d6db83441691fe0c1ab6d7c6da4d24777849 Reviewed-on: https://boringssl-review.googlesource.com/13203 Reviewed-by: Adam Langley <agl@google.com>
2017-01-19 23:12:44 +00:00
{TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 0},
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
{TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// @STRENGTH performs a stable strength-sort of the selected ciphers and
// only the selected ciphers.
{
// To simplify things, banish all but {ECDHE_RSA,RSA} x
Remove RC4 from TLS for real. This withdraws support for -DBORINGSSL_ENABLE_RC4_TLS, and removes the RC4 AEADs. Change-Id: I1321b76bfe047d180743fa46d1b81c5d70c64e81 Reviewed-on: https://boringssl-review.googlesource.com/10940 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-07 23:09:58 +01:00
// {CHACHA20,AES_256_CBC,AES_128_CBC} x SHA1.
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
"!AESGCM:!3DES:!SHA256:!SHA384:"
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
// Order some ciphers backwards by strength.
Remove RC4 from TLS for real. This withdraws support for -DBORINGSSL_ENABLE_RC4_TLS, and removes the RC4 AEADs. Change-Id: I1321b76bfe047d180743fa46d1b81c5d70c64e81 Reviewed-on: https://boringssl-review.googlesource.com/10940 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-07 23:09:58 +01:00
"ALL:-CHACHA20:-AES256:-AES128:-ALL:"
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
// Select ECDHE ones and sort them by strength. Ties should resolve
// based on the order above.
"kECDHE:@STRENGTH:-ALL:"
// Now bring back everything uses RSA. ECDHE_RSA should be first, sorted
// by strength. Then RSA, backwards by strength.
"aRSA",
{
{TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA, 0},
{TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA, 0},
{TLS1_CK_RSA_WITH_AES_128_SHA, 0},
{TLS1_CK_RSA_WITH_AES_256_SHA, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// Exact ciphers may not be used in multi-part rules; they are treated
// as unknown aliases.
{
"ECDHE-ECDSA-AES128-GCM-SHA256:"
"ECDHE-RSA-AES128-GCM-SHA256:"
"!ECDHE-RSA-AES128-GCM-SHA256+RSA:"
"!ECDSA+ECDHE-ECDSA-AES128-GCM-SHA256",
{
{TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
true,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// SSLv3 matches everything that existed before TLS 1.2.
{
"AES128-SHA:AES128-SHA256:!SSLv3",
{
{TLS1_CK_RSA_WITH_AES_128_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
// TLSv1.2 matches everything added in TLS 1.2.
{
"AES128-SHA:AES128-SHA256:!TLSv1.2",
{
{TLS1_CK_RSA_WITH_AES_128_SHA, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
// The two directives have no intersection. But each component is valid, so
// even in strict mode it is accepted.
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
{
"AES128-SHA:AES128-SHA256:!TLSv1.2+SSLv3",
{
{TLS1_CK_RSA_WITH_AES_128_SHA, 0},
{TLS1_CK_RSA_WITH_AES_128_SHA256, 0},
},
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
false,
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
},
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
};
static const char *kBadRules[] = {
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Invalid brackets.
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
"[ECDHE-RSA-CHACHA20-POLY1305|ECDHE-RSA-AES128-GCM-SHA256",
"RSA]",
"[[RSA]]",
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Operators inside brackets.
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
"[+RSA]",
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Unknown directive.
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
"@BOGUS",
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Empty cipher lists error at SSL_CTX_set_cipher_list.
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
"",
"BOGUS",
Remove anonymous cipher suites. These are the remaining untested cipher suites. Rather than add support in runner.go, just remove them altogether. Grepping for this is a little tricky, but nothing enables aNULL (all occurrences disable it), and all occurrences of ["ALL:] seem to be either unused or explicitly disable anonymous ciphers. Change-Id: I4fd4b8dc6a273d6c04a26e93839641ddf738343f Reviewed-on: https://boringssl-review.googlesource.com/4258 Reviewed-by: Adam Langley <agl@google.com>
2015-04-07 06:14:06 +01:00
// COMPLEMENTOFDEFAULT is empty.
"COMPLEMENTOFDEFAULT",
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Invalid command.
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
"?BAR",
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Special operators are not allowed if groups are used.
Disallow all special operators once groups are used. + and - should also be forbidden. Any operation other than appending will mix up the in_group bits and give unexpected behavior. Change-Id: Ieaebb9ee6393aa36243d0765e45cae667f977ef5 Reviewed-on: https://boringssl-review.googlesource.com/1803 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 22:54:24 +01:00
"[ECDHE-RSA-CHACHA20-POLY1305|ECDHE-RSA-AES128-GCM-SHA256]:+FOO",
"[ECDHE-RSA-CHACHA20-POLY1305|ECDHE-RSA-AES128-GCM-SHA256]:!FOO",
"[ECDHE-RSA-CHACHA20-POLY1305|ECDHE-RSA-AES128-GCM-SHA256]:-FOO",
"[ECDHE-RSA-CHACHA20-POLY1305|ECDHE-RSA-AES128-GCM-SHA256]:@STRENGTH",
Return immediately if a cipher command is invalid. Breaking from inside the inner loop doesn't do what the code wants. Instead the outer loop will continue running and it's possible for it to read off the end of the buffer. (Found with libFuzzer.) Next change will update the other abort points in this code to match. Change-Id: I006dca0cd4c31db1c4b5e84b996fe24b2f1e6c13 Reviewed-on: https://boringssl-review.googlesource.com/11421 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-10-02 17:53:38 +01:00
// Opcode supplied, but missing selector.
"+",
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
};
Restore the NULL-SHA ciphersuite. (Alas.) Change-Id: Ia5398f3b86a13fb20dba053f730b51a0e57b9aa4 Reviewed-on: https://boringssl-review.googlesource.com/5791 Reviewed-by: Adam Langley <agl@google.com>
2015-09-03 03:48:16 +01:00
static const char *kMustNotIncludeNull[] = {
"ALL",
"DEFAULT",
Remove algo_strength. FIPS is the same as HIGH (but for CHACHA20), so those are redundant. Likewise, MEDIUM vs HIGH was just RC4. Remove those in favor of redefining those legacy rules to mean this. One less field to keep track of in each cipher. Change-Id: I2b2489cffb9e16efb0ac7d7290c173cac061432a Reviewed-on: https://boringssl-review.googlesource.com/6515 Reviewed-by: Adam Langley <agl@google.com>
2015-11-18 14:48:55 +00:00
"HIGH",
Restore the NULL-SHA ciphersuite. (Alas.) Change-Id: Ia5398f3b86a13fb20dba053f730b51a0e57b9aa4 Reviewed-on: https://boringssl-review.googlesource.com/5791 Reviewed-by: Adam Langley <agl@google.com>
2015-09-03 03:48:16 +01:00
"FIPS",
"SHA",
"SHA1",
"RSA",
"SSLv3",
"TLSv1",
"TLSv1.2",
};
Implement SSL_CTX_set1_curves_list() This function is used by NGINX to enable specific curves for ECDH from a configuration file. However when building with BoringSSL, since it's not implmeneted, it falls back to using EC_KEY_new_by_curve_name() wich doesn't support X25519. Change-Id: I533df4ef302592c1a9f9fc8880bd85f796ce0ef3 Reviewed-on: https://boringssl-review.googlesource.com/11382 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-28 21:04:25 +01:00
static const CurveTest kCurveTests[] = {
{
"P-256",
{ SSL_CURVE_SECP256R1 },
},
{
"P-256:P-384:P-521:X25519",
{
SSL_CURVE_SECP256R1,
SSL_CURVE_SECP384R1,
SSL_CURVE_SECP521R1,
SSL_CURVE_X25519,
},
},
};
static const char *kBadCurvesLists[] = {
"",
":",
"::",
"P-256::X25519",
"RSA:P-256",
"P-256:RSA",
"X25519:P-256:",
":X25519:P-256",
};
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
static std::string CipherListToString(ssl_cipher_preference_list_st *list) {
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
bool in_group = false;
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
std::string ret;
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
for (size_t i = 0; i < sk_SSL_CIPHER_num(list->ciphers); i++) {
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(list->ciphers, i);
if (!in_group && list->in_group_flags[i]) {
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ret += "\t[\n";
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
in_group = true;
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ret += "\t";
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
if (in_group) {
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ret += " ";
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ret += SSL_CIPHER_get_name(cipher);
ret += "\n";
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
if (in_group && !list->in_group_flags[i]) {
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ret += "\t]\n";
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
in_group = false;
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
}
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
return ret;
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
static bool CipherListsEqual(ssl_cipher_preference_list_st *list,
const std::vector<ExpectedCipher> &expected) {
if (sk_SSL_CIPHER_num(list->ciphers) != expected.size()) {
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_CIPHER_get_rfc_name. OpenSSL's internal names for the ciphers are not the standard ones and are not easy to consistently map to the standard ones. Add an API to get the real names out. (WebRTC wants an API to get the standard names out.) Also change some incorrect flags on SHA-256 TLS 1.2 ciphers; SSL_HANDSHAKE_MAC_DEFAULT and SSL_HANDSHAKE_MAC_SHA256 are the same after TLS 1.2. A TLS 1.2 cipher should be tagged explicitly with SHA-256. (This avoids tripping a check in SSL_CIPHER_get_rfc_name which asserts that default-hash ciphers only ever use SHA-1 or MD5 for the bulk cipher MAC.) Change-Id: Iaec2fd4aa97df29883094d3c2ae60f0ba003bf07
2015-02-05 21:49:47 +00:00
}
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
for (size_t i = 0; i < expected.size(); i++) {
const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(list->ciphers, i);
if (expected[i].id != SSL_CIPHER_get_id(cipher) ||
expected[i].in_group_flag != list->in_group_flags[i]) {
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return true;
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
TEST(SSLTest, CipherRules) {
for (const CipherTest &t : kCipherTests) {
SCOPED_TRACE(t.rule);
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(ctx);
Restore the NULL-SHA ciphersuite. (Alas.) Change-Id: Ia5398f3b86a13fb20dba053f730b51a0e57b9aa4 Reviewed-on: https://boringssl-review.googlesource.com/5791 Reviewed-by: Adam Langley <agl@google.com>
2015-09-03 03:48:16 +01:00
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
// Test lax mode.
ASSERT_TRUE(SSL_CTX_set_cipher_list(ctx.get(), t.rule));
EXPECT_TRUE(CipherListsEqual(ctx->cipher_list, t.expected))
<< "Cipher rule evaluated to:\n"
<< CipherListToString(ctx->cipher_list);
// Test strict mode.
if (t.strict_fail) {
EXPECT_FALSE(SSL_CTX_set_strict_cipher_list(ctx.get(), t.rule));
} else {
ASSERT_TRUE(SSL_CTX_set_strict_cipher_list(ctx.get(), t.rule));
EXPECT_TRUE(CipherListsEqual(ctx->cipher_list, t.expected))
<< "Cipher rule evaluated to:\n"
<< CipherListToString(ctx->cipher_list);
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
}
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
for (const char *rule : kBadRules) {
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
SCOPED_TRACE(rule);
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(ctx);
EXPECT_FALSE(SSL_CTX_set_cipher_list(ctx.get(), rule));
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
ERR_clear_error();
}
Use initializer lists to specify cipher rule tests. This is significantly less of a nuisance than having to explicitly type out kRule5, kExpected5. Change-Id: I61820c26a159c71e09000fbe0bf91e30da42205e Reviewed-on: https://boringssl-review.googlesource.com/7000 Reviewed-by: Adam Langley <agl@google.com>
2015-12-17 00:34:22 +00:00
for (const char *rule : kMustNotIncludeNull) {
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
SCOPED_TRACE(rule);
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(ctx);
ASSERT_TRUE(SSL_CTX_set_strict_cipher_list(ctx.get(), rule));
for (size_t i = 0; i < sk_SSL_CIPHER_num(ctx->cipher_list->ciphers); i++) {
EXPECT_FALSE(SSL_CIPHER_is_NULL(
sk_SSL_CIPHER_value(ctx->cipher_list->ciphers, i)));
Restore the NULL-SHA ciphersuite. (Alas.) Change-Id: Ia5398f3b86a13fb20dba053f730b51a0e57b9aa4 Reviewed-on: https://boringssl-review.googlesource.com/5791 Reviewed-by: Adam Langley <agl@google.com>
2015-09-03 03:48:16 +01:00
}
}
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
Fix magic SSL reason codes. SSL reason codes corresponding to alerts have special values. Teach make_errors.go that values above 1000 are reserved (otherwise it will assign new values in that namespace). Also fix all the existing reason codes which corresponded to alerts. Change-Id: Ieabdf8fd59f4802938616934e1d84e659227cf84 Reviewed-on: https://boringssl-review.googlesource.com/1212 Reviewed-by: Adam Langley <agl@google.com>
2014-07-16 19:37:51 +01:00
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
TEST(SSLTest, CurveRules) {
for (const CurveTest &t : kCurveTests) {
SCOPED_TRACE(t.rule);
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(ctx);
Implement SSL_CTX_set1_curves_list() This function is used by NGINX to enable specific curves for ECDH from a configuration file. However when building with BoringSSL, since it's not implmeneted, it falls back to using EC_KEY_new_by_curve_name() wich doesn't support X25519. Change-Id: I533df4ef302592c1a9f9fc8880bd85f796ce0ef3 Reviewed-on: https://boringssl-review.googlesource.com/11382 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-28 21:04:25 +01:00
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ASSERT_TRUE(SSL_CTX_set1_curves_list(ctx.get(), t.rule));
ASSERT_EQ(t.expected.size(), ctx->supported_group_list_len);
for (size_t i = 0; i < t.expected.size(); i++) {
EXPECT_EQ(t.expected[i], ctx->supported_group_list[i]);
Implement SSL_CTX_set1_curves_list() This function is used by NGINX to enable specific curves for ECDH from a configuration file. However when building with BoringSSL, since it's not implmeneted, it falls back to using EC_KEY_new_by_curve_name() wich doesn't support X25519. Change-Id: I533df4ef302592c1a9f9fc8880bd85f796ce0ef3 Reviewed-on: https://boringssl-review.googlesource.com/11382 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-28 21:04:25 +01:00
}
}
for (const char *rule : kBadCurvesLists) {
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
SCOPED_TRACE(rule);
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(ctx);
EXPECT_FALSE(SSL_CTX_set1_curves_list(ctx.get(), rule));
Implement SSL_CTX_set1_curves_list() This function is used by NGINX to enable specific curves for ECDH from a configuration file. However when building with BoringSSL, since it's not implmeneted, it falls back to using EC_KEY_new_by_curve_name() wich doesn't support X25519. Change-Id: I533df4ef302592c1a9f9fc8880bd85f796ce0ef3 Reviewed-on: https://boringssl-review.googlesource.com/11382 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-28 21:04:25 +01:00
ERR_clear_error();
}
}
Push the difference in chain semantics to the edge. OpenSSL includes a leaf certificate in a certificate chain when it's a client, but doesn't when it's a server. This is also reflected in the serialisation of sessions. This change makes the internal semantics consistent: the leaf is always included in the chain in memory, and never duplicated when serialised. To maintain the same API, SSL_get_peer_cert_chain will construct a copy of the chain without the leaf if needed. Since the serialised format of a client session has changed, an |is_server| boolean is added to the ASN.1 that defaults to true. Thus any old client sessions will be parsed as server sessions and (silently) discarded by a client. Change-Id: Ibcf72bc8a130cedb423bc0fd3417868e0af3ca3e Reviewed-on: https://boringssl-review.googlesource.com/12704 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-12 18:51:00 +00:00
// kOpenSSLSession is a serialized SSL_SESSION.
Revert "Move C++ helpers into |bssl| namespace." This reverts commit 09feb0f3d95a2bc58ce0faaf14256d3bd30f52a4. (In order to make WebRTC happy this also needs to be reverted.)
2016-07-12 16:09:33 +01:00
static const char kOpenSSLSession[] =
Push the difference in chain semantics to the edge. OpenSSL includes a leaf certificate in a certificate chain when it's a client, but doesn't when it's a server. This is also reflected in the serialisation of sessions. This change makes the internal semantics consistent: the leaf is always included in the chain in memory, and never duplicated when serialised. To maintain the same API, SSL_get_peer_cert_chain will construct a copy of the chain without the leaf if needed. Since the serialised format of a client session has changed, an |is_server| boolean is added to the ASN.1 that defaults to true. Thus any old client sessions will be parsed as server sessions and (silently) discarded by a client. Change-Id: Ibcf72bc8a130cedb423bc0fd3417868e0af3ca3e Reviewed-on: https://boringssl-review.googlesource.com/12704 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-12 18:51:00 +00:00
"MIIFqgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
Revert "Move C++ helpers into |bssl| namespace." This reverts commit 09feb0f3d95a2bc58ce0faaf14256d3bd30f52a4. (In order to make WebRTC happy this also needs to be reverted.)
2016-07-12 16:09:33 +01:00
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
"IWoJoQYCBFRDO46iBAICASyjggR6MIIEdjCCA16gAwIBAgIIK9dUvsPWSlUwDQYJ"
"KoZIhvcNAQEFBQAwSTELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMx"
"JTAjBgNVBAMTHEdvb2dsZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwHhcNMTQxMDA4"
"MTIwNzU3WhcNMTUwMTA2MDAwMDAwWjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwK"
"Q2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzETMBEGA1UECgwKR29v"
"Z2xlIEluYzEXMBUGA1UEAwwOd3d3Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEB"
"AQUAA4IBDwAwggEKAoIBAQCcKeLrplAC+Lofy8t/wDwtB6eu72CVp0cJ4V3lknN6"
"huH9ct6FFk70oRIh/VBNBBz900jYy+7111Jm1b8iqOTQ9aT5C7SEhNcQFJvqzH3e"
"MPkb6ZSWGm1yGF7MCQTGQXF20Sk/O16FSjAynU/b3oJmOctcycWYkY0ytS/k3LBu"
"Id45PJaoMqjB0WypqvNeJHC3q5JjCB4RP7Nfx5jjHSrCMhw8lUMW4EaDxjaR9KDh"
"PLgjsk+LDIySRSRDaCQGhEOWLJZVLzLo4N6/UlctCHEllpBUSvEOyFga52qroGjg"
"rf3WOQ925MFwzd6AK+Ich0gDRg8sQfdLH5OuP1cfLfU1AgMBAAGjggFBMIIBPTAd"
"BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGQYDVR0RBBIwEIIOd3d3Lmdv"
"b2dsZS5jb20waAYIKwYBBQUHAQEEXDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtp"
"Lmdvb2dsZS5jb20vR0lBRzIuY3J0MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50"
"czEuZ29vZ2xlLmNvbS9vY3NwMB0GA1UdDgQWBBQ7a+CcxsZByOpc+xpYFcIbnUMZ"
"hTAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEv"
"MBcGA1UdIAQQMA4wDAYKKwYBBAHWeQIFATAwBgNVHR8EKTAnMCWgI6Ahhh9odHRw"
"Oi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQCa"
"OXCBdoqUy5bxyq+Wrh1zsyyCFim1PH5VU2+yvDSWrgDY8ibRGJmfff3r4Lud5kal"
"dKs9k8YlKD3ITG7P0YT/Rk8hLgfEuLcq5cc0xqmE42xJ+Eo2uzq9rYorc5emMCxf"
"5L0TJOXZqHQpOEcuptZQ4OjdYMfSxk5UzueUhA3ogZKRcRkdB3WeWRp+nYRhx4St"
"o2rt2A0MKmY9165GHUqMK9YaaXHDXqBu7Sefr1uSoAP9gyIJKeihMivsGqJ1TD6Z"
"cc6LMe+dN2P8cZEQHtD1y296ul4Mivqk3jatUVL8/hCwgch9A8O4PGZq9WqBfEWm"
"IyHh1dPtbg1lOXdYCWtjpAIEAKUDAgEUqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36S"
"YTcLEkXqKwOBfF9vE4KX0NxeLwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9B"
"sNHM362zZnY27GpTw+Kwd751CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yE"
"OTDKPNj3+inbMaVigtK4PLyPq+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdA"
Push the difference in chain semantics to the edge. OpenSSL includes a leaf certificate in a certificate chain when it's a client, but doesn't when it's a server. This is also reflected in the serialisation of sessions. This change makes the internal semantics consistent: the leaf is always included in the chain in memory, and never duplicated when serialised. To maintain the same API, SSL_get_peer_cert_chain will construct a copy of the chain without the leaf if needed. Since the serialised format of a client session has changed, an |is_server| boolean is added to the ASN.1 that defaults to true. Thus any old client sessions will be parsed as server sessions and (silently) discarded by a client. Change-Id: Ibcf72bc8a130cedb423bc0fd3417868e0af3ca3e Reviewed-on: https://boringssl-review.googlesource.com/12704 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-12 18:51:00 +00:00
"i4gv7Y5oliyntgMBAQA=";
Revert "Move C++ helpers into |bssl| namespace." This reverts commit 09feb0f3d95a2bc58ce0faaf14256d3bd30f52a4. (In order to make WebRTC happy this also needs to be reverted.)
2016-07-12 16:09:33 +01:00
// kCustomSession is a custom serialized SSL_SESSION generated by
// filling in missing fields from |kOpenSSLSession|. This includes
// providing |peer_sha256|, so |peer| is not serialized.
static const char kCustomSession[] =
"MIIBdgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
"IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"
"BXdvcmxkqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36SYTcLEkXqKwOBfF9vE4KX0Nxe"
"LwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9BsNHM362zZnY27GpTw+Kwd751"
"CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yEOTDKPNj3+inbMaVigtK4PLyP"
"q+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdAi4gv7Y5oliynrSIEIAYGBgYG"
"BgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGrgMEAQevAwQBBLADBAEF";
// kBoringSSLSession is a serialized SSL_SESSION generated from bssl client.
static const char kBoringSSLSession[] =
"MIIRwQIBAQICAwMEAsAvBCDdoGxGK26mR+8lM0uq6+k9xYuxPnwAjpcF9n0Yli9R"
"kQQwbyshfWhdi5XQ1++7n2L1qqrcVlmHBPpr6yknT/u4pUrpQB5FZ7vqvNn8MdHf"
"9rWgoQYCBFXgs7uiBAICHCCjggR6MIIEdjCCA16gAwIBAgIIf+yfD7Y6UicwDQYJ"
"KoZIhvcNAQELBQAwSTELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMx"
"JTAjBgNVBAMTHEdvb2dsZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwHhcNMTUwODEy"
"MTQ1MzE1WhcNMTUxMTEwMDAwMDAwWjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwK"
"Q2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzETMBEGA1UECgwKR29v"
"Z2xlIEluYzEXMBUGA1UEAwwOd3d3Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEB"
"AQUAA4IBDwAwggEKAoIBAQC0MeG5YGQ0t+IeJeoneP/PrhEaieibeKYkbKVLNZpo"
"PLuBinvhkXZo3DC133NpCBpy6ZktBwamqyixAyuk/NU6OjgXqwwxfQ7di1AInLIU"
"792c7hFyNXSUCG7At8Ifi3YwBX9Ba6u/1d6rWTGZJrdCq3QU11RkKYyTq2KT5mce"
"Tv9iGKqSkSTlp8puy/9SZ/3DbU3U+BuqCFqeSlz7zjwFmk35acdCilpJlVDDN5C/"
"RCh8/UKc8PaL+cxlt531qoTENvYrflBno14YEZlCBZsPiFeUSILpKEj3Ccwhy0eL"
"EucWQ72YZU8mUzXBoXGn0zA0crFl5ci/2sTBBGZsylNBAgMBAAGjggFBMIIBPTAd"
"BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGQYDVR0RBBIwEIIOd3d3Lmdv"
"b2dsZS5jb20waAYIKwYBBQUHAQEEXDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtp"
"Lmdvb2dsZS5jb20vR0lBRzIuY3J0MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50"
"czEuZ29vZ2xlLmNvbS9vY3NwMB0GA1UdDgQWBBS/bzHxcE73Q4j3slC4BLbMtLjG"
"GjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEv"
"MBcGA1UdIAQQMA4wDAYKKwYBBAHWeQIFATAwBgNVHR8EKTAnMCWgI6Ahhh9odHRw"
"Oi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQAb"
"qdWPZEHk0X7iKPCTHL6S3w6q1eR67goxZGFSM1lk1hjwyu7XcLJuvALVV9uY3ovE"
"kQZSHwT+pyOPWQhsSjO+1GyjvCvK/CAwiUmBX+bQRGaqHsRcio7xSbdVcajQ3bXd"
"X+s0WdbOpn6MStKAiBVloPlSxEI8pxY6x/BBCnTIk/+DMB17uZlOjG3vbAnkDkP+"
"n0OTucD9sHV7EVj9XUxi51nOfNBCN/s7lpUjDS/NJ4k3iwOtbCPswiot8vLO779a"
"f07vR03r349Iz/KTzk95rlFtX0IU+KYNxFNsanIXZ+C9FYGRXkwhHcvFb4qMUB1y"
"TTlM80jBMOwyjZXmjRAhpAIEAKUDAgEUqQUCAwGJwKqBpwSBpOgebbmn9NRUtMWH"
"+eJpqA5JLMFSMCChOsvKey3toBaCNGU7HfAEiiXNuuAdCBoK262BjQc2YYfqFzqH"
"zuppopXCvhohx7j/tnCNZIMgLYt/O9SXK2RYI5z8FhCCHvB4CbD5G0LGl5EFP27s"
"Jb6S3aTTYPkQe8yZSlxevg6NDwmTogLO9F7UUkaYmVcMQhzssEE2ZRYNwSOU6KjE"
"0Yj+8fAiBtbQriIEIN2L8ZlpaVrdN5KFNdvcmOxJu81P8q53X55xQyGTnGWwsgMC"
"ARezggvvMIIEdjCCA16gAwIBAgIIf+yfD7Y6UicwDQYJKoZIhvcNAQELBQAwSTEL"
"MAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2ds"
"ZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwHhcNMTUwODEyMTQ1MzE1WhcNMTUxMTEw"
"MDAwMDAwWjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG"
"A1UEBwwNTW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEXMBUGA1UE"
"AwwOd3d3Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB"
"AQC0MeG5YGQ0t+IeJeoneP/PrhEaieibeKYkbKVLNZpoPLuBinvhkXZo3DC133Np"
"CBpy6ZktBwamqyixAyuk/NU6OjgXqwwxfQ7di1AInLIU792c7hFyNXSUCG7At8If"
"i3YwBX9Ba6u/1d6rWTGZJrdCq3QU11RkKYyTq2KT5mceTv9iGKqSkSTlp8puy/9S"
"Z/3DbU3U+BuqCFqeSlz7zjwFmk35acdCilpJlVDDN5C/RCh8/UKc8PaL+cxlt531"
"qoTENvYrflBno14YEZlCBZsPiFeUSILpKEj3Ccwhy0eLEucWQ72YZU8mUzXBoXGn"
"0zA0crFl5ci/2sTBBGZsylNBAgMBAAGjggFBMIIBPTAdBgNVHSUEFjAUBggrBgEF"
"BQcDAQYIKwYBBQUHAwIwGQYDVR0RBBIwEIIOd3d3Lmdvb2dsZS5jb20waAYIKwYB"
"BQUHAQEEXDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lB"
"RzIuY3J0MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50czEuZ29vZ2xlLmNvbS9v"
"Y3NwMB0GA1UdDgQWBBS/bzHxcE73Q4j3slC4BLbMtLjGGjAMBgNVHRMBAf8EAjAA"
"MB8GA1UdIwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEvMBcGA1UdIAQQMA4wDAYK"
"KwYBBAHWeQIFATAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vcGtpLmdvb2dsZS5j"
"b20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQAbqdWPZEHk0X7iKPCTHL6S"
"3w6q1eR67goxZGFSM1lk1hjwyu7XcLJuvALVV9uY3ovEkQZSHwT+pyOPWQhsSjO+"
"1GyjvCvK/CAwiUmBX+bQRGaqHsRcio7xSbdVcajQ3bXdX+s0WdbOpn6MStKAiBVl"
"oPlSxEI8pxY6x/BBCnTIk/+DMB17uZlOjG3vbAnkDkP+n0OTucD9sHV7EVj9XUxi"
"51nOfNBCN/s7lpUjDS/NJ4k3iwOtbCPswiot8vLO779af07vR03r349Iz/KTzk95"
"rlFtX0IU+KYNxFNsanIXZ+C9FYGRXkwhHcvFb4qMUB1yTTlM80jBMOwyjZXmjRAh"
"MIID8DCCAtigAwIBAgIDAjqDMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVT"
"MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i"
"YWwgQ0EwHhcNMTMwNDA1MTUxNTU2WhcNMTYxMjMxMjM1OTU5WjBJMQswCQYDVQQG"
"EwJVUzETMBEGA1UEChMKR29vZ2xlIEluYzElMCMGA1UEAxMcR29vZ2xlIEludGVy"
"bmV0IEF1dGhvcml0eSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB"
"AJwqBHdc2FCROgajguDYUEi8iT/xGXAaiEZ+4I/F8YnOIe5a/mENtzJEiaB0C1NP"
"VaTOgmKV7utZX8bhBYASxF6UP7xbSDj0U/ck5vuR6RXEz/RTDfRK/J9U3n2+oGtv"
"h8DQUB8oMANA2ghzUWx//zo8pzcGjr1LEQTrfSTe5vn8MXH7lNVg8y5Kr0LSy+rE"
"ahqyzFPdFUuLH8gZYR/Nnag+YyuENWllhMgZxUYi+FOVvuOAShDGKuy6lyARxzmZ"
"EASg8GF6lSWMTlJ14rbtCMoU/M4iarNOz0YDl5cDfsCx3nuvRTPPuj5xt970JSXC"
"DTWJnZ37DhF5iR43xa+OcmkCAwEAAaOB5zCB5DAfBgNVHSMEGDAWgBTAephojYn7"
"qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQUSt0GFhu89mi1dvWBtrtiGrpagS8wDgYD"
"VR0PAQH/BAQDAgEGMC4GCCsGAQUFBwEBBCIwIDAeBggrBgEFBQcwAYYSaHR0cDov"
"L2cuc3ltY2QuY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwNQYDVR0fBC4wLDAqoCig"
"JoYkaHR0cDovL2cuc3ltY2IuY29tL2NybHMvZ3RnbG9iYWwuY3JsMBcGA1UdIAQQ"
"MA4wDAYKKwYBBAHWeQIFATANBgkqhkiG9w0BAQsFAAOCAQEAqvqpIM1qZ4PtXtR+"
"3h3Ef+AlBgDFJPupyC1tft6dgmUsgWM0Zj7pUsIItMsv91+ZOmqcUHqFBYx90SpI"
"hNMJbHzCzTWf84LuUt5oX+QAihcglvcpjZpNy6jehsgNb1aHA30DP9z6eX0hGfnI"
"Oi9RdozHQZJxjyXON/hKTAAj78Q1EK7gI4BzfE00LshukNYQHpmEcxpw8u1VDu4X"
"Bupn7jLrLN1nBz/2i8Jw3lsA5rsb0zYaImxssDVCbJAJPZPpZAkiDoUGn8JzIdPm"
"X4DkjYUiOnMDsWCOrmji9D6X52ASCWg23jrW4kOVWzeBkoEfu43XrVJkFleW2V40"
"fsg12DCCA30wggLmoAMCAQICAxK75jANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQG"
"EwJVUzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUg"
"Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTAyMDUyMTA0MDAwMFoXDTE4MDgyMTA0"
"MDAwMFowQjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xGzAZ"
"BgNVBAMTEkdlb1RydXN0IEdsb2JhbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP"
"ADCCAQoCggEBANrMGGMw/fQXIxpWflvfPGw45HG3eJHUvKHYTPioQ7YD6U0hBwiI"
"2lgvZjkpvQV4i5046AW3an5xpObEYKaw74DkiSgPniXW7YPzraaRx5jJQhg1FJ2t"
"mEaSLk/K8YdDwRaVVy1Q74ktgHpXrfLuX2vSAI25FPgUFTXZwEaje3LIkb/JVSvN"
"0Jc+nCZkzN/Ogxlxyk7m1NV7qRnNVd7I7NJeOFPlXE+MLf5QIzb8ZubLjqQ5GQC3"
"lQI5kQsO/jgu0R0FmvZNPm8PBx2vLB6PYDni+jZTEznUXiYr2z2oFL0y6xgDKFIE"
"ceWrMz3hOLsHNoRinHnqFjD0X8Ar6HFr5PkCAwEAAaOB8DCB7TAfBgNVHSMEGDAW"
"gBRI5mj5K9KylddH2CMgEE8zmJCf1DAdBgNVHQ4EFgQUwHqYaI2J+6sFZAwRfap9"
"ZbjKzE4wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwOgYDVR0fBDMw"
"MTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20vY3Jscy9zZWN1cmVjYS5j"
"cmwwTgYDVR0gBEcwRTBDBgRVHSAAMDswOQYIKwYBBQUHAgEWLWh0dHBzOi8vd3d3"
"Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvcmVwb3NpdG9yeTANBgkqhkiG9w0BAQUF"
"AAOBgQB24RJuTksWEoYwBrKBCM/wCMfHcX5m7sLt1Dsf//DwyE7WQziwuTB9GNBV"
"g6JqyzYRnOhIZqNtf7gT1Ef+i1pcc/yu2RsyGTirlzQUqpbS66McFAhJtrvlke+D"
"NusdVm/K2rxzY5Dkf3s+Iss9B+1fOHSc4wNQTqGvmO5h8oQ/Eg==";
// kBadSessionExtraField is a custom serialized SSL_SESSION generated by replacing
// the final (optional) element of |kCustomSession| with tag number 30.
static const char kBadSessionExtraField[] =
"MIIBdgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
"IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"
"BXdvcmxkqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36SYTcLEkXqKwOBfF9vE4KX0Nxe"
"LwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9BsNHM362zZnY27GpTw+Kwd751"
"CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yEOTDKPNj3+inbMaVigtK4PLyP"
"q+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdAi4gv7Y5oliynrSIEIAYGBgYG"
"BgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGrgMEAQevAwQBBL4DBAEF";
// kBadSessionVersion is a custom serialized SSL_SESSION generated by replacing
// the version of |kCustomSession| with 2.
static const char kBadSessionVersion[] =
"MIIBdgIBAgICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
"IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"
"BXdvcmxkqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36SYTcLEkXqKwOBfF9vE4KX0Nxe"
"LwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9BsNHM362zZnY27GpTw+Kwd751"
"CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yEOTDKPNj3+inbMaVigtK4PLyP"
"q+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdAi4gv7Y5oliynrSIEIAYGBgYG"
"BgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGrgMEAQevAwQBBLADBAEF";
// kBadSessionTrailingData is a custom serialized SSL_SESSION with trailing data
// appended.
static const char kBadSessionTrailingData[] =
"MIIBdgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
"IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"
"BXdvcmxkqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36SYTcLEkXqKwOBfF9vE4KX0Nxe"
"LwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9BsNHM362zZnY27GpTw+Kwd751"
"CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yEOTDKPNj3+inbMaVigtK4PLyP"
"q+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdAi4gv7Y5oliynrSIEIAYGBgYG"
"BgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGrgMEAQevAwQBBLADBAEFAAAA";
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
static bool DecodeBase64(std::vector<uint8_t> *out, const char *in) {
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
size_t len;
if (!EVP_DecodedLength(&len, strlen(in))) {
fprintf(stderr, "EVP_DecodedLength failed\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
out->resize(len);
Remove stl_compat.h. Chromium's toolchains may now assume C++11 library support, so we may freely use C++11 features. (Chromium's still in the process of deciding what to allow, but we use Google's style guide directly, toolchain limitations aside.) Change-Id: I1c7feb92b7f5f51d9091a4c686649fb574ac138d Reviewed-on: https://boringssl-review.googlesource.com/6465 Reviewed-by: Adam Langley <agl@google.com>
2015-11-11 22:01:27 +00:00
if (!EVP_DecodeBase64(out->data(), &len, len, (const uint8_t *)in,
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
strlen(in))) {
fprintf(stderr, "EVP_DecodeBase64 failed\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
out->resize(len);
return true;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
static bool TestSSL_SESSIONEncoding(const char *input_b64) {
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
const uint8_t *cptr;
uint8_t *ptr;
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Decode the input.
std::vector<uint8_t> input;
if (!DecodeBase64(&input, input_b64)) {
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Verify the SSL_SESSION decodes.
Remove |X509| things from SSL_SESSION. |SSL_SESSION_from_bytes| now takes an |SSL_CTX*|, from which it uses the |X509_METHOD| and buffer pool. This is our API so we can do this. This also requires adding an |SSL_CTX*| argument to |SSL_SESSION_new| for the same reason. However, |SSL_SESSION_new| already has very few callers (and none in third-party code that I can see) so I think we can get away with this. Change-Id: I1337cd2bd8cff03d4b9405ea3146b3b59584aa72 Reviewed-on: https://boringssl-review.googlesource.com/13584 Reviewed-by: Adam Langley <alangley@gmail.com> Commit-Queue: Adam Langley <alangley@gmail.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-01 23:49:37 +00:00
bssl::UniquePtr<SSL_CTX> ssl_ctx(SSL_CTX_new(TLS_method()));
if (!ssl_ctx) {
return false;
}
bssl::UniquePtr<SSL_SESSION> session(
SSL_SESSION_from_bytes(input.data(), input.size(), ssl_ctx.get()));
Add SSL_SESSION_from_bytes. Mirrors SSL_SESSION_to_bytes. It avoids having to deal with object-reuse, the non-size_t length parameter, and trailing data. Both it and the object-reuse variant back onto an unexposed SSL_SESSION_parse which reads a CBS. Note that this changes the object reuse story slightly. It's now merely an optional output pointer that frees its old contents. No d2i_SSL_SESSION consumer in Google that's built does reuse, much less reuse with the assumption that the top-level object won't be overridden. Change-Id: I5cb8522f96909bb222cab0f342423f2dd7814282 Reviewed-on: https://boringssl-review.googlesource.com/5121 Reviewed-by: Adam Langley <agl@google.com>
2015-06-16 00:41:48 +01:00
if (!session) {
fprintf(stderr, "SSL_SESSION_from_bytes failed\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Verify the SSL_SESSION encoding round-trips.
size_t encoded_len;
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<uint8_t> encoded;
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
uint8_t *encoded_raw;
if (!SSL_SESSION_to_bytes(session.get(), &encoded_raw, &encoded_len)) {
Add SSL_SESSION_to_bytes to replace i2d_SSL_SESSION. Deprecate the old two-pass version of the function. If the ticket is too long, replace it with a placeholder value but keep the connection working. Change-Id: Ib9fdea66389b171862143d79b5540ea90a9bd5fb Reviewed-on: https://boringssl-review.googlesource.com/2011 Reviewed-by: Adam Langley <agl@google.com>
2014-10-21 06:46:30 +01:00
fprintf(stderr, "SSL_SESSION_to_bytes failed\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION_to_bytes to replace i2d_SSL_SESSION. Deprecate the old two-pass version of the function. If the ticket is too long, replace it with a placeholder value but keep the connection working. Change-Id: Ib9fdea66389b171862143d79b5540ea90a9bd5fb Reviewed-on: https://boringssl-review.googlesource.com/2011 Reviewed-by: Adam Langley <agl@google.com>
2014-10-21 06:46:30 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
encoded.reset(encoded_raw);
if (encoded_len != input.size() ||
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcmp(input.data(), encoded.get(), input.size()) != 0) {
Add SSL_SESSION_to_bytes to replace i2d_SSL_SESSION. Deprecate the old two-pass version of the function. If the ticket is too long, replace it with a placeholder value but keep the connection working. Change-Id: Ib9fdea66389b171862143d79b5540ea90a9bd5fb Reviewed-on: https://boringssl-review.googlesource.com/2011 Reviewed-by: Adam Langley <agl@google.com>
2014-10-21 06:46:30 +01:00
fprintf(stderr, "SSL_SESSION_to_bytes did not round-trip\n");
Make key exchange strength available. This change stores the size of the group/modulus (for RSA/DHE) or curve ID (for ECDHE) in the |SSL_SESSION|. This makes it available for UIs where desired. Change-Id: I354141da432a08f71704c9683f298b361362483d Reviewed-on: https://boringssl-review.googlesource.com/5280 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 14:07:26 +01:00
hexdump(stderr, "Before: ", input.data(), input.size());
hexdump(stderr, "After: ", encoded_raw, encoded_len);
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION_to_bytes to replace i2d_SSL_SESSION. Deprecate the old two-pass version of the function. If the ticket is too long, replace it with a placeholder value but keep the connection working. Change-Id: Ib9fdea66389b171862143d79b5540ea90a9bd5fb Reviewed-on: https://boringssl-review.googlesource.com/2011 Reviewed-by: Adam Langley <agl@google.com>
2014-10-21 06:46:30 +01:00
}
Add SSL_SESSION_from_bytes. Mirrors SSL_SESSION_to_bytes. It avoids having to deal with object-reuse, the non-size_t length parameter, and trailing data. Both it and the object-reuse variant back onto an unexposed SSL_SESSION_parse which reads a CBS. Note that this changes the object reuse story slightly. It's now merely an optional output pointer that frees its old contents. No d2i_SSL_SESSION consumer in Google that's built does reuse, much less reuse with the assumption that the top-level object won't be overridden. Change-Id: I5cb8522f96909bb222cab0f342423f2dd7814282 Reviewed-on: https://boringssl-review.googlesource.com/5121 Reviewed-by: Adam Langley <agl@google.com>
2015-06-16 00:41:48 +01:00
// Verify the SSL_SESSION also decodes with the legacy API.
Remove stl_compat.h. Chromium's toolchains may now assume C++11 library support, so we may freely use C++11 features. (Chromium's still in the process of deciding what to allow, but we use Google's style guide directly, toolchain limitations aside.) Change-Id: I1c7feb92b7f5f51d9091a4c686649fb574ac138d Reviewed-on: https://boringssl-review.googlesource.com/6465 Reviewed-by: Adam Langley <agl@google.com>
2015-11-11 22:01:27 +00:00
cptr = input.data();
Add SSL_SESSION_from_bytes. Mirrors SSL_SESSION_to_bytes. It avoids having to deal with object-reuse, the non-size_t length parameter, and trailing data. Both it and the object-reuse variant back onto an unexposed SSL_SESSION_parse which reads a CBS. Note that this changes the object reuse story slightly. It's now merely an optional output pointer that frees its old contents. No d2i_SSL_SESSION consumer in Google that's built does reuse, much less reuse with the assumption that the top-level object won't be overridden. Change-Id: I5cb8522f96909bb222cab0f342423f2dd7814282 Reviewed-on: https://boringssl-review.googlesource.com/5121 Reviewed-by: Adam Langley <agl@google.com>
2015-06-16 00:41:48 +01:00
session.reset(d2i_SSL_SESSION(NULL, &cptr, input.size()));
Remove stl_compat.h. Chromium's toolchains may now assume C++11 library support, so we may freely use C++11 features. (Chromium's still in the process of deciding what to allow, but we use Google's style guide directly, toolchain limitations aside.) Change-Id: I1c7feb92b7f5f51d9091a4c686649fb574ac138d Reviewed-on: https://boringssl-review.googlesource.com/6465 Reviewed-by: Adam Langley <agl@google.com>
2015-11-11 22:01:27 +00:00
if (!session || cptr != input.data() + input.size()) {
Add SSL_SESSION_from_bytes. Mirrors SSL_SESSION_to_bytes. It avoids having to deal with object-reuse, the non-size_t length parameter, and trailing data. Both it and the object-reuse variant back onto an unexposed SSL_SESSION_parse which reads a CBS. Note that this changes the object reuse story slightly. It's now merely an optional output pointer that frees its old contents. No d2i_SSL_SESSION consumer in Google that's built does reuse, much less reuse with the assumption that the top-level object won't be overridden. Change-Id: I5cb8522f96909bb222cab0f342423f2dd7814282 Reviewed-on: https://boringssl-review.googlesource.com/5121 Reviewed-by: Adam Langley <agl@google.com>
2015-06-16 00:41:48 +01:00
fprintf(stderr, "d2i_SSL_SESSION failed\n");
return false;
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
// Verify the SSL_SESSION encoding round-trips via the legacy API.
int len = i2d_SSL_SESSION(session.get(), NULL);
if (len < 0 || (size_t)len != input.size()) {
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
fprintf(stderr, "i2d_SSL_SESSION(NULL) returned invalid length\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
encoded.reset((uint8_t *)OPENSSL_malloc(input.size()));
if (!encoded) {
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
fprintf(stderr, "malloc failed\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
ptr = encoded.get();
len = i2d_SSL_SESSION(session.get(), &ptr);
if (len < 0 || (size_t)len != input.size()) {
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
fprintf(stderr, "i2d_SSL_SESSION returned invalid length\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
if (ptr != encoded.get() + input.size()) {
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
fprintf(stderr, "i2d_SSL_SESSION did not advance ptr correctly\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
if (OPENSSL_memcmp(input.data(), encoded.get(), input.size()) != 0) {
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
fprintf(stderr, "i2d_SSL_SESSION did not round-trip\n");
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return false;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
return true;
Add SSL_SESSION serialization and deserialization tests. Change-Id: Ia59e4accb644c8807b7c4ab6267efa624be95c18 Reviewed-on: https://boringssl-review.googlesource.com/1992 Reviewed-by: Adam Langley <agl@google.com>
2014-10-19 05:59:36 +01:00
}
Reject unknown fields in d2i_SSL_SESSION. The original OpenSSL implementation did the same. M_ASN1_D2I_Finish checks this. Forwards compatibility with future sessions with unknown fields is probably not desirable. Change-Id: I116a8c482cbcc47c3fcc31515c4a3718f66cf268 Reviewed-on: https://boringssl-review.googlesource.com/4941 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 00:55:29 +01:00
static bool TestBadSSL_SESSIONEncoding(const char *input_b64) {
std::vector<uint8_t> input;
if (!DecodeBase64(&input, input_b64)) {
return false;
}
// Verify that the SSL_SESSION fails to decode.
Remove |X509| things from SSL_SESSION. |SSL_SESSION_from_bytes| now takes an |SSL_CTX*|, from which it uses the |X509_METHOD| and buffer pool. This is our API so we can do this. This also requires adding an |SSL_CTX*| argument to |SSL_SESSION_new| for the same reason. However, |SSL_SESSION_new| already has very few callers (and none in third-party code that I can see) so I think we can get away with this. Change-Id: I1337cd2bd8cff03d4b9405ea3146b3b59584aa72 Reviewed-on: https://boringssl-review.googlesource.com/13584 Reviewed-by: Adam Langley <alangley@gmail.com> Commit-Queue: Adam Langley <alangley@gmail.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-01 23:49:37 +00:00
bssl::UniquePtr<SSL_CTX> ssl_ctx(SSL_CTX_new(TLS_method()));
if (!ssl_ctx) {
return false;
}
bssl::UniquePtr<SSL_SESSION> session(
SSL_SESSION_from_bytes(input.data(), input.size(), ssl_ctx.get()));
Reject unknown fields in d2i_SSL_SESSION. The original OpenSSL implementation did the same. M_ASN1_D2I_Finish checks this. Forwards compatibility with future sessions with unknown fields is probably not desirable. Change-Id: I116a8c482cbcc47c3fcc31515c4a3718f66cf268 Reviewed-on: https://boringssl-review.googlesource.com/4941 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 00:55:29 +01:00
if (session) {
Add SSL_SESSION_from_bytes. Mirrors SSL_SESSION_to_bytes. It avoids having to deal with object-reuse, the non-size_t length parameter, and trailing data. Both it and the object-reuse variant back onto an unexposed SSL_SESSION_parse which reads a CBS. Note that this changes the object reuse story slightly. It's now merely an optional output pointer that frees its old contents. No d2i_SSL_SESSION consumer in Google that's built does reuse, much less reuse with the assumption that the top-level object won't be overridden. Change-Id: I5cb8522f96909bb222cab0f342423f2dd7814282 Reviewed-on: https://boringssl-review.googlesource.com/5121 Reviewed-by: Adam Langley <agl@google.com>
2015-06-16 00:41:48 +01:00
fprintf(stderr, "SSL_SESSION_from_bytes unexpectedly succeeded\n");
Reject unknown fields in d2i_SSL_SESSION. The original OpenSSL implementation did the same. M_ASN1_D2I_Finish checks this. Forwards compatibility with future sessions with unknown fields is probably not desirable. Change-Id: I116a8c482cbcc47c3fcc31515c4a3718f66cf268 Reviewed-on: https://boringssl-review.googlesource.com/4941 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 00:55:29 +01:00
return false;
}
ERR_clear_error();
return true;
}
Always set min_version / max_version. Saves us some mess if they're never zero. This also fixes a bug in ssl3_get_max_client_version where it didn't account for all versions being disabled properly. Change-Id: I4c95ff57cf8953cb4a528263b252379f252f3e01 Reviewed-on: https://boringssl-review.googlesource.com/8512 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-21 03:20:47 +01:00
static bool TestDefaultVersion(uint16_t min_version, uint16_t max_version,
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
const SSL_METHOD *(*method)(void)) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(method()));
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
if (!ctx) {
return false;
Merge SSLv23_method and DTLS_ANY_VERSION. This makes SSLv23_method go through DTLS_ANY_VERSION's version negotiation logic. This allows us to get rid of duplicate ClientHello logic. For compatibility, SSL_METHOD is now split into SSL_PROTOCOL_METHOD and a version. The legacy version-locked methods set min_version and max_version based this version field to emulate the original semantics. As a bonus, we can now handle fragmented ClientHello versions now. Because SSLv23_method is a silly name, deprecate that too and introduce TLS_method. Change-Id: I8b3df2b427ae34c44ecf972f466ad64dc3dbb171
2014-12-12 20:55:27 +00:00
}
Simplify version configuration. OpenSSL's SSL_OP_NO_* flags allow discontinuous version ranges. This is a nuisance for two reasons. First it makes it unnecessarily difficult to answer "are any versions below TLS 1.3 enabled?". Second the protocol does not allow discontinuous version ranges on the client anyway. OpenSSL instead picks the first continous range of enabled versions on the client, but not the server. This is bizarrely inconsistent. It also doesn't quite do this as the ClientHello sending logic does this, but not the ServerHello processing logic. So we actually break some invariants slightly. The logic is also cumbersome in DTLS which kindly inverts the comparison logic. First, switch min_version/max_version's storage to normalized versions. Next replace all the ad-hoc version-related functions with a single ssl_get_version_range function. Client and server now consistently pick a contiguous range of versions. Note this is a slight behavior change for servers. Version-range-sensitive logic is rewritten to use this new function. BUG=66 Change-Id: Iad0d64f2b7a917603fc7da54c9fc6656c5fbdb24 Reviewed-on: https://boringssl-review.googlesource.com/8513 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-21 15:33:21 +01:00
if (ctx->min_version != min_version || ctx->max_version != max_version) {
fprintf(stderr, "Got min %04x, max %04x; wanted min %04x, max %04x\n",
ctx->min_version, ctx->max_version, min_version, max_version);
return false;
}
return true;
Merge SSLv23_method and DTLS_ANY_VERSION. This makes SSLv23_method go through DTLS_ANY_VERSION's version negotiation logic. This allows us to get rid of duplicate ClientHello logic. For compatibility, SSL_METHOD is now split into SSL_PROTOCOL_METHOD and a version. The legacy version-locked methods set min_version and max_version based this version field to emulate the original semantics. As a bonus, we can now handle fragmented ClientHello versions now. Because SSLv23_method is a silly name, deprecate that too and introduce TLS_method. Change-Id: I8b3df2b427ae34c44ecf972f466ad64dc3dbb171
2014-12-12 20:55:27 +00:00
}
Add SSL_CIPHER_get_rfc_name. OpenSSL's internal names for the ciphers are not the standard ones and are not easy to consistently map to the standard ones. Add an API to get the real names out. (WebRTC wants an API to get the standard names out.) Also change some incorrect flags on SHA-256 TLS 1.2 ciphers; SSL_HANDSHAKE_MAC_DEFAULT and SSL_HANDSHAKE_MAC_SHA256 are the same after TLS 1.2. A TLS 1.2 cipher should be tagged explicitly with SHA-256. (This avoids tripping a check in SSL_CIPHER_get_rfc_name which asserts that default-hash ciphers only ever use SHA-1 or MD5 for the bulk cipher MAC.) Change-Id: Iaec2fd4aa97df29883094d3c2ae60f0ba003bf07
2015-02-05 21:49:47 +00:00
typedef struct {
Use SSL_get_cipher_by_value in cipher_get_rfc_name tests. Saves making a temporary SSL_CTX and looking at its insides. Change-Id: Ia351b9b91aec8b813ad7b6e373773396f0975f9a Reviewed-on: https://boringssl-review.googlesource.com/3561 Reviewed-by: Adam Langley <agl@google.com>
2015-02-21 16:03:06 +00:00
int id;
Add SSL_CIPHER_get_rfc_name. OpenSSL's internal names for the ciphers are not the standard ones and are not easy to consistently map to the standard ones. Add an API to get the real names out. (WebRTC wants an API to get the standard names out.) Also change some incorrect flags on SHA-256 TLS 1.2 ciphers; SSL_HANDSHAKE_MAC_DEFAULT and SSL_HANDSHAKE_MAC_SHA256 are the same after TLS 1.2. A TLS 1.2 cipher should be tagged explicitly with SHA-256. (This avoids tripping a check in SSL_CIPHER_get_rfc_name which asserts that default-hash ciphers only ever use SHA-1 or MD5 for the bulk cipher MAC.) Change-Id: Iaec2fd4aa97df29883094d3c2ae60f0ba003bf07
2015-02-05 21:49:47 +00:00
const char *rfc_name;
} CIPHER_RFC_NAME_TEST;
static const CIPHER_RFC_NAME_TEST kCipherRFCNameTests[] = {
Update crypto negotation to draft 15. BUG=77 Change-Id: If568412655aae240b072c29d763a5b17bb5ca3f7 Reviewed-on: https://boringssl-review.googlesource.com/10840 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Commit-Queue: David Benjamin <davidben@google.com>
2016-09-06 19:13:43 +01:00
{SSL3_CK_RSA_DES_192_CBC3_SHA, "TLS_RSA_WITH_3DES_EDE_CBC_SHA"},
{TLS1_CK_RSA_WITH_AES_128_SHA, "TLS_RSA_WITH_AES_128_CBC_SHA"},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"},
{TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"},
{TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"},
{TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"},
{TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"},
{TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA,
"TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA"},
{TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"},
{TLS1_CK_AES_256_GCM_SHA384, "TLS_AES_256_GCM_SHA384"},
{TLS1_CK_AES_128_GCM_SHA256, "TLS_AES_128_GCM_SHA256"},
{TLS1_CK_CHACHA20_POLY1305_SHA256, "TLS_CHACHA20_POLY1305_SHA256"},
Add SSL_CIPHER_get_rfc_name. OpenSSL's internal names for the ciphers are not the standard ones and are not easy to consistently map to the standard ones. Add an API to get the real names out. (WebRTC wants an API to get the standard names out.) Also change some incorrect flags on SHA-256 TLS 1.2 ciphers; SSL_HANDSHAKE_MAC_DEFAULT and SSL_HANDSHAKE_MAC_SHA256 are the same after TLS 1.2. A TLS 1.2 cipher should be tagged explicitly with SHA-256. (This avoids tripping a check in SSL_CIPHER_get_rfc_name which asserts that default-hash ciphers only ever use SHA-1 or MD5 for the bulk cipher MAC.) Change-Id: Iaec2fd4aa97df29883094d3c2ae60f0ba003bf07
2015-02-05 21:49:47 +00:00
};
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
TEST(SSLTest, CipherGetRFCName) {
for (const CIPHER_RFC_NAME_TEST &t : kCipherRFCNameTests) {
SCOPED_TRACE(t.rfc_name);
const SSL_CIPHER *cipher = SSL_get_cipher_by_value(t.id & 0xffff);
ASSERT_TRUE(cipher);
bssl::UniquePtr<char> rfc_name(SSL_CIPHER_get_rfc_name(cipher));
ASSERT_TRUE(rfc_name);
EXPECT_STREQ(t.rfc_name, rfc_name.get());
Add SSL_CIPHER_get_rfc_name. OpenSSL's internal names for the ciphers are not the standard ones and are not easy to consistently map to the standard ones. Add an API to get the real names out. (WebRTC wants an API to get the standard names out.) Also change some incorrect flags on SHA-256 TLS 1.2 ciphers; SSL_HANDSHAKE_MAC_DEFAULT and SSL_HANDSHAKE_MAC_SHA256 are the same after TLS 1.2. A TLS 1.2 cipher should be tagged explicitly with SHA-256. (This avoids tripping a check in SSL_CIPHER_get_rfc_name which asserts that default-hash ciphers only ever use SHA-1 or MD5 for the bulk cipher MAC.) Change-Id: Iaec2fd4aa97df29883094d3c2ae60f0ba003bf07
2015-02-05 21:49:47 +00:00
}
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
// CreateSessionWithTicket returns a sample |SSL_SESSION| with the specified
// version and ticket length or nullptr on failure.
static bssl::UniquePtr<SSL_SESSION> CreateSessionWithTicket(uint16_t version,
size_t ticket_len) {
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
std::vector<uint8_t> der;
if (!DecodeBase64(&der, kOpenSSLSession)) {
return nullptr;
}
Remove |X509| things from SSL_SESSION. |SSL_SESSION_from_bytes| now takes an |SSL_CTX*|, from which it uses the |X509_METHOD| and buffer pool. This is our API so we can do this. This also requires adding an |SSL_CTX*| argument to |SSL_SESSION_new| for the same reason. However, |SSL_SESSION_new| already has very few callers (and none in third-party code that I can see) so I think we can get away with this. Change-Id: I1337cd2bd8cff03d4b9405ea3146b3b59584aa72 Reviewed-on: https://boringssl-review.googlesource.com/13584 Reviewed-by: Adam Langley <alangley@gmail.com> Commit-Queue: Adam Langley <alangley@gmail.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-01 23:49:37 +00:00
bssl::UniquePtr<SSL_CTX> ssl_ctx(SSL_CTX_new(TLS_method()));
if (!ssl_ctx) {
return nullptr;
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
bssl::UniquePtr<SSL_SESSION> session(
Remove |X509| things from SSL_SESSION. |SSL_SESSION_from_bytes| now takes an |SSL_CTX*|, from which it uses the |X509_METHOD| and buffer pool. This is our API so we can do this. This also requires adding an |SSL_CTX*| argument to |SSL_SESSION_new| for the same reason. However, |SSL_SESSION_new| already has very few callers (and none in third-party code that I can see) so I think we can get away with this. Change-Id: I1337cd2bd8cff03d4b9405ea3146b3b59584aa72 Reviewed-on: https://boringssl-review.googlesource.com/13584 Reviewed-by: Adam Langley <alangley@gmail.com> Commit-Queue: Adam Langley <alangley@gmail.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-01 23:49:37 +00:00
SSL_SESSION_from_bytes(der.data(), der.size(), ssl_ctx.get()));
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
if (!session) {
return nullptr;
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
session->ssl_version = version;
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
// Swap out the ticket for a garbage one.
OPENSSL_free(session->tlsext_tick);
session->tlsext_tick = reinterpret_cast<uint8_t*>(OPENSSL_malloc(ticket_len));
if (session->tlsext_tick == nullptr) {
return nullptr;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memset(session->tlsext_tick, 'a', ticket_len);
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
session->tlsext_ticklen = ticket_len;
Never use the internal session cache for a client. The internal session cache is keyed on session ID, so this is completely useless for clients (indeed we never look it up internally). Along the way, tidy up ssl_update_cache to be more readable. The slight behavior change is that SSL_CTX_add_session's return code no longer controls the external callback. It's not clear to me what that could have accomplished. (It can only fail on allocation error. We only call it for new sessions, so the duplicate case is impossible.) The one thing of value the internal cache might have provided is managing the timeout. The SSL_CTX_flush_sessions logic would flip the not_resumable bit and cause us not to offer expired sessions (modulo SSL_CTX_flush_sessions's delay and any discrepancies between the two caches). Instead, just check expiration when deciding whether or not to offer a session. This way clients that set SSL_SESS_CACHE_CLIENT blindly don't accidentally consume gobs of memory. BUG=531194 Change-Id: If97485beab21874f37737edc44df24e61ce23705 Reviewed-on: https://boringssl-review.googlesource.com/6321 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 20:18:55 +01:00
// Fix up the timeout.
Fix run_tests on fuzzer-mode builds. Change-Id: I0767cd4801924170ce13b8143a9586485b8f78af Reviewed-on: https://boringssl-review.googlesource.com/12280 Reviewed-by: Steven Valdez <svaldez@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-15 05:44:05 +00:00
#if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
session->time = 1234;
#else
Never use the internal session cache for a client. The internal session cache is keyed on session ID, so this is completely useless for clients (indeed we never look it up internally). Along the way, tidy up ssl_update_cache to be more readable. The slight behavior change is that SSL_CTX_add_session's return code no longer controls the external callback. It's not clear to me what that could have accomplished. (It can only fail on allocation error. We only call it for new sessions, so the duplicate case is impossible.) The one thing of value the internal cache might have provided is managing the timeout. The SSL_CTX_flush_sessions logic would flip the not_resumable bit and cause us not to offer expired sessions (modulo SSL_CTX_flush_sessions's delay and any discrepancies between the two caches). Instead, just check expiration when deciding whether or not to offer a session. This way clients that set SSL_SESS_CACHE_CLIENT blindly don't accidentally consume gobs of memory. BUG=531194 Change-Id: If97485beab21874f37737edc44df24e61ce23705 Reviewed-on: https://boringssl-review.googlesource.com/6321 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 20:18:55 +01:00
session->time = time(NULL);
Fix run_tests on fuzzer-mode builds. Change-Id: I0767cd4801924170ce13b8143a9586485b8f78af Reviewed-on: https://boringssl-review.googlesource.com/12280 Reviewed-by: Steven Valdez <svaldez@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-15 05:44:05 +00:00
#endif
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
return session;
}
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
static bool GetClientHello(SSL *ssl, std::vector<uint8_t> *out) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<BIO> bio(BIO_new(BIO_s_mem()));
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
if (!bio) {
return false;
}
// Do not configure a reading BIO, but record what's written to a memory BIO.
Finish aligning up_ref functions with OpenSSL 1.1.0. All external callers should be resolved now. BUG=89 Change-Id: I6055450e8202c59cca49e4a824be3ec11c32a15a Reviewed-on: https://boringssl-review.googlesource.com/10285 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-11 17:14:47 +01:00
BIO_up_ref(bio.get());
SSL_set_bio(ssl, nullptr /* rbio */, bio.get());
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
int ret = SSL_connect(ssl);
if (ret > 0) {
// SSL_connect should fail without a BIO to write to.
return false;
}
ERR_clear_error();
const uint8_t *client_hello;
size_t client_hello_len;
if (!BIO_mem_contents(bio.get(), &client_hello, &client_hello_len)) {
return false;
}
*out = std::vector<uint8_t>(client_hello, client_hello + client_hello_len);
return true;
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
// GetClientHelloLen creates a client SSL connection with the specified version
// and ticket length. It returns the length of the ClientHello, not including
// the record header, on success and zero on error.
static size_t GetClientHelloLen(uint16_t max_version, uint16_t session_version,
size_t ticket_len) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
bssl::UniquePtr<SSL_SESSION> session =
CreateSessionWithTicket(session_version, ticket_len);
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
if (!ctx || !session) {
return 0;
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
// Set a one-element cipher list so the baseline ClientHello is unpadded.
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> ssl(SSL_new(ctx.get()));
Run TestSequenceNumber at all versions. There were some logic errors that were revealed by testing at TLS 1.3. Also explicitly test GetClientHelloLen at TLS 1.2 (rather than relying on the default) since the TLS 1.3 ClientHello is too large. Change-Id: I907cb6ac04b40f845e99593bad06739132ca56b2 Reviewed-on: https://boringssl-review.googlesource.com/11605 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-10-14 17:08:12 +01:00
if (!ssl || !SSL_set_session(ssl.get(), session.get()) ||
Add new cipherlist-setting APIs that reject nonsense. The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2017-02-18 06:08:23 +00:00
!SSL_set_strict_cipher_list(ssl.get(), "ECDHE-RSA-AES128-GCM-SHA256") ||
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
!SSL_set_max_proto_version(ssl.get(), max_version)) {
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
return 0;
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
std::vector<uint8_t> client_hello;
if (!GetClientHello(ssl.get(), &client_hello) ||
client_hello.size() <= SSL3_RT_HEADER_LENGTH) {
Revert "Add tests to ensure our ClientHello does not change." This reverts commit 69f40dff83aed9de7e480f658dea65c191bfec7a. I'm not sure why the CQ didn't catch it while the bots didn't, but I'll look into it after the QUIC BoF. Change-Id: Ia187787c86aab082b9cffe0c86c828805dfc212d Reviewed-on: https://boringssl-review.googlesource.com/8870 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-20 10:16:57 +01:00
return 0;
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
return client_hello.size() - SSL3_RT_HEADER_LENGTH;
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
}
struct PaddingTest {
size_t input_len, padded_len;
};
static const PaddingTest kPaddingTests[] = {
// ClientHellos of length below 0x100 do not require padding.
{0xfe, 0xfe},
{0xff, 0xff},
// ClientHellos of length 0x100 through 0x1fb are padded up to 0x200.
{0x100, 0x200},
{0x123, 0x200},
{0x1fb, 0x200},
// ClientHellos of length 0x1fc through 0x1ff get padded beyond 0x200. The
// padding extension takes a minimum of four bytes plus one required content
// byte. (To work around yet more server bugs, we avoid empty final
// extensions.)
{0x1fc, 0x201},
{0x1fd, 0x202},
{0x1fe, 0x203},
{0x1ff, 0x204},
// Finally, larger ClientHellos need no padding.
{0x200, 0x200},
{0x201, 0x201},
};
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
static bool TestPaddingExtension(uint16_t max_version,
uint16_t session_version) {
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
// Sample a baseline length.
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
size_t base_len = GetClientHelloLen(max_version, session_version, 1);
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
if (base_len == 0) {
return false;
}
for (const PaddingTest &test : kPaddingTests) {
if (base_len > test.input_len) {
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
fprintf(stderr,
"Baseline ClientHello too long (max_version = %04x, "
"session_version = %04x).\n",
max_version, session_version);
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
return false;
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
size_t padded_len = GetClientHelloLen(max_version, session_version,
1 + test.input_len - base_len);
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
if (padded_len != test.padded_len) {
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
fprintf(stderr,
"%u-byte ClientHello padded to %u bytes, not %u (max_version = "
"%04x, session_version = %04x).\n",
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
static_cast<unsigned>(test.input_len),
static_cast<unsigned>(padded_len),
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
static_cast<unsigned>(test.padded_len), max_version,
session_version);
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
return false;
}
}
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
Add tests for the padding extension. This sort of test is more suitable for ssl_test than runner. This should stress all the various cases around padding. Use tickets rather than hostnames to inflate the ClientHello because there's a fairly tight maximum hostname length. Change-Id: Ibd43aaa7acb9bf5fa00a9d2548d2101e5bb147d3 Reviewed-on: https://boringssl-review.googlesource.com/5480 Reviewed-by: Adam Langley <agl@google.com>
2015-07-22 03:03:43 +01:00
return true;
}
Make SSL_get_client_CA_list slightly more OpenSSL-compatible. SSL_get_client_CA_list is one of those dreaded functions which may query either configuration state or handshake state. Moreover, it does so based on |ssl->server|, which may not be configured until later. Also check |ssl->handshake_func| to make sure |ssl| is not in an indeterminate state. This also fixes a bug where SSL_get_client_CA_list wouldn't work in DTLS due to the incorrect |ssl->version| check. Change-Id: Ie564dbfeecd2c8257fd6bcb148bc5db827390c77 Reviewed-on: https://boringssl-review.googlesource.com/5827 Reviewed-by: Adam Langley <agl@google.com>
2015-09-08 22:41:40 +01:00
// Test that |SSL_get_client_CA_list| echoes back the configured parameter even
// before configuring as a server.
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
TEST(SSLTest, ClientCAList) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ctx);
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> ssl(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
Make SSL_get_client_CA_list slightly more OpenSSL-compatible. SSL_get_client_CA_list is one of those dreaded functions which may query either configuration state or handshake state. Moreover, it does so based on |ssl->server|, which may not be configured until later. Also check |ssl->handshake_func| to make sure |ssl| is not in an indeterminate state. This also fixes a bug where SSL_get_client_CA_list wouldn't work in DTLS due to the incorrect |ssl->version| check. Change-Id: Ie564dbfeecd2c8257fd6bcb148bc5db827390c77 Reviewed-on: https://boringssl-review.googlesource.com/5827 Reviewed-by: Adam Langley <agl@google.com>
2015-09-08 22:41:40 +01:00
Hold CA names as |CRYPTO_BUFFER|s. This change converts the CA names that are parsed from a server's CertificateRequest, as well as the CA names that are configured for sending to clients in the same, to use |CRYPTO_BUFFER|. The |X509_NAME|-based interfaces are turned into compatibility wrappers. Change-Id: I95304ecc988ee39320499739a0866c7f8ff5ed98 Reviewed-on: https://boringssl-review.googlesource.com/13585 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-02 18:57:17 +00:00
bssl::UniquePtr<X509_NAME> name(X509_NAME_new());
ASSERT_TRUE(name);
bssl::UniquePtr<X509_NAME> name_dup(X509_NAME_dup(name.get()));
ASSERT_TRUE(name_dup);
bssl::UniquePtr<STACK_OF(X509_NAME)> stack(sk_X509_NAME_new_null());
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(stack);
Hold CA names as |CRYPTO_BUFFER|s. This change converts the CA names that are parsed from a server's CertificateRequest, as well as the CA names that are configured for sending to clients in the same, to use |CRYPTO_BUFFER|. The |X509_NAME|-based interfaces are turned into compatibility wrappers. Change-Id: I95304ecc988ee39320499739a0866c7f8ff5ed98 Reviewed-on: https://boringssl-review.googlesource.com/13585 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-02 18:57:17 +00:00
ASSERT_TRUE(sk_X509_NAME_push(stack.get(), name_dup.get()));
name_dup.release();
Make SSL_get_client_CA_list slightly more OpenSSL-compatible. SSL_get_client_CA_list is one of those dreaded functions which may query either configuration state or handshake state. Moreover, it does so based on |ssl->server|, which may not be configured until later. Also check |ssl->handshake_func| to make sure |ssl| is not in an indeterminate state. This also fixes a bug where SSL_get_client_CA_list wouldn't work in DTLS due to the incorrect |ssl->version| check. Change-Id: Ie564dbfeecd2c8257fd6bcb148bc5db827390c77 Reviewed-on: https://boringssl-review.googlesource.com/5827 Reviewed-by: Adam Langley <agl@google.com>
2015-09-08 22:41:40 +01:00
// |SSL_set_client_CA_list| takes ownership.
Hold CA names as |CRYPTO_BUFFER|s. This change converts the CA names that are parsed from a server's CertificateRequest, as well as the CA names that are configured for sending to clients in the same, to use |CRYPTO_BUFFER|. The |X509_NAME|-based interfaces are turned into compatibility wrappers. Change-Id: I95304ecc988ee39320499739a0866c7f8ff5ed98 Reviewed-on: https://boringssl-review.googlesource.com/13585 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-02 18:57:17 +00:00
SSL_set_client_CA_list(ssl.get(), stack.release());
Make SSL_get_client_CA_list slightly more OpenSSL-compatible. SSL_get_client_CA_list is one of those dreaded functions which may query either configuration state or handshake state. Moreover, it does so based on |ssl->server|, which may not be configured until later. Also check |ssl->handshake_func| to make sure |ssl| is not in an indeterminate state. This also fixes a bug where SSL_get_client_CA_list wouldn't work in DTLS due to the incorrect |ssl->version| check. Change-Id: Ie564dbfeecd2c8257fd6bcb148bc5db827390c77 Reviewed-on: https://boringssl-review.googlesource.com/5827 Reviewed-by: Adam Langley <agl@google.com>
2015-09-08 22:41:40 +01:00
Hold CA names as |CRYPTO_BUFFER|s. This change converts the CA names that are parsed from a server's CertificateRequest, as well as the CA names that are configured for sending to clients in the same, to use |CRYPTO_BUFFER|. The |X509_NAME|-based interfaces are turned into compatibility wrappers. Change-Id: I95304ecc988ee39320499739a0866c7f8ff5ed98 Reviewed-on: https://boringssl-review.googlesource.com/13585 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-02 18:57:17 +00:00
STACK_OF(X509_NAME) *result = SSL_get_client_CA_list(ssl.get());
ASSERT_TRUE(result);
ASSERT_EQ(1u, sk_X509_NAME_num(result));
EXPECT_EQ(0, X509_NAME_cmp(sk_X509_NAME_value(result, 0), name.get()));
Make SSL_get_client_CA_list slightly more OpenSSL-compatible. SSL_get_client_CA_list is one of those dreaded functions which may query either configuration state or handshake state. Moreover, it does so based on |ssl->server|, which may not be configured until later. Also check |ssl->handshake_func| to make sure |ssl| is not in an indeterminate state. This also fixes a bug where SSL_get_client_CA_list wouldn't work in DTLS due to the incorrect |ssl->version| check. Change-Id: Ie564dbfeecd2c8257fd6bcb148bc5db827390c77 Reviewed-on: https://boringssl-review.googlesource.com/5827 Reviewed-by: Adam Langley <agl@google.com>
2015-09-08 22:41:40 +01:00
}
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
static void AppendSession(SSL_SESSION *session, void *arg) {
std::vector<SSL_SESSION*> *out =
reinterpret_cast<std::vector<SSL_SESSION*>*>(arg);
out->push_back(session);
}
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
// CacheEquals returns true if |ctx|'s session cache consists of |expected|, in
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
// order.
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
static bool CacheEquals(SSL_CTX *ctx,
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
const std::vector<SSL_SESSION*> &expected) {
// Check the linked list.
SSL_SESSION *ptr = ctx->session_cache_head;
for (SSL_SESSION *session : expected) {
if (ptr != session) {
return false;
}
// TODO(davidben): This is an absurd way to denote the end of the list.
if (ptr->next ==
reinterpret_cast<SSL_SESSION *>(&ctx->session_cache_tail)) {
ptr = nullptr;
} else {
ptr = ptr->next;
}
}
if (ptr != nullptr) {
return false;
}
// Check the hash table.
std::vector<SSL_SESSION*> actual, expected_copy;
lh_SSL_SESSION_doall_arg(SSL_CTX_sessions(ctx), AppendSession, &actual);
expected_copy = expected;
std::sort(actual.begin(), actual.end());
std::sort(expected_copy.begin(), expected_copy.end());
return actual == expected_copy;
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
static bssl::UniquePtr<SSL_SESSION> CreateTestSession(uint32_t number) {
Remove |X509| things from SSL_SESSION. |SSL_SESSION_from_bytes| now takes an |SSL_CTX*|, from which it uses the |X509_METHOD| and buffer pool. This is our API so we can do this. This also requires adding an |SSL_CTX*| argument to |SSL_SESSION_new| for the same reason. However, |SSL_SESSION_new| already has very few callers (and none in third-party code that I can see) so I think we can get away with this. Change-Id: I1337cd2bd8cff03d4b9405ea3146b3b59584aa72 Reviewed-on: https://boringssl-review.googlesource.com/13584 Reviewed-by: Adam Langley <alangley@gmail.com> Commit-Queue: Adam Langley <alangley@gmail.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-01 23:49:37 +00:00
bssl::UniquePtr<SSL_CTX> ssl_ctx(SSL_CTX_new(TLS_method()));
if (!ssl_ctx) {
return nullptr;
}
bssl::UniquePtr<SSL_SESSION> ret(SSL_SESSION_new(ssl_ctx.get()));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
if (!ret) {
return nullptr;
}
ret->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memset(ret->session_id, 0, ret->session_id_length);
OPENSSL_memcpy(ret->session_id, &number, sizeof(number));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
return ret;
}
// Test that the internal session cache behaves as expected.
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
TEST(SSLTest, InternalSessionCache) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ASSERT_TRUE(ctx);
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
// Prepare 10 test sessions.
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
std::vector<bssl::UniquePtr<SSL_SESSION>> sessions;
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
for (int i = 0; i < 10; i++) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_SESSION> session = CreateTestSession(i);
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ASSERT_TRUE(session);
Use more C++11 features. Finally, we can stick ScopedFOO in containers. Change-Id: I3ed166575822af9f182e8be8f4db723e1f08ea31 Reviewed-on: https://boringssl-review.googlesource.com/6553 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-11-21 08:00:50 +00:00
sessions.push_back(std::move(session));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
}
SSL_CTX_sess_set_cache_size(ctx.get(), 5);
// Insert all the test sessions.
Use more C++11 features. Finally, we can stick ScopedFOO in containers. Change-Id: I3ed166575822af9f182e8be8f4db723e1f08ea31 Reviewed-on: https://boringssl-review.googlesource.com/6553 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-11-21 08:00:50 +00:00
for (const auto &session : sessions) {
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ASSERT_TRUE(SSL_CTX_add_session(ctx.get(), session.get()));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
}
// Only the last five should be in the list.
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ASSERT_TRUE(CacheEquals(
ctx.get(), {sessions[9].get(), sessions[8].get(), sessions[7].get(),
sessions[6].get(), sessions[5].get()}));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
// Inserting an element already in the cache should fail and leave the cache
// unchanged.
ASSERT_FALSE(SSL_CTX_add_session(ctx.get(), sessions[7].get()));
ASSERT_TRUE(CacheEquals(
ctx.get(), {sessions[9].get(), sessions[8].get(), sessions[7].get(),
sessions[6].get(), sessions[5].get()}));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
// Although collisions should be impossible (256-bit session IDs), the cache
// must handle them gracefully.
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_SESSION> collision(CreateTestSession(7));
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ASSERT_TRUE(collision);
ASSERT_TRUE(SSL_CTX_add_session(ctx.get(), collision.get()));
ASSERT_TRUE(CacheEquals(
ctx.get(), {collision.get(), sessions[9].get(), sessions[8].get(),
sessions[6].get(), sessions[5].get()}));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
// Removing sessions behaves correctly.
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ASSERT_TRUE(SSL_CTX_remove_session(ctx.get(), sessions[6].get()));
ASSERT_TRUE(CacheEquals(ctx.get(), {collision.get(), sessions[9].get(),
sessions[8].get(), sessions[5].get()}));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
// Removing sessions requires an exact match.
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
ASSERT_FALSE(SSL_CTX_remove_session(ctx.get(), sessions[0].get()));
ASSERT_FALSE(SSL_CTX_remove_session(ctx.get(), sessions[7].get()));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
// The cache remains unchanged.
ASSERT_TRUE(CacheEquals(ctx.get(), {collision.get(), sessions[9].get(),
sessions[8].get(), sessions[5].get()}));
Add tests for the internal session cache behavior. In doing so, fix the documentation for SSL_CTX_add_session and SSL_CTX_remove_session. I misread the code and documented the behavior on session ID collision wrong. Change-Id: I6f364305e1f092b9eb0b1402962fd04577269d30 Reviewed-on: https://boringssl-review.googlesource.com/6319 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-18 19:28:01 +01:00
}
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
static uint16_t EpochFromSequence(uint64_t seq) {
return static_cast<uint16_t>(seq >> 48);
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
static bssl::UniquePtr<X509> GetTestCertificate() {
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
static const char kCertPEM[] =
"-----BEGIN CERTIFICATE-----\n"
"MIICWDCCAcGgAwIBAgIJAPuwTC6rEJsMMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV\n"
"BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX\n"
"aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDIzMjA1MDQwWhcNMTcwNDIyMjA1MDQwWjBF\n"
"MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50\n"
"ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\n"
"gQDYK8imMuRi/03z0K1Zi0WnvfFHvwlYeyK9Na6XJYaUoIDAtB92kWdGMdAQhLci\n"
"HnAjkXLI6W15OoV3gA/ElRZ1xUpxTMhjP6PyY5wqT5r6y8FxbiiFKKAnHmUcrgfV\n"
"W28tQ+0rkLGMryRtrukXOgXBv7gcrmU7G1jC2a7WqmeI8QIDAQABo1AwTjAdBgNV\n"
"HQ4EFgQUi3XVrMsIvg4fZbf6Vr5sp3Xaha8wHwYDVR0jBBgwFoAUi3XVrMsIvg4f\n"
"Zbf6Vr5sp3Xaha8wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA76Hht\n"
"ldY9avcTGSwbwoiuIqv0jTL1fHFnzy3RHMLDh+Lpvolc5DSrSJHCP5WuK0eeJXhr\n"
"T5oQpHL9z/cCDLAKCKRa4uV0fhEdOWBqyR9p8y5jJtye72t6CuFUV5iqcpF4BH4f\n"
"j2VNHwsSrJwkD4QUGlUtH7vwnQmyCFxZMmWAJg==\n"
"-----END CERTIFICATE-----\n";
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(kCertPEM, strlen(kCertPEM)));
Add tests for auto-chaining. Alas, wpa_supplicant relies on the auto-chaining feature, so we can't easily remove it. Write tests for it to ensure it stays working. These test currently do not work for TLS 1.3 because the feature is broken in 1.3. A follow-up change will fix this. BUG=70 Change-Id: I2c04f55b712d66f5af1556254a5b017ebc3244f7 Reviewed-on: https://boringssl-review.googlesource.com/12965 Reviewed-by: Adam Langley <agl@google.com>
2016-12-20 22:23:11 +00:00
return bssl::UniquePtr<X509>(
PEM_read_bio_X509(bio.get(), nullptr, nullptr, nullptr));
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
static bssl::UniquePtr<EVP_PKEY> GetTestKey() {
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
static const char kKeyPEM[] =
"-----BEGIN RSA PRIVATE KEY-----\n"
"MIICXgIBAAKBgQDYK8imMuRi/03z0K1Zi0WnvfFHvwlYeyK9Na6XJYaUoIDAtB92\n"
"kWdGMdAQhLciHnAjkXLI6W15OoV3gA/ElRZ1xUpxTMhjP6PyY5wqT5r6y8FxbiiF\n"
"KKAnHmUcrgfVW28tQ+0rkLGMryRtrukXOgXBv7gcrmU7G1jC2a7WqmeI8QIDAQAB\n"
"AoGBAIBy09Fd4DOq/Ijp8HeKuCMKTHqTW1xGHshLQ6jwVV2vWZIn9aIgmDsvkjCe\n"
"i6ssZvnbjVcwzSoByhjN8ZCf/i15HECWDFFh6gt0P5z0MnChwzZmvatV/FXCT0j+\n"
"WmGNB/gkehKjGXLLcjTb6dRYVJSCZhVuOLLcbWIV10gggJQBAkEA8S8sGe4ezyyZ\n"
"m4e9r95g6s43kPqtj5rewTsUxt+2n4eVodD+ZUlCULWVNAFLkYRTBCASlSrm9Xhj\n"
"QpmWAHJUkQJBAOVzQdFUaewLtdOJoPCtpYoY1zd22eae8TQEmpGOR11L6kbxLQsk\n"
"aMly/DOnOaa82tqAGTdqDEZgSNmCeKKknmECQAvpnY8GUOVAubGR6c+W90iBuQLj\n"
"LtFp/9ihd2w/PoDwrHZaoUYVcT4VSfJQog/k7kjE4MYXYWL8eEKg3WTWQNECQQDk\n"
"104Wi91Umd1PzF0ijd2jXOERJU1wEKe6XLkYYNHWQAe5l4J4MWj9OdxFXAxIuuR/\n"
"tfDwbqkta4xcux67//khAkEAvvRXLHTaa6VFzTaiiO8SaFsHV3lQyXOtMrBpB5jd\n"
"moZWgjHvB2W9Ckn7sDqsPB+U2tyX0joDdQEyuiMECDY8oQ==\n"
"-----END RSA PRIVATE KEY-----\n";
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(kKeyPEM, strlen(kKeyPEM)));
return bssl::UniquePtr<EVP_PKEY>(
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
PEM_read_bio_PrivateKey(bio.get(), nullptr, nullptr, nullptr));
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
static bssl::UniquePtr<X509> GetECDSATestCertificate() {
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
static const char kCertPEM[] =
"-----BEGIN CERTIFICATE-----\n"
"MIIBzzCCAXagAwIBAgIJANlMBNpJfb/rMAkGByqGSM49BAEwRTELMAkGA1UEBhMC\n"
"QVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdp\n"
"dHMgUHR5IEx0ZDAeFw0xNDA0MjMyMzIxNTdaFw0xNDA1MjMyMzIxNTdaMEUxCzAJ\n"
"BgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5l\n"
"dCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATmK2ni\n"
"v2Wfl74vHg2UikzVl2u3qR4NRvvdqakendy6WgHn1peoChj5w8SjHlbifINI2xYa\n"
"HPUdfvGULUvPciLBo1AwTjAdBgNVHQ4EFgQUq4TSrKuV8IJOFngHVVdf5CaNgtEw\n"
"HwYDVR0jBBgwFoAUq4TSrKuV8IJOFngHVVdf5CaNgtEwDAYDVR0TBAUwAwEB/zAJ\n"
"BgcqhkjOPQQBA0gAMEUCIQDyoDVeUTo2w4J5m+4nUIWOcAZ0lVfSKXQA9L4Vh13E\n"
"BwIgfB55FGohg/B6dGh5XxSZmmi08cueFV7mHzJSYV51yRQ=\n"
"-----END CERTIFICATE-----\n";
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(kCertPEM, strlen(kCertPEM)));
return bssl::UniquePtr<X509>(PEM_read_bio_X509(bio.get(), nullptr, nullptr, nullptr));
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
static bssl::UniquePtr<EVP_PKEY> GetECDSATestKey() {
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
static const char kKeyPEM[] =
"-----BEGIN PRIVATE KEY-----\n"
"MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgBw8IcnrUoEqc3VnJ\n"
"TYlodwi1b8ldMHcO6NHJzgqLtGqhRANCAATmK2niv2Wfl74vHg2UikzVl2u3qR4N\n"
"Rvvdqakendy6WgHn1peoChj5w8SjHlbifINI2xYaHPUdfvGULUvPciLB\n"
"-----END PRIVATE KEY-----\n";
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(kKeyPEM, strlen(kKeyPEM)));
return bssl::UniquePtr<EVP_PKEY>(
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
PEM_read_bio_PrivateKey(bio.get(), nullptr, nullptr, nullptr));
}
Add |SSL[_CTX]_set_chain_and_key|. This allows a caller to configure a serving chain without dealing with crypto/x509. Change-Id: Ib42bb2ab9227d32071cf13ab07f92d029643a9a6 Reviewed-on: https://boringssl-review.googlesource.com/14126 Commit-Queue: Adam Langley <alangley@gmail.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-28 19:26:51 +00:00
static bssl::UniquePtr<CRYPTO_BUFFER> BufferFromPEM(const char *pem) {
bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(pem, strlen(pem)));
char *name, *header;
uint8_t *data;
long data_len;
if (!PEM_read_bio(bio.get(), &name, &header, &data,
&data_len)) {
return nullptr;
}
OPENSSL_free(name);
OPENSSL_free(header);
auto ret = bssl::UniquePtr<CRYPTO_BUFFER>(
CRYPTO_BUFFER_new(data, data_len, nullptr));
OPENSSL_free(data);
return ret;
}
static bssl::UniquePtr<CRYPTO_BUFFER> GetChainTestCertificateBuffer() {
Add tests for auto-chaining. Alas, wpa_supplicant relies on the auto-chaining feature, so we can't easily remove it. Write tests for it to ensure it stays working. These test currently do not work for TLS 1.3 because the feature is broken in 1.3. A follow-up change will fix this. BUG=70 Change-Id: I2c04f55b712d66f5af1556254a5b017ebc3244f7 Reviewed-on: https://boringssl-review.googlesource.com/12965 Reviewed-by: Adam Langley <agl@google.com>
2016-12-20 22:23:11 +00:00
static const char kCertPEM[] =
"-----BEGIN CERTIFICATE-----\n"
"MIIC0jCCAbqgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwDzENMAsGA1UEAwwEQiBD\n"
"QTAeFw0xNjAyMjgyMDI3MDNaFw0yNjAyMjUyMDI3MDNaMBgxFjAUBgNVBAMMDUNs\n"
"aWVudCBDZXJ0IEEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRvaz8\n"
"CC/cshpCafJo4jLkHEoBqDLhdgFelJoAiQUyIqyWl2O7YHPnpJH+TgR7oelzNzt/\n"
"kLRcH89M/TszB6zqyLTC4aqmvzKL0peD/jL2LWBucR0WXIvjA3zoRuF/x86+rYH3\n"
"tHb+xs2PSs8EGL/Ev+ss+qTzTGEn26fuGNHkNw6tOwPpc+o8+wUtzf/kAthamo+c\n"
"IDs2rQ+lP7+aLZTLeU/q4gcLutlzcK5imex5xy2jPkweq48kijK0kIzl1cPlA5d1\n"
"z7C8jU50Pj9X9sQDJTN32j7UYRisJeeYQF8GaaN8SbrDI6zHgKzrRLyxDt/KQa9V\n"
"iLeXANgZi+Xx9KgfAgMBAAGjLzAtMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYI\n"
"KwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQBFEVbmYl+2RtNw\n"
"rDftRDF1v2QUbcN2ouSnQDHxeDQdSgasLzT3ui8iYu0Rw2WWcZ0DV5e0ztGPhWq7\n"
"AO0B120aFRMOY+4+bzu9Q2FFkQqc7/fKTvTDzIJI5wrMnFvUfzzvxh3OHWMYSs/w\n"
"giq33hTKeHEq6Jyk3btCny0Ycecyc3yGXH10sizUfiHlhviCkDuESk8mFDwDDzqW\n"
"ZF0IipzFbEDHoIxLlm3GQxpiLoEV4k8KYJp3R5KBLFyxM6UGPz8h72mIPCJp2RuK\n"
"MYgF91UDvVzvnYm6TfseM2+ewKirC00GOrZ7rEcFvtxnKSqYf4ckqfNdSU1Y+RRC\n"
"1ngWZ7Ih\n"
"-----END CERTIFICATE-----\n";
Add |SSL[_CTX]_set_chain_and_key|. This allows a caller to configure a serving chain without dealing with crypto/x509. Change-Id: Ib42bb2ab9227d32071cf13ab07f92d029643a9a6 Reviewed-on: https://boringssl-review.googlesource.com/14126 Commit-Queue: Adam Langley <alangley@gmail.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-28 19:26:51 +00:00
return BufferFromPEM(kCertPEM);
}
static bssl::UniquePtr<X509> X509FromBuffer(
bssl::UniquePtr<CRYPTO_BUFFER> buffer) {
if (!buffer) {
return nullptr;
}
const uint8_t *derp = CRYPTO_BUFFER_data(buffer.get());
Add tests for auto-chaining. Alas, wpa_supplicant relies on the auto-chaining feature, so we can't easily remove it. Write tests for it to ensure it stays working. These test currently do not work for TLS 1.3 because the feature is broken in 1.3. A follow-up change will fix this. BUG=70 Change-Id: I2c04f55b712d66f5af1556254a5b017ebc3244f7 Reviewed-on: https://boringssl-review.googlesource.com/12965 Reviewed-by: Adam Langley <agl@google.com>
2016-12-20 22:23:11 +00:00
return bssl::UniquePtr<X509>(
Add |SSL[_CTX]_set_chain_and_key|. This allows a caller to configure a serving chain without dealing with crypto/x509. Change-Id: Ib42bb2ab9227d32071cf13ab07f92d029643a9a6 Reviewed-on: https://boringssl-review.googlesource.com/14126 Commit-Queue: Adam Langley <alangley@gmail.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-28 19:26:51 +00:00
d2i_X509(NULL, &derp, CRYPTO_BUFFER_len(buffer.get())));
Add tests for auto-chaining. Alas, wpa_supplicant relies on the auto-chaining feature, so we can't easily remove it. Write tests for it to ensure it stays working. These test currently do not work for TLS 1.3 because the feature is broken in 1.3. A follow-up change will fix this. BUG=70 Change-Id: I2c04f55b712d66f5af1556254a5b017ebc3244f7 Reviewed-on: https://boringssl-review.googlesource.com/12965 Reviewed-by: Adam Langley <agl@google.com>
2016-12-20 22:23:11 +00:00
}
Add |SSL[_CTX]_set_chain_and_key|. This allows a caller to configure a serving chain without dealing with crypto/x509. Change-Id: Ib42bb2ab9227d32071cf13ab07f92d029643a9a6 Reviewed-on: https://boringssl-review.googlesource.com/14126 Commit-Queue: Adam Langley <alangley@gmail.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-28 19:26:51 +00:00
static bssl::UniquePtr<X509> GetChainTestCertificate() {
return X509FromBuffer(GetChainTestCertificateBuffer());
}
static bssl::UniquePtr<CRYPTO_BUFFER> GetChainTestIntermediateBuffer() {
Add tests for auto-chaining. Alas, wpa_supplicant relies on the auto-chaining feature, so we can't easily remove it. Write tests for it to ensure it stays working. These test currently do not work for TLS 1.3 because the feature is broken in 1.3. A follow-up change will fix this. BUG=70 Change-Id: I2c04f55b712d66f5af1556254a5b017ebc3244f7 Reviewed-on: https://boringssl-review.googlesource.com/12965 Reviewed-by: Adam Langley <agl@google.com>
2016-12-20 22:23:11 +00:00
static const char kCertPEM[] =
"-----BEGIN CERTIFICATE-----\n"
"MIICwjCCAaqgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwFDESMBAGA1UEAwwJQyBS\n"
"b290IENBMB4XDTE2MDIyODIwMjcwM1oXDTI2MDIyNTIwMjcwM1owDzENMAsGA1UE\n"
"AwwEQiBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALsSCYmDip2D\n"
"GkjFxw7ykz26JSjELkl6ArlYjFJ3aT/SCh8qbS4gln7RH8CPBd78oFdfhIKQrwtZ\n"
"3/q21ykD9BAS3qHe2YdcJfm8/kWAy5DvXk6NXU4qX334KofBAEpgdA/igEFq1P1l\n"
"HAuIfZCpMRfT+i5WohVsGi8f/NgpRvVaMONLNfgw57mz1lbtFeBEISmX0kbsuJxF\n"
"Qj/Bwhi5/0HAEXG8e7zN4cEx0yPRvmOATRdVb/8dW2pwOHRJq9R5M0NUkIsTSnL7\n"
"6N/z8hRAHMsV3IudC5Yd7GXW1AGu9a+iKU+Q4xcZCoj0DC99tL4VKujrV1kAeqsM\n"
"cz5/dKzi6+cCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
"AQYwDQYJKoZIhvcNAQELBQADggEBAIIeZiEeNhWWQ8Y4D+AGDwqUUeG8NjCbKrXQ\n"
"BlHg5wZ8xftFaiP1Dp/UAezmx2LNazdmuwrYB8lm3FVTyaPDTKEGIPS4wJKHgqH1\n"
"QPDhqNm85ey7TEtI9oYjsNim/Rb+iGkIAMXaxt58SzxbjvP0kMr1JfJIZbic9vye\n"
"NwIspMFIpP3FB8ywyu0T0hWtCQgL4J47nigCHpOu58deP88fS/Nyz/fyGVWOZ76b\n"
"WhWwgM3P3X95fQ3d7oFPR/bVh0YV+Cf861INwplokXgXQ3/TCQ+HNXeAMWn3JLWv\n"
"XFwk8owk9dq/kQGdndGgy3KTEW4ctPX5GNhf3LJ9Q7dLji4ReQ4=\n"
"-----END CERTIFICATE-----\n";
Add |SSL[_CTX]_set_chain_and_key|. This allows a caller to configure a serving chain without dealing with crypto/x509. Change-Id: Ib42bb2ab9227d32071cf13ab07f92d029643a9a6 Reviewed-on: https://boringssl-review.googlesource.com/14126 Commit-Queue: Adam Langley <alangley@gmail.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-28 19:26:51 +00:00
return BufferFromPEM(kCertPEM);
}
static bssl::UniquePtr<X509> GetChainTestIntermediate() {
return X509FromBuffer(GetChainTestIntermediateBuffer());
Add tests for auto-chaining. Alas, wpa_supplicant relies on the auto-chaining feature, so we can't easily remove it. Write tests for it to ensure it stays working. These test currently do not work for TLS 1.3 because the feature is broken in 1.3. A follow-up change will fix this. BUG=70 Change-Id: I2c04f55b712d66f5af1556254a5b017ebc3244f7 Reviewed-on: https://boringssl-review.googlesource.com/12965 Reviewed-by: Adam Langley <agl@google.com>
2016-12-20 22:23:11 +00:00
}
static bssl::UniquePtr<EVP_PKEY> GetChainTestKey() {
static const char kKeyPEM[] =
"-----BEGIN PRIVATE KEY-----\n"
"MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRvaz8CC/cshpC\n"
"afJo4jLkHEoBqDLhdgFelJoAiQUyIqyWl2O7YHPnpJH+TgR7oelzNzt/kLRcH89M\n"
"/TszB6zqyLTC4aqmvzKL0peD/jL2LWBucR0WXIvjA3zoRuF/x86+rYH3tHb+xs2P\n"
"Ss8EGL/Ev+ss+qTzTGEn26fuGNHkNw6tOwPpc+o8+wUtzf/kAthamo+cIDs2rQ+l\n"
"P7+aLZTLeU/q4gcLutlzcK5imex5xy2jPkweq48kijK0kIzl1cPlA5d1z7C8jU50\n"
"Pj9X9sQDJTN32j7UYRisJeeYQF8GaaN8SbrDI6zHgKzrRLyxDt/KQa9ViLeXANgZ\n"
"i+Xx9KgfAgMBAAECggEBAK0VjSJzkyPaamcyTVSWjo7GdaBGcK60lk657RjR+lK0\n"
"YJ7pkej4oM2hdsVZFsP8Cs4E33nXLa/0pDsRov/qrp0WQm2skwqGMC1I/bZ0WRPk\n"
"wHaDrBBfESWnJDX/AGpVtlyOjPmgmK6J2usMPihQUDkKdAYrVWJePrMIxt1q6BMe\n"
"iczs3qriMmtY3bUc4UyUwJ5fhDLjshHvfuIpYQyI6EXZM6dZksn9LylXJnigY6QJ\n"
"HxOYO0BDwOsZ8yQ8J8afLk88i0GizEkgE1z3REtQUwgWfxr1WV/ud+T6/ZhSAgH9\n"
"042mQvSFZnIUSEsmCvjhWuAunfxHKCTcAoYISWfzWpkCgYEA7gpf3HHU5Tn+CgUn\n"
"1X5uGpG3DmcMgfeGgs2r2f/IIg/5Ac1dfYILiybL1tN9zbyLCJfcbFpWBc9hJL6f\n"
"CPc5hUiwWFJqBJewxQkC1Ae/HakHbip+IZ+Jr0842O4BAArvixk4Lb7/N2Ct9sTE\n"
"NJO6RtK9lbEZ5uK61DglHy8CS2UCgYEA4ZC1o36kPAMQBggajgnucb2yuUEelk0f\n"
"AEr+GI32MGE+93xMr7rAhBoqLg4AITyIfEnOSQ5HwagnIHonBbv1LV/Gf9ursx8Z\n"
"YOGbvT8zzzC+SU1bkDzdjAYnFQVGIjMtKOBJ3K07++ypwX1fr4QsQ8uKL8WSOWwt\n"
"Z3Bym6XiZzMCgYADnhy+2OwHX85AkLt+PyGlPbmuelpyTzS4IDAQbBa6jcuW/2wA\n"
"UE2km75VUXmD+u2R/9zVuLm99NzhFhSMqlUxdV1YukfqMfP5yp1EY6m/5aW7QuIP\n"
"2MDa7TVL9rIFMiVZ09RKvbBbQxjhuzPQKL6X/PPspnhiTefQ+dl2k9xREQKBgHDS\n"
"fMfGNEeAEKezrfSVqxphE9/tXms3L+ZpnCaT+yu/uEr5dTIAawKoQ6i9f/sf1/Sy\n"
"xedsqR+IB+oKrzIDDWMgoJybN4pkZ8E5lzhVQIjFjKgFdWLzzqyW9z1gYfABQPlN\n"
"FiS20WX0vgP1vcKAjdNrHzc9zyHBpgQzDmAj3NZZAoGBAI8vKCKdH7w3aL5CNkZQ\n"
"2buIeWNA2HZazVwAGG5F2TU/LmXfRKnG6dX5bkU+AkBZh56jNZy//hfFSewJB4Kk\n"
"buB7ERSdaNbO21zXt9FEA3+z0RfMd/Zv2vlIWOSB5nzl/7UKti3sribK6s9ZVLfi\n"
"SxpiPQ8d/hmSGwn4ksrWUsJD\n"
"-----END PRIVATE KEY-----\n";
bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(kKeyPEM, strlen(kKeyPEM)));
return bssl::UniquePtr<EVP_PKEY>(
PEM_read_bio_PrivateKey(bio.get(), nullptr, nullptr, nullptr));
}
Fix SSL_clear's interaction with session resumption. Prior to 87eab4902d1003983079881d3ee8a66ec2eaccc2, due to some confusions between configuration and connection state, SSL_clear had the side effect of offering the previously established session on the new connection. wpa_supplicant relies on this behavior, so restore it for TLS 1.2 and below and add a test. (This behavior is largely incompatible with TLS 1.3's post-handshake tickets, so it won't work in 1.3. It'll act as if we configured an unresumable session instead.) Change-Id: Iaee8c0afc1cb65c0ab7397435602732b901b1c2d Reviewed-on: https://boringssl-review.googlesource.com/12632 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-07 20:57:14 +00:00
static bool CompleteHandshakes(SSL *client, SSL *server) {
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
// Drive both their handshakes to completion.
for (;;) {
Fix SSL_clear's interaction with session resumption. Prior to 87eab4902d1003983079881d3ee8a66ec2eaccc2, due to some confusions between configuration and connection state, SSL_clear had the side effect of offering the previously established session on the new connection. wpa_supplicant relies on this behavior, so restore it for TLS 1.2 and below and add a test. (This behavior is largely incompatible with TLS 1.3's post-handshake tickets, so it won't work in 1.3. It'll act as if we configured an unresumable session instead.) Change-Id: Iaee8c0afc1cb65c0ab7397435602732b901b1c2d Reviewed-on: https://boringssl-review.googlesource.com/12632 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-07 20:57:14 +00:00
int client_ret = SSL_do_handshake(client);
int client_err = SSL_get_error(client, client_ret);
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
if (client_err != SSL_ERROR_NONE &&
client_err != SSL_ERROR_WANT_READ &&
Support asynchronous ticket decryption with TLS 1.0–1.2. This change adds support for setting an |SSL_TICKET_AEAD_METHOD| which allows a caller to control ticket encryption and decryption to a greater extent than previously possible and also permits asynchronous ticket decryption. This change only includes partial support: TLS 1.3 work remains to be done. Change-Id: Ia2e10ebb3257e1a119630c463b6bf389cf20ef18 Reviewed-on: https://boringssl-review.googlesource.com/14144 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-09 03:33:21 +00:00
client_err != SSL_ERROR_WANT_WRITE &&
client_err != SSL_ERROR_PENDING_TICKET) {
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
fprintf(stderr, "Client error: %d\n", client_err);
return false;
}
Fix SSL_clear's interaction with session resumption. Prior to 87eab4902d1003983079881d3ee8a66ec2eaccc2, due to some confusions between configuration and connection state, SSL_clear had the side effect of offering the previously established session on the new connection. wpa_supplicant relies on this behavior, so restore it for TLS 1.2 and below and add a test. (This behavior is largely incompatible with TLS 1.3's post-handshake tickets, so it won't work in 1.3. It'll act as if we configured an unresumable session instead.) Change-Id: Iaee8c0afc1cb65c0ab7397435602732b901b1c2d Reviewed-on: https://boringssl-review.googlesource.com/12632 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-07 20:57:14 +00:00
int server_ret = SSL_do_handshake(server);
int server_err = SSL_get_error(server, server_ret);
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
if (server_err != SSL_ERROR_NONE &&
server_err != SSL_ERROR_WANT_READ &&
Support asynchronous ticket decryption with TLS 1.0–1.2. This change adds support for setting an |SSL_TICKET_AEAD_METHOD| which allows a caller to control ticket encryption and decryption to a greater extent than previously possible and also permits asynchronous ticket decryption. This change only includes partial support: TLS 1.3 work remains to be done. Change-Id: Ia2e10ebb3257e1a119630c463b6bf389cf20ef18 Reviewed-on: https://boringssl-review.googlesource.com/14144 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-09 03:33:21 +00:00
server_err != SSL_ERROR_WANT_WRITE &&
server_err != SSL_ERROR_PENDING_TICKET) {
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
fprintf(stderr, "Server error: %d\n", server_err);
return false;
}
if (client_ret == 1 && server_ret == 1) {
break;
}
}
Fix SSL_clear's interaction with session resumption. Prior to 87eab4902d1003983079881d3ee8a66ec2eaccc2, due to some confusions between configuration and connection state, SSL_clear had the side effect of offering the previously established session on the new connection. wpa_supplicant relies on this behavior, so restore it for TLS 1.2 and below and add a test. (This behavior is largely incompatible with TLS 1.3's post-handshake tickets, so it won't work in 1.3. It'll act as if we configured an unresumable session instead.) Change-Id: Iaee8c0afc1cb65c0ab7397435602732b901b1c2d Reviewed-on: https://boringssl-review.googlesource.com/12632 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-07 20:57:14 +00:00
return true;
}
static bool ConnectClientAndServer(bssl::UniquePtr<SSL> *out_client,
bssl::UniquePtr<SSL> *out_server,
SSL_CTX *client_ctx, SSL_CTX *server_ctx,
SSL_SESSION *session) {
bssl::UniquePtr<SSL> client(SSL_new(client_ctx)), server(SSL_new(server_ctx));
if (!client || !server) {
return false;
}
SSL_set_connect_state(client.get());
SSL_set_accept_state(server.get());
SSL_set_session(client.get(), session);
BIO *bio1, *bio2;
if (!BIO_new_bio_pair(&bio1, 0, &bio2, 0)) {
return false;
}
// SSL_set_bio takes ownership.
SSL_set_bio(client.get(), bio1, bio1);
SSL_set_bio(server.get(), bio2, bio2);
if (!CompleteHandshakes(client.get(), server.get())) {
return false;
}
Add a unit test for one-sided shutdown. OpenSSL was actually super-buggy here (though known bugs on our end have been fixed), but pyOpenSSL was confused and incorrectly documented that callers call SSL_read after SSL_shutdown to do bidi shutdown, so we should probably support this. Add a test that it works. Change-Id: I2b6d012161330aeb4cf894bae3a0b6a55d53c70d Reviewed-on: https://boringssl-review.googlesource.com/8093 Reviewed-by: Adam Langley <agl@google.com>
2016-05-10 20:15:41 +01:00
*out_client = std::move(client);
*out_server = std::move(server);
return true;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool TestSequenceNumber(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(method));
if (!server_ctx || !client_ctx ||
!SSL_CTX_set_min_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_min_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(server_ctx.get(), version)) {
return false;
}
Add a unit test for one-sided shutdown. OpenSSL was actually super-buggy here (though known bugs on our end have been fixed), but pyOpenSSL was confused and incorrectly documented that callers call SSL_read after SSL_shutdown to do bidi shutdown, so we should probably support this. Add a test that it works. Change-Id: I2b6d012161330aeb4cf894bae3a0b6a55d53c70d Reviewed-on: https://boringssl-review.googlesource.com/8093 Reviewed-by: Adam Langley <agl@google.com>
2016-05-10 20:15:41 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
if (!cert || !key || !SSL_CTX_use_certificate(server_ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(server_ctx.get(), key.get())) {
return false;
}
Add a unit test for one-sided shutdown. OpenSSL was actually super-buggy here (though known bugs on our end have been fixed), but pyOpenSSL was confused and incorrectly documented that callers call SSL_read after SSL_shutdown to do bidi shutdown, so we should probably support this. Add a test that it works. Change-Id: I2b6d012161330aeb4cf894bae3a0b6a55d53c70d Reviewed-on: https://boringssl-review.googlesource.com/8093 Reviewed-by: Adam Langley <agl@google.com>
2016-05-10 20:15:41 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL> client, server;
if (!ConnectClientAndServer(&client, &server, client_ctx.get(),
server_ctx.get(), nullptr /* no session */)) {
return false;
}
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Drain any post-handshake messages to ensure there are no unread records
// on either end.
uint8_t byte = 0;
if (SSL_read(client.get(), &byte, 1) > 0 ||
SSL_read(server.get(), &byte, 1) > 0) {
fprintf(stderr, "Received unexpected data.\n");
return false;
}
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
uint64_t client_read_seq = SSL_get_read_sequence(client.get());
uint64_t client_write_seq = SSL_get_write_sequence(client.get());
uint64_t server_read_seq = SSL_get_read_sequence(server.get());
uint64_t server_write_seq = SSL_get_write_sequence(server.get());
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (is_dtls) {
// Both client and server must be at epoch 1.
if (EpochFromSequence(client_read_seq) != 1 ||
EpochFromSequence(client_write_seq) != 1 ||
EpochFromSequence(server_read_seq) != 1 ||
EpochFromSequence(server_write_seq) != 1) {
fprintf(stderr, "Bad epochs.\n");
return false;
}
Run TestSequenceNumber at all versions. There were some logic errors that were revealed by testing at TLS 1.3. Also explicitly test GetClientHelloLen at TLS 1.2 (rather than relying on the default) since the TLS 1.3 ClientHello is too large. Change-Id: I907cb6ac04b40f845e99593bad06739132ca56b2 Reviewed-on: https://boringssl-review.googlesource.com/11605 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-10-14 17:08:12 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// The next record to be written should exceed the largest received.
if (client_write_seq <= server_read_seq ||
server_write_seq <= client_read_seq) {
fprintf(stderr, "Inconsistent sequence numbers.\n");
return false;
}
} else {
// The next record to be written should equal the next to be received.
if (client_write_seq != server_read_seq ||
server_write_seq != client_read_seq) {
fprintf(stderr, "Inconsistent sequence numbers.\n");
return false;
}
}
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Send a record from client to server.
if (SSL_write(client.get(), &byte, 1) != 1 ||
SSL_read(server.get(), &byte, 1) != 1) {
fprintf(stderr, "Could not send byte.\n");
return false;
}
Run TestSequenceNumber at all versions. There were some logic errors that were revealed by testing at TLS 1.3. Also explicitly test GetClientHelloLen at TLS 1.2 (rather than relying on the default) since the TLS 1.3 ClientHello is too large. Change-Id: I907cb6ac04b40f845e99593bad06739132ca56b2 Reviewed-on: https://boringssl-review.googlesource.com/11605 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-10-14 17:08:12 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// The client write and server read sequence numbers should have
// incremented.
if (client_write_seq + 1 != SSL_get_write_sequence(client.get()) ||
server_read_seq + 1 != SSL_get_read_sequence(server.get())) {
fprintf(stderr, "Sequence numbers did not increment.\n");
return false;
Fix SSL_get_{read,write}_sequence. I switched up the endianness. Add some tests to make sure those work right. Also tweak the DTLS semantics. SSL_get_read_sequence should return the highest sequence number received so far. Include the epoch number in both so we don't need a second API for it. Change-Id: I9901a1665b41224c46fadb7ce0b0881dcb466bcc Reviewed-on: https://boringssl-review.googlesource.com/7141 Reviewed-by: Adam Langley <agl@google.com>
2016-02-11 17:02:01 +00:00
}
return true;
}
Run TestOneSidedShutdown at all versions. Change-Id: I3a5d949eec9241ea43da40ce23e0e7f2a25e30e5 Reviewed-on: https://boringssl-review.googlesource.com/12381 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-18 06:14:42 +00:00
static bool TestOneSidedShutdown(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
// SSL_shutdown is a no-op in DTLS.
if (is_dtls) {
return true;
Add a unit test for one-sided shutdown. OpenSSL was actually super-buggy here (though known bugs on our end have been fixed), but pyOpenSSL was confused and incorrectly documented that callers call SSL_read after SSL_shutdown to do bidi shutdown, so we should probably support this. Add a test that it works. Change-Id: I2b6d012161330aeb4cf894bae3a0b6a55d53c70d Reviewed-on: https://boringssl-review.googlesource.com/8093 Reviewed-by: Adam Langley <agl@google.com>
2016-05-10 20:15:41 +01:00
}
Run TestOneSidedShutdown at all versions. Change-Id: I3a5d949eec9241ea43da40ce23e0e7f2a25e30e5 Reviewed-on: https://boringssl-review.googlesource.com/12381 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-18 06:14:42 +00:00
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(method));
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
Run TestOneSidedShutdown at all versions. Change-Id: I3a5d949eec9241ea43da40ce23e0e7f2a25e30e5 Reviewed-on: https://boringssl-review.googlesource.com/12381 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-18 06:14:42 +00:00
if (!client_ctx || !server_ctx || !cert || !key ||
!SSL_CTX_set_min_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_min_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(client_ctx.get(), version) ||
Add a unit test for one-sided shutdown. OpenSSL was actually super-buggy here (though known bugs on our end have been fixed), but pyOpenSSL was confused and incorrectly documented that callers call SSL_read after SSL_shutdown to do bidi shutdown, so we should probably support this. Add a test that it works. Change-Id: I2b6d012161330aeb4cf894bae3a0b6a55d53c70d Reviewed-on: https://boringssl-review.googlesource.com/8093 Reviewed-by: Adam Langley <agl@google.com>
2016-05-10 20:15:41 +01:00
!SSL_CTX_use_certificate(server_ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(server_ctx.get(), key.get())) {
return false;
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> client, server;
Add a unit test for one-sided shutdown. OpenSSL was actually super-buggy here (though known bugs on our end have been fixed), but pyOpenSSL was confused and incorrectly documented that callers call SSL_read after SSL_shutdown to do bidi shutdown, so we should probably support this. Add a test that it works. Change-Id: I2b6d012161330aeb4cf894bae3a0b6a55d53c70d Reviewed-on: https://boringssl-review.googlesource.com/8093 Reviewed-by: Adam Langley <agl@google.com>
2016-05-10 20:15:41 +01:00
if (!ConnectClientAndServer(&client, &server, client_ctx.get(),
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
server_ctx.get(), nullptr /* no session */)) {
Add a unit test for one-sided shutdown. OpenSSL was actually super-buggy here (though known bugs on our end have been fixed), but pyOpenSSL was confused and incorrectly documented that callers call SSL_read after SSL_shutdown to do bidi shutdown, so we should probably support this. Add a test that it works. Change-Id: I2b6d012161330aeb4cf894bae3a0b6a55d53c70d Reviewed-on: https://boringssl-review.googlesource.com/8093 Reviewed-by: Adam Langley <agl@google.com>
2016-05-10 20:15:41 +01:00
return false;
}
// Shut down half the connection. SSL_shutdown will return 0 to signal only
// one side has shut down.
if (SSL_shutdown(client.get()) != 0) {
fprintf(stderr, "Could not shutdown.\n");
return false;
}
// Reading from the server should consume the EOF.
uint8_t byte;
if (SSL_read(server.get(), &byte, 1) != 0 ||
SSL_get_error(server.get(), 0) != SSL_ERROR_ZERO_RETURN) {
fprintf(stderr, "Connection was not shut down cleanly.\n");
return false;
}
// However, the server may continue to write data and then shut down the
// connection.
byte = 42;
if (SSL_write(server.get(), &byte, 1) != 1 ||
SSL_read(client.get(), &byte, 1) != 1 ||
byte != 42) {
fprintf(stderr, "Could not send byte.\n");
return false;
}
// The server may then shutdown the connection.
if (SSL_shutdown(server.get()) != 1 ||
SSL_shutdown(client.get()) != 1) {
fprintf(stderr, "Could not complete shutdown.\n");
return false;
}
return true;
}
Run TestOneSidedShutdown at all versions. Change-Id: I3a5d949eec9241ea43da40ce23e0e7f2a25e30e5 Reviewed-on: https://boringssl-review.googlesource.com/12381 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-18 06:14:42 +00:00
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
TEST(SSLTest, SessionDuplication) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(TLS_method()));
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(TLS_method()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(client_ctx);
ASSERT_TRUE(server_ctx);
Splitting SSL session state. To prevent configuration/established session confusion, the handshake session state is separated into the configured session (ssl->session) and the newly created session (ssl->s3->new_session). Upon conclusion of the handshake, the finalized session is stored in (ssl->s3->established_session). During the handshake, any requests for the session (SSL_get_session) return a non-resumable session, to prevent resumption of a partially filled session. Sessions should only be cached upon the completion of the full handshake, using the resulting established_session. The semantics of accessors on the session are maintained mid-renego. Change-Id: I4358aecb71fce4fe14a6746c5af1416a69935078 Reviewed-on: https://boringssl-review.googlesource.com/8612 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-06-27 21:34:59 +01:00
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(cert);
ASSERT_TRUE(key);
ASSERT_TRUE(SSL_CTX_use_certificate(server_ctx.get(), cert.get()));
ASSERT_TRUE(SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()));
Splitting SSL session state. To prevent configuration/established session confusion, the handshake session state is separated into the configured session (ssl->session) and the newly created session (ssl->s3->new_session). Upon conclusion of the handshake, the finalized session is stored in (ssl->s3->established_session). During the handshake, any requests for the session (SSL_get_session) return a non-resumable session, to prevent resumption of a partially filled session. Sessions should only be cached upon the completion of the full handshake, using the resulting established_session. The semantics of accessors on the session are maintained mid-renego. Change-Id: I4358aecb71fce4fe14a6746c5af1416a69935078 Reviewed-on: https://boringssl-review.googlesource.com/8612 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-06-27 21:34:59 +01:00
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> client, server;
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ConnectClientAndServer(&client, &server, client_ctx.get(),
server_ctx.get(),
nullptr /* no session */));
Splitting SSL session state. To prevent configuration/established session confusion, the handshake session state is separated into the configured session (ssl->session) and the newly created session (ssl->s3->new_session). Upon conclusion of the handshake, the finalized session is stored in (ssl->s3->established_session). During the handshake, any requests for the session (SSL_get_session) return a non-resumable session, to prevent resumption of a partially filled session. Sessions should only be cached upon the completion of the full handshake, using the resulting established_session. The semantics of accessors on the session are maintained mid-renego. Change-Id: I4358aecb71fce4fe14a6746c5af1416a69935078 Reviewed-on: https://boringssl-review.googlesource.com/8612 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-06-27 21:34:59 +01:00
SSL_SESSION *session0 = SSL_get_session(client.get());
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
bssl::UniquePtr<SSL_SESSION> session1(
SSL_SESSION_dup(session0, SSL_SESSION_DUP_ALL));
ASSERT_TRUE(session1);
Align with OpenSSL on SSL_set_bio behavior. SSL_set_bio is a nightmare. In f715c423224a292d79ba0e3df373c828fbae29f7, we noticed that, among other problems, SSL_set_bio's actual behavior did not match how SSL_set_rfd was calling it due to an asymmetry in the rbio/wbio handling. This resulted in SSL_set_fd/SSL_set_rfd calls to crash. We decided that SSL_set_rfd's believed semantics were definitive and changed SSL_set_bio. Upstream, in 65e2d672548e7c4bcb28f1c5c835362830b1745b, decided that SSL_set_bio's behavior, asymmetry and all, was definitive and that the SSL_set_rfd crash was a bug in SSL_set_rfd. Accordingly, they switched the fd callers to use the side-specific setters, new in 1.1.0. Align with upstream's behavior and add tests for all of SSL_set_bio's insanity. Also export the new side-specific setters in anticipation of wanting to be mostly compatible with OpenSSL 1.1.0. Change-Id: Iceac9508711f79750a3cc2ded081b2bb2cbf54d8 Reviewed-on: https://boringssl-review.googlesource.com/9064 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-01 18:39:41 +01:00
Serialize unresumable sessions to a placeholder value. Change-Id: I676d7fb00d63d74946b96c22ae2705072033c5f7 Reviewed-on: https://boringssl-review.googlesource.com/10620 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-25 21:30:58 +01:00
session1->not_resumable = 0;
Splitting SSL session state. To prevent configuration/established session confusion, the handshake session state is separated into the configured session (ssl->session) and the newly created session (ssl->s3->new_session). Upon conclusion of the handshake, the finalized session is stored in (ssl->s3->established_session). During the handshake, any requests for the session (SSL_get_session) return a non-resumable session, to prevent resumption of a partially filled session. Sessions should only be cached upon the completion of the full handshake, using the resulting established_session. The semantics of accessors on the session are maintained mid-renego. Change-Id: I4358aecb71fce4fe14a6746c5af1416a69935078 Reviewed-on: https://boringssl-review.googlesource.com/8612 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-06-27 21:34:59 +01:00
uint8_t *s0_bytes, *s1_bytes;
size_t s0_len, s1_len;
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(SSL_SESSION_to_bytes(session0, &s0_bytes, &s0_len));
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<uint8_t> free_s0(s0_bytes);
Splitting SSL session state. To prevent configuration/established session confusion, the handshake session state is separated into the configured session (ssl->session) and the newly created session (ssl->s3->new_session). Upon conclusion of the handshake, the finalized session is stored in (ssl->s3->established_session). During the handshake, any requests for the session (SSL_get_session) return a non-resumable session, to prevent resumption of a partially filled session. Sessions should only be cached upon the completion of the full handshake, using the resulting established_session. The semantics of accessors on the session are maintained mid-renego. Change-Id: I4358aecb71fce4fe14a6746c5af1416a69935078 Reviewed-on: https://boringssl-review.googlesource.com/8612 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-06-27 21:34:59 +01:00
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(SSL_SESSION_to_bytes(session1.get(), &s1_bytes, &s1_len));
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<uint8_t> free_s1(s1_bytes);
Splitting SSL session state. To prevent configuration/established session confusion, the handshake session state is separated into the configured session (ssl->session) and the newly created session (ssl->s3->new_session). Upon conclusion of the handshake, the finalized session is stored in (ssl->s3->established_session). During the handshake, any requests for the session (SSL_get_session) return a non-resumable session, to prevent resumption of a partially filled session. Sessions should only be cached upon the completion of the full handshake, using the resulting established_session. The semantics of accessors on the session are maintained mid-renego. Change-Id: I4358aecb71fce4fe14a6746c5af1416a69935078 Reviewed-on: https://boringssl-review.googlesource.com/8612 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-06-27 21:34:59 +01:00
Add a helper for comparing byte strings. We compare pointer/length pairs constantly. To avoid needing to type it everywhere and get GTest's output, add a StringPiece-alike for byte slices which supports ==, !=, and std::ostream. BUG=129 Change-Id: I108342cbd2c6a58fec0b9cb87ebdf50364bda099 Reviewed-on: https://boringssl-review.googlesource.com/13625 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 16:48:59 +00:00
EXPECT_EQ(Bytes(s0_bytes, s0_len), Bytes(s1_bytes, s1_len));
Splitting SSL session state. To prevent configuration/established session confusion, the handshake session state is separated into the configured session (ssl->session) and the newly created session (ssl->s3->new_session). Upon conclusion of the handshake, the finalized session is stored in (ssl->s3->established_session). During the handshake, any requests for the session (SSL_get_session) return a non-resumable session, to prevent resumption of a partially filled session. Sessions should only be cached upon the completion of the full handshake, using the resulting established_session. The semantics of accessors on the session are maintained mid-renego. Change-Id: I4358aecb71fce4fe14a6746c5af1416a69935078 Reviewed-on: https://boringssl-review.googlesource.com/8612 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-06-27 21:34:59 +01:00
}
Add a unit test for one-sided shutdown. OpenSSL was actually super-buggy here (though known bugs on our end have been fixed), but pyOpenSSL was confused and incorrectly documented that callers call SSL_read after SSL_shutdown to do bidi shutdown, so we should probably support this. Add a test that it works. Change-Id: I2b6d012161330aeb4cf894bae3a0b6a55d53c70d Reviewed-on: https://boringssl-review.googlesource.com/8093 Reviewed-by: Adam Langley <agl@google.com>
2016-05-10 20:15:41 +01:00
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
static void ExpectFDs(const SSL *ssl, int rfd, int wfd) {
EXPECT_EQ(rfd, SSL_get_rfd(ssl));
EXPECT_EQ(wfd, SSL_get_wfd(ssl));
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// The wrapper BIOs are always equal when fds are equal, even if set
// individually.
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
if (rfd == wfd) {
EXPECT_EQ(SSL_get_rbio(ssl), SSL_get_wbio(ssl));
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
}
}
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
TEST(SSLTest, SetFD) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ctx);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// Test setting different read and write FDs.
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> ssl(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
EXPECT_TRUE(SSL_set_rfd(ssl.get(), 1));
EXPECT_TRUE(SSL_set_wfd(ssl.get(), 2));
ExpectFDs(ssl.get(), 1, 2);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// Test setting the same FD.
ssl.reset(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
EXPECT_TRUE(SSL_set_fd(ssl.get(), 1));
ExpectFDs(ssl.get(), 1, 1);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// Test setting the same FD one side at a time.
ssl.reset(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
EXPECT_TRUE(SSL_set_rfd(ssl.get(), 1));
EXPECT_TRUE(SSL_set_wfd(ssl.get(), 1));
ExpectFDs(ssl.get(), 1, 1);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// Test setting the same FD in the other order.
ssl.reset(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
EXPECT_TRUE(SSL_set_wfd(ssl.get(), 1));
EXPECT_TRUE(SSL_set_rfd(ssl.get(), 1));
ExpectFDs(ssl.get(), 1, 1);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// Test changing the read FD partway through.
ssl.reset(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
EXPECT_TRUE(SSL_set_fd(ssl.get(), 1));
EXPECT_TRUE(SSL_set_rfd(ssl.get(), 2));
ExpectFDs(ssl.get(), 2, 1);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// Test changing the write FD partway through.
ssl.reset(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
EXPECT_TRUE(SSL_set_fd(ssl.get(), 1));
EXPECT_TRUE(SSL_set_wfd(ssl.get(), 2));
ExpectFDs(ssl.get(), 1, 2);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// Test a no-op change to the read FD partway through.
ssl.reset(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
EXPECT_TRUE(SSL_set_fd(ssl.get(), 1));
EXPECT_TRUE(SSL_set_rfd(ssl.get(), 1));
ExpectFDs(ssl.get(), 1, 1);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// Test a no-op change to the write FD partway through.
ssl.reset(SSL_new(ctx.get()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
EXPECT_TRUE(SSL_set_fd(ssl.get(), 1));
EXPECT_TRUE(SSL_set_wfd(ssl.get(), 1));
ExpectFDs(ssl.get(), 1, 1);
Add tests for SSL_set_fd and friends. Their implementations expose a lot of really weird SSL_set_bio behavior. Note that one test must be disabled as it doesn't even work. The subsequent commit will re-enable it. Change-Id: I4b7acadd710b3be056951886fc3e073a5aa816de Reviewed-on: https://boringssl-review.googlesource.com/8272 Reviewed-by: Adam Langley <agl@google.com>
2016-06-14 19:03:51 +01:00
// ASan builds will implicitly test that the internal |BIO| reference-counting
// is correct.
}
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
TEST(SSLTest, SetBIO) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ctx);
Align with OpenSSL on SSL_set_bio behavior. SSL_set_bio is a nightmare. In f715c423224a292d79ba0e3df373c828fbae29f7, we noticed that, among other problems, SSL_set_bio's actual behavior did not match how SSL_set_rfd was calling it due to an asymmetry in the rbio/wbio handling. This resulted in SSL_set_fd/SSL_set_rfd calls to crash. We decided that SSL_set_rfd's believed semantics were definitive and changed SSL_set_bio. Upstream, in 65e2d672548e7c4bcb28f1c5c835362830b1745b, decided that SSL_set_bio's behavior, asymmetry and all, was definitive and that the SSL_set_rfd crash was a bug in SSL_set_rfd. Accordingly, they switched the fd callers to use the side-specific setters, new in 1.1.0. Align with upstream's behavior and add tests for all of SSL_set_bio's insanity. Also export the new side-specific setters in anticipation of wanting to be mostly compatible with OpenSSL 1.1.0. Change-Id: Iceac9508711f79750a3cc2ded081b2bb2cbf54d8 Reviewed-on: https://boringssl-review.googlesource.com/9064 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-01 18:39:41 +01:00
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> ssl(SSL_new(ctx.get()));
bssl::UniquePtr<BIO> bio1(BIO_new(BIO_s_mem())), bio2(BIO_new(BIO_s_mem())),
Align with OpenSSL on SSL_set_bio behavior. SSL_set_bio is a nightmare. In f715c423224a292d79ba0e3df373c828fbae29f7, we noticed that, among other problems, SSL_set_bio's actual behavior did not match how SSL_set_rfd was calling it due to an asymmetry in the rbio/wbio handling. This resulted in SSL_set_fd/SSL_set_rfd calls to crash. We decided that SSL_set_rfd's believed semantics were definitive and changed SSL_set_bio. Upstream, in 65e2d672548e7c4bcb28f1c5c835362830b1745b, decided that SSL_set_bio's behavior, asymmetry and all, was definitive and that the SSL_set_rfd crash was a bug in SSL_set_rfd. Accordingly, they switched the fd callers to use the side-specific setters, new in 1.1.0. Align with upstream's behavior and add tests for all of SSL_set_bio's insanity. Also export the new side-specific setters in anticipation of wanting to be mostly compatible with OpenSSL 1.1.0. Change-Id: Iceac9508711f79750a3cc2ded081b2bb2cbf54d8 Reviewed-on: https://boringssl-review.googlesource.com/9064 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-01 18:39:41 +01:00
bio3(BIO_new(BIO_s_mem()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ssl);
ASSERT_TRUE(bio1);
ASSERT_TRUE(bio2);
ASSERT_TRUE(bio3);
Align with OpenSSL on SSL_set_bio behavior. SSL_set_bio is a nightmare. In f715c423224a292d79ba0e3df373c828fbae29f7, we noticed that, among other problems, SSL_set_bio's actual behavior did not match how SSL_set_rfd was calling it due to an asymmetry in the rbio/wbio handling. This resulted in SSL_set_fd/SSL_set_rfd calls to crash. We decided that SSL_set_rfd's believed semantics were definitive and changed SSL_set_bio. Upstream, in 65e2d672548e7c4bcb28f1c5c835362830b1745b, decided that SSL_set_bio's behavior, asymmetry and all, was definitive and that the SSL_set_rfd crash was a bug in SSL_set_rfd. Accordingly, they switched the fd callers to use the side-specific setters, new in 1.1.0. Align with upstream's behavior and add tests for all of SSL_set_bio's insanity. Also export the new side-specific setters in anticipation of wanting to be mostly compatible with OpenSSL 1.1.0. Change-Id: Iceac9508711f79750a3cc2ded081b2bb2cbf54d8 Reviewed-on: https://boringssl-review.googlesource.com/9064 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-01 18:39:41 +01:00
// SSL_set_bio takes one reference when the parameters are the same.
BIO_up_ref(bio1.get());
SSL_set_bio(ssl.get(), bio1.get(), bio1.get());
// Repeating the call does nothing.
SSL_set_bio(ssl.get(), bio1.get(), bio1.get());
// It takes one reference each when the parameters are different.
BIO_up_ref(bio2.get());
BIO_up_ref(bio3.get());
SSL_set_bio(ssl.get(), bio2.get(), bio3.get());
// Repeating the call does nothing.
SSL_set_bio(ssl.get(), bio2.get(), bio3.get());
// It takes one reference when changing only wbio.
BIO_up_ref(bio1.get());
SSL_set_bio(ssl.get(), bio2.get(), bio1.get());
// It takes one reference when changing only rbio and the two are different.
BIO_up_ref(bio3.get());
SSL_set_bio(ssl.get(), bio3.get(), bio1.get());
// If setting wbio to rbio, it takes no additional references.
SSL_set_bio(ssl.get(), bio3.get(), bio3.get());
// From there, wbio may be switched to something else.
BIO_up_ref(bio1.get());
SSL_set_bio(ssl.get(), bio3.get(), bio1.get());
// If setting rbio to wbio, it takes no additional references.
SSL_set_bio(ssl.get(), bio1.get(), bio1.get());
// From there, rbio may be switched to something else, but, for historical
// reasons, it takes a reference to both parameters.
BIO_up_ref(bio1.get());
BIO_up_ref(bio2.get());
SSL_set_bio(ssl.get(), bio2.get(), bio1.get());
// ASAN builds will implicitly test that the internal |BIO| reference-counting
// is correct.
}
Add a unit test for SSL_CTX_set_retain_only_sha256_of_client_certs. Change-Id: I5addfb1e8ec97fc426ae8ca39769120856470451 Reviewed-on: https://boringssl-review.googlesource.com/8780 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:22:54 +01:00
static int VerifySucceed(X509_STORE_CTX *store_ctx, void *arg) { return 1; }
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool TestGetPeerCertificate(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
Test SSL_get_peer_certificate and SSL_get_peer_cert_chain behavior. Between client and server, the second API behaves very very differently. Change-Id: I2a6c3cab717466a2d67ae102810a5ecd99362d9e Reviewed-on: https://boringssl-review.googlesource.com/8781 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:33:24 +01:00
if (!cert || !key) {
return false;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Configure both client and server to accept any certificate.
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(method));
if (!ctx ||
!SSL_CTX_use_certificate(ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(ctx.get(), key.get()) ||
!SSL_CTX_set_min_proto_version(ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(ctx.get(), version)) {
return false;
}
SSL_CTX_set_verify(
ctx.get(), SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, nullptr);
SSL_CTX_set_cert_verify_callback(ctx.get(), VerifySucceed, NULL);
Test SSL_get_peer_certificate and SSL_get_peer_cert_chain behavior. Between client and server, the second API behaves very very differently. Change-Id: I2a6c3cab717466a2d67ae102810a5ecd99362d9e Reviewed-on: https://boringssl-review.googlesource.com/8781 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:33:24 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL> client, server;
if (!ConnectClientAndServer(&client, &server, ctx.get(), ctx.get(),
nullptr /* no session */)) {
return false;
}
Test SSL_get_peer_certificate and SSL_get_peer_cert_chain behavior. Between client and server, the second API behaves very very differently. Change-Id: I2a6c3cab717466a2d67ae102810a5ecd99362d9e Reviewed-on: https://boringssl-review.googlesource.com/8781 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:33:24 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Client and server should both see the leaf certificate.
bssl::UniquePtr<X509> peer(SSL_get_peer_certificate(server.get()));
if (!peer || X509_cmp(cert.get(), peer.get()) != 0) {
fprintf(stderr, "Server peer certificate did not match.\n");
return false;
}
Test SSL_get_peer_certificate and SSL_get_peer_cert_chain behavior. Between client and server, the second API behaves very very differently. Change-Id: I2a6c3cab717466a2d67ae102810a5ecd99362d9e Reviewed-on: https://boringssl-review.googlesource.com/8781 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:33:24 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
peer.reset(SSL_get_peer_certificate(client.get()));
if (!peer || X509_cmp(cert.get(), peer.get()) != 0) {
fprintf(stderr, "Client peer certificate did not match.\n");
return false;
}
Test SSL_get_peer_certificate and SSL_get_peer_cert_chain behavior. Between client and server, the second API behaves very very differently. Change-Id: I2a6c3cab717466a2d67ae102810a5ecd99362d9e Reviewed-on: https://boringssl-review.googlesource.com/8781 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:33:24 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// However, for historical reasons, the chain includes the leaf on the
// client, but does not on the server.
if (sk_X509_num(SSL_get_peer_cert_chain(client.get())) != 1) {
fprintf(stderr, "Client peer chain was incorrect.\n");
return false;
}
Test SSL_get_peer_certificate and SSL_get_peer_cert_chain behavior. Between client and server, the second API behaves very very differently. Change-Id: I2a6c3cab717466a2d67ae102810a5ecd99362d9e Reviewed-on: https://boringssl-review.googlesource.com/8781 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:33:24 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (sk_X509_num(SSL_get_peer_cert_chain(server.get())) != 0) {
fprintf(stderr, "Server peer chain was incorrect.\n");
return false;
Test SSL_get_peer_certificate and SSL_get_peer_cert_chain behavior. Between client and server, the second API behaves very very differently. Change-Id: I2a6c3cab717466a2d67ae102810a5ecd99362d9e Reviewed-on: https://boringssl-review.googlesource.com/8781 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:33:24 +01:00
}
return true;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool TestRetainOnlySHA256OfCerts(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
Add a unit test for SSL_CTX_set_retain_only_sha256_of_client_certs. Change-Id: I5addfb1e8ec97fc426ae8ca39769120856470451 Reviewed-on: https://boringssl-review.googlesource.com/8780 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:22:54 +01:00
if (!cert || !key) {
return false;
}
uint8_t *cert_der = NULL;
int cert_der_len = i2d_X509(cert.get(), &cert_der);
if (cert_der_len < 0) {
return false;
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<uint8_t> free_cert_der(cert_der);
Add a unit test for SSL_CTX_set_retain_only_sha256_of_client_certs. Change-Id: I5addfb1e8ec97fc426ae8ca39769120856470451 Reviewed-on: https://boringssl-review.googlesource.com/8780 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:22:54 +01:00
uint8_t cert_sha256[SHA256_DIGEST_LENGTH];
SHA256(cert_der, cert_der_len, cert_sha256);
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Configure both client and server to accept any certificate, but the
// server must retain only the SHA-256 of the peer.
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(method));
if (!ctx ||
!SSL_CTX_use_certificate(ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(ctx.get(), key.get()) ||
!SSL_CTX_set_min_proto_version(ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(ctx.get(), version)) {
return false;
}
SSL_CTX_set_verify(
ctx.get(), SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, nullptr);
SSL_CTX_set_cert_verify_callback(ctx.get(), VerifySucceed, NULL);
SSL_CTX_set_retain_only_sha256_of_client_certs(ctx.get(), 1);
Add a unit test for SSL_CTX_set_retain_only_sha256_of_client_certs. Change-Id: I5addfb1e8ec97fc426ae8ca39769120856470451 Reviewed-on: https://boringssl-review.googlesource.com/8780 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:22:54 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL> client, server;
if (!ConnectClientAndServer(&client, &server, ctx.get(), ctx.get(),
nullptr /* no session */)) {
return false;
}
Add a unit test for SSL_CTX_set_retain_only_sha256_of_client_certs. Change-Id: I5addfb1e8ec97fc426ae8ca39769120856470451 Reviewed-on: https://boringssl-review.googlesource.com/8780 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:22:54 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// The peer certificate has been dropped.
bssl::UniquePtr<X509> peer(SSL_get_peer_certificate(server.get()));
if (peer) {
fprintf(stderr, "Peer certificate was retained.\n");
return false;
}
Add a unit test for SSL_CTX_set_retain_only_sha256_of_client_certs. Change-Id: I5addfb1e8ec97fc426ae8ca39769120856470451 Reviewed-on: https://boringssl-review.googlesource.com/8780 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:22:54 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
SSL_SESSION *session = SSL_get_session(server.get());
if (!session->peer_sha256_valid) {
fprintf(stderr, "peer_sha256_valid was not set.\n");
return false;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
if (OPENSSL_memcmp(cert_sha256, session->peer_sha256, SHA256_DIGEST_LENGTH) !=
0) {
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
fprintf(stderr, "peer_sha256 did not match.\n");
return false;
Add a unit test for SSL_CTX_set_retain_only_sha256_of_client_certs. Change-Id: I5addfb1e8ec97fc426ae8ca39769120856470451 Reviewed-on: https://boringssl-review.googlesource.com/8780 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 05:22:54 +01:00
}
return true;
}
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
static bool ClientHelloMatches(uint16_t version, const uint8_t *expected,
size_t expected_len) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
// Our default cipher list varies by CPU capabilities, so manually place the
// ChaCha20 ciphers in front.
Really remove DHE ciphersuites from TLS. This follows up on cedc6f18 by removing support for the -DBORINGSSL_ENABLE_DHE_TLS compile flag, and the code needed to support it. Change-Id: I53b6aa7a0eddd23ace8b770edb2a31b18ba2ce26 Reviewed-on: https://boringssl-review.googlesource.com/14886 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-10 23:52:14 +01:00
const char* cipher_list = "CHACHA20:ALL";
Don't return invalid versions in version_from_wire. This is in preparation for using the supported_versions extension to experiment with draft TLS 1.3 versions, since we don't wish to restore the fallback. With versions begin opaque values, we will want version_from_wire to reject unknown values, not attempt to preserve order in some way. This means ClientHello.version processing needs to be separate code. That's just written out fully in negotiate_version now. It also means SSL_set_{min,max}_version will notice invalid inputs which aligns us better with upstream's versions of those APIs. This CL doesn't replace ssl->version with an internal-representation version, though follow work should do it once a couple of changes land in consumers. BUG=90 Change-Id: Id2f5e1fa72847c823ee7f082e9e69f55e51ce9da Reviewed-on: https://boringssl-review.googlesource.com/11122 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-20 00:57:37 +01:00
if (!ctx ||
Disable SSLv3 by default. As a precursor to removing the code entirely later, disable the protocol by default. Callers must use SSL_CTX_set_min_version to enable it. This change also makes SSLv3_method *not* enable SSL 3.0. Normally version-specific methods set the minimum and maximum version to their version. SSLv3_method leaves the minimum at the default, so we will treat it as all versions disabled. To help debugging, the error code is switched from WRONG_SSL_VERSION to a new NO_SUPPORTED_VERSIONS_ENABLED. This also defines OPENSSL_NO_SSL3 and OPENSSL_NO_SSL3_METHOD to kick in any no-ssl3 build paths in consumers which should provide a convenient hook for any upstreaming changes that may be needed. (OPENSSL_NO_SSL3 existed in older versions of OpenSSL, so in principle one may encounter an OpenSSL with the same settings.) Change-Id: I96a8f2f568eb77b2537b3a774b2f7108bd67dd0c Reviewed-on: https://boringssl-review.googlesource.com/14031 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-01 21:48:38 +00:00
// SSLv3 is off by default.
!SSL_CTX_set_min_proto_version(ctx.get(), SSL3_VERSION) ||
Align SSL_set_{min,max}_version with upstream. Upstream added these functions after we did but decided to change the names slightly. I'm not sure why they wanted to add the "proto" in there, but align with them nonetheless so the ecosystem only has one set of these functions. BUG=90 Change-Id: Ia9863c58c9734374092051f02952b112806040cc Reviewed-on: https://boringssl-review.googlesource.com/11123 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-20 20:12:23 +01:00
!SSL_CTX_set_max_proto_version(ctx.get(), version) ||
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
!SSL_CTX_set_strict_cipher_list(ctx.get(), cipher_list)) {
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
return false;
}
Don't return invalid versions in version_from_wire. This is in preparation for using the supported_versions extension to experiment with draft TLS 1.3 versions, since we don't wish to restore the fallback. With versions begin opaque values, we will want version_from_wire to reject unknown values, not attempt to preserve order in some way. This means ClientHello.version processing needs to be separate code. That's just written out fully in negotiate_version now. It also means SSL_set_{min,max}_version will notice invalid inputs which aligns us better with upstream's versions of those APIs. This CL doesn't replace ssl->version with an internal-representation version, though follow work should do it once a couple of changes land in consumers. BUG=90 Change-Id: Id2f5e1fa72847c823ee7f082e9e69f55e51ce9da Reviewed-on: https://boringssl-review.googlesource.com/11122 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-20 00:57:37 +01:00
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> ssl(SSL_new(ctx.get()));
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
if (!ssl) {
return false;
}
std::vector<uint8_t> client_hello;
if (!GetClientHello(ssl.get(), &client_hello)) {
return false;
}
// Zero the client_random.
constexpr size_t kRandomOffset = 1 + 2 + 2 + // record header
1 + 3 + // handshake message header
2; // client_version
if (client_hello.size() < kRandomOffset + SSL3_RANDOM_SIZE) {
fprintf(stderr, "ClientHello for version %04x too short.\n", version);
return false;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memset(client_hello.data() + kRandomOffset, 0, SSL3_RANDOM_SIZE);
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
if (client_hello.size() != expected_len ||
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcmp(client_hello.data(), expected, expected_len) != 0) {
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
fprintf(stderr, "ClientHello for version %04x did not match:\n", version);
fprintf(stderr, "Got:\n\t");
for (size_t i = 0; i < client_hello.size(); i++) {
fprintf(stderr, "0x%02x, ", client_hello[i]);
}
fprintf(stderr, "\nWanted:\n\t");
for (size_t i = 0; i < expected_len; i++) {
fprintf(stderr, "0x%02x, ", expected[i]);
}
fprintf(stderr, "\n");
return false;
}
return true;
}
// Tests that our ClientHellos do not change unexpectedly.
static bool TestClientHello() {
static const uint8_t kSSL3ClientHello[] = {
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x16,
0x03, 0x00,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x3b,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x01,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x00, 0x37,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x03, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x10,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0xc0, 0x09,
0xc0, 0x13,
0xc0, 0x0a,
0xc0, 0x14,
0x00, 0x2f,
0x00, 0x35,
0x00, 0x0a,
0x00, 0xff, 0x01, 0x00,
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
};
if (!ClientHelloMatches(SSL3_VERSION, kSSL3ClientHello,
sizeof(kSSL3ClientHello))) {
return false;
}
static const uint8_t kTLS1ClientHello[] = {
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x16,
0x03, 0x01,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x5a,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x01,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x00, 0x56,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x03, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x0e,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0xc0, 0x09,
0xc0, 0x13,
0xc0, 0x0a,
0xc0, 0x14,
0x00, 0x2f,
0x00, 0x35,
0x00, 0x0a,
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
0x01, 0x00, 0x00, 0x1f, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x17, 0x00,
0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00,
0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18,
};
if (!ClientHelloMatches(TLS1_VERSION, kTLS1ClientHello,
sizeof(kTLS1ClientHello))) {
return false;
}
static const uint8_t kTLS11ClientHello[] = {
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x16,
0x03, 0x01,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x5a,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x01,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x00, 0x56,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0x03, 0x02,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x0e,
Remove RC4 ciphersuites from TLS. For now, they can be restored by compiling with -DBORINGSSL_RC4_TLS. Of note, this means that `MEDIUM' is now empty. Change-Id: Ic77308e7bd4849bdb2b4882c6b34af85089fe3cc Reviewed-on: https://boringssl-review.googlesource.com/10580 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-24 22:36:54 +01:00
0xc0, 0x09,
0xc0, 0x13,
0xc0, 0x0a,
0xc0, 0x14,
0x00, 0x2f,
0x00, 0x35,
0x00, 0x0a,
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
0x01, 0x00, 0x00, 0x1f, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x17, 0x00,
0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00,
0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18,
};
if (!ClientHelloMatches(TLS1_1_VERSION, kTLS11ClientHello,
sizeof(kTLS11ClientHello))) {
return false;
}
Fix ssl_test with BORINGSSL_ANDROID_SYSTEM. We need to suppress a few tests on the system Android build until RSA-PSS is shipped there. Change-Id: I5843997aae9fa499ec08d76f44fdf3b523599e1c Reviewed-on: https://boringssl-review.googlesource.com/13267 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-01-25 03:47:18 +00:00
// kTLS12ClientHello assumes RSA-PSS, which is disabled for Android system
// builds.
#if defined(BORINGSSL_ANDROID_SYSTEM)
return true;
#endif
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
static const uint8_t kTLS12ClientHello[] = {
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x16,
0x03, 0x01,
0x00, 0x8e,
0x01,
0x00, 0x00, 0x8a,
0x03, 0x03,
Enable RSA-PSS in TLS 1.2 by default. Add a test that RSA-PSS is available in TLS 1.2 by default, both for signing and verifying. Note that if a custom SSL_PRIVATE_KEY_METHOD is used and it sets signing preferences, it won't use RSA-PSS if it doesn't know about it. (See *-Sign-Negotiate-* tests.) Change-Id: I3776a0c95480188a135795f7ebf31f2b0e0626cc Reviewed-on: https://boringssl-review.googlesource.com/10723 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-30 05:30:38 +01:00
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
Remove DHE ciphersuites from TLS. They can be restored by compiling with -DBORINGSSL_ENABLE_DHE_TLS. This is similar to 9c8c4188 for RC4 ciphers. Change-Id: I7cd3421b108a024f1ee11f13a6df881c2d0de3c3 Reviewed-on: https://boringssl-review.googlesource.com/14284 Commit-Queue: Matt Braithwaite <mab@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-16 02:20:23 +00:00
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x2a,
0xcc, 0xa9,
0xcc, 0xa8,
0xc0, 0x2b,
0xc0, 0x2f,
0xc0, 0x2c,
0xc0, 0x30,
0xc0, 0x09,
0xc0, 0x23,
0xc0, 0x13,
0xc0, 0x27,
0xc0, 0x0a,
0xc0, 0x24,
0xc0, 0x14,
0xc0, 0x28,
0x00, 0x9c,
0x00, 0x9d,
0x00, 0x2f,
0x00, 0x3c,
0x00, 0x35,
0x00, 0x3d,
0x00, 0x0a,
0x01, 0x00, 0x00, 0x37, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x17, 0x00,
0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x14, 0x00, 0x12, 0x04,
0x03, 0x08, 0x04, 0x04, 0x01, 0x05, 0x03, 0x08, 0x05, 0x05, 0x01, 0x08,
0x06, 0x06, 0x01, 0x02, 0x01, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00,
0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18,
Add tests to ensure our ClientHello does not change. We'll need to update it on occasion, but we should not update our default ClientHello without noticing. Change-Id: I19ca52fdbe10e3ac14413fecd16be2e58af5a1f6 Reviewed-on: https://boringssl-review.googlesource.com/9075 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-19 16:12:41 +01:00
};
if (!ClientHelloMatches(TLS1_2_VERSION, kTLS12ClientHello,
sizeof(kTLS12ClientHello))) {
return false;
}
// TODO(davidben): Add a change detector for TLS 1.3 once the spec and our
// implementation has settled enough that it won't change.
return true;
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
static bssl::UniquePtr<SSL_SESSION> g_last_session;
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
static int SaveLastSession(SSL *ssl, SSL_SESSION *session) {
// Save the most recent session.
g_last_session.reset(session);
return 1;
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
static bssl::UniquePtr<SSL_SESSION> CreateClientSession(SSL_CTX *client_ctx,
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
SSL_CTX *server_ctx) {
g_last_session = nullptr;
SSL_CTX_sess_set_new_cb(client_ctx, SaveLastSession);
// Connect client and server to get a session.
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> client, server;
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
if (!ConnectClientAndServer(&client, &server, client_ctx, server_ctx,
nullptr /* no session */)) {
fprintf(stderr, "Failed to connect client and server.\n");
return nullptr;
}
// Run the read loop to account for post-handshake tickets in TLS 1.3.
SSL_read(client.get(), nullptr, 0);
SSL_CTX_sess_set_new_cb(client_ctx, nullptr);
if (!g_last_session) {
fprintf(stderr, "Client did not receive a session.\n");
return nullptr;
}
return std::move(g_last_session);
}
static bool ExpectSessionReused(SSL_CTX *client_ctx, SSL_CTX *server_ctx,
SSL_SESSION *session,
bool reused) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> client, server;
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
if (!ConnectClientAndServer(&client, &server, client_ctx,
server_ctx, session)) {
fprintf(stderr, "Failed to connect client and server.\n");
return false;
}
if (SSL_session_reused(client.get()) != SSL_session_reused(server.get())) {
fprintf(stderr, "Client and server were inconsistent.\n");
return false;
}
bool was_reused = !!SSL_session_reused(client.get());
if (was_reused != reused) {
fprintf(stderr, "Session was%s reused, but we expected the opposite.\n",
was_reused ? "" : " not");
return false;
}
return true;
}
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
static bssl::UniquePtr<SSL_SESSION> ExpectSessionRenewed(SSL_CTX *client_ctx,
SSL_CTX *server_ctx,
SSL_SESSION *session) {
g_last_session = nullptr;
SSL_CTX_sess_set_new_cb(client_ctx, SaveLastSession);
bssl::UniquePtr<SSL> client, server;
if (!ConnectClientAndServer(&client, &server, client_ctx,
server_ctx, session)) {
fprintf(stderr, "Failed to connect client and server.\n");
return nullptr;
}
if (SSL_session_reused(client.get()) != SSL_session_reused(server.get())) {
fprintf(stderr, "Client and server were inconsistent.\n");
return nullptr;
}
if (!SSL_session_reused(client.get())) {
fprintf(stderr, "Session was not reused.\n");
return nullptr;
}
// Run the read loop to account for post-handshake tickets in TLS 1.3.
SSL_read(client.get(), nullptr, 0);
SSL_CTX_sess_set_new_cb(client_ctx, nullptr);
if (!g_last_session) {
fprintf(stderr, "Client did not receive a renewed session.\n");
return nullptr;
}
return std::move(g_last_session);
}
Test setting session ID context in early or SNI callback. The former has always worked. The latter is new to the revised processing order. Change-Id: I993d29ccaca091725524847695df4d1944b609cf Reviewed-on: https://boringssl-review.googlesource.com/11848 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-10-28 05:10:03 +01:00
static int SwitchSessionIDContextSNI(SSL *ssl, int *out_alert, void *arg) {
static const uint8_t kContext[] = {3};
if (!SSL_set_session_id_context(ssl, kContext, sizeof(kContext))) {
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
return SSL_TLSEXT_ERR_OK;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool TestSessionIDContext(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
if (!cert || !key) {
return false;
}
static const uint8_t kContext1[] = {1};
static const uint8_t kContext2[] = {2};
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(method));
if (!server_ctx || !client_ctx ||
!SSL_CTX_use_certificate(server_ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()) ||
!SSL_CTX_set_session_id_context(server_ctx.get(), kContext1,
sizeof(kContext1)) ||
!SSL_CTX_set_min_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_min_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(server_ctx.get(), version)) {
return false;
}
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
SSL_CTX_set_session_cache_mode(client_ctx.get(), SSL_SESS_CACHE_BOTH);
SSL_CTX_set_session_cache_mode(server_ctx.get(), SSL_SESS_CACHE_BOTH);
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL_SESSION> session =
CreateClientSession(client_ctx.get(), server_ctx.get());
if (!session) {
fprintf(stderr, "Error getting session.\n");
return false;
}
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(), session.get(),
true /* expect session reused */)) {
fprintf(stderr, "Error resuming session.\n");
return false;
}
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Change the session ID context.
if (!SSL_CTX_set_session_id_context(server_ctx.get(), kContext2,
sizeof(kContext2))) {
return false;
}
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(), session.get(),
false /* expect session not reused */)) {
fprintf(stderr, "Error connecting with a different context.\n");
return false;
}
Test setting session ID context in early or SNI callback. The former has always worked. The latter is new to the revised processing order. Change-Id: I993d29ccaca091725524847695df4d1944b609cf Reviewed-on: https://boringssl-review.googlesource.com/11848 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-10-28 05:10:03 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Change the session ID context back and install an SNI callback to switch
// it.
if (!SSL_CTX_set_session_id_context(server_ctx.get(), kContext1,
sizeof(kContext1))) {
return false;
}
Test setting session ID context in early or SNI callback. The former has always worked. The latter is new to the revised processing order. Change-Id: I993d29ccaca091725524847695df4d1944b609cf Reviewed-on: https://boringssl-review.googlesource.com/11848 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-10-28 05:10:03 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
SSL_CTX_set_tlsext_servername_callback(server_ctx.get(),
SwitchSessionIDContextSNI);
Test setting session ID context in early or SNI callback. The former has always worked. The latter is new to the revised processing order. Change-Id: I993d29ccaca091725524847695df4d1944b609cf Reviewed-on: https://boringssl-review.googlesource.com/11848 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-10-28 05:10:03 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(), session.get(),
false /* expect session not reused */)) {
fprintf(stderr, "Error connecting with a context switch on SNI callback.\n");
return false;
}
Test setting session ID context in early or SNI callback. The former has always worked. The latter is new to the revised processing order. Change-Id: I993d29ccaca091725524847695df4d1944b609cf Reviewed-on: https://boringssl-review.googlesource.com/11848 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-10-28 05:10:03 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Switch the session ID context with the early callback instead.
SSL_CTX_set_tlsext_servername_callback(server_ctx.get(), nullptr);
Name |select_certificate_cb| return values The |select_certificate_cb| return values are somewhat confusing due to the fact that they don't match the |cert_cb| ones, despite the similarities between the two callbacks (they both have "certificate" in the name! well, sort of). This also documents the error return value (-1) which was previously undocumented, and it expands the |SSL_CTX_set_select_certificate_cb| documentation regarding retrial (by shamelessly copying from |SSL_CTX_set_ticket_aead_method|). Also updates other scattered documentation that was missed by previous changes. Change-Id: Ib962b31d08e6475e09954cbc3c939988b0ba13f7 Reviewed-on: https://boringssl-review.googlesource.com/14245 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-14 23:36:00 +00:00
SSL_CTX_set_select_certificate_cb(
server_ctx.get(),
[](const SSL_CLIENT_HELLO *client_hello) -> ssl_select_cert_result_t {
static const uint8_t kContext[] = {3};
if (!SSL_set_session_id_context(client_hello->ssl, kContext,
sizeof(kContext))) {
return ssl_select_cert_error;
}
return ssl_select_cert_success;
});
Test setting session ID context in early or SNI callback. The former has always worked. The latter is new to the revised processing order. Change-Id: I993d29ccaca091725524847695df4d1944b609cf Reviewed-on: https://boringssl-review.googlesource.com/11848 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-10-28 05:10:03 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(), session.get(),
false /* expect session not reused */)) {
fprintf(stderr,
"Error connecting with a context switch on early callback.\n");
return false;
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
}
return true;
}
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
static timeval g_current_time;
static void CurrentTimeCallback(const SSL *ssl, timeval *out_clock) {
*out_clock = g_current_time;
}
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
static void FrozenTimeCallback(const SSL *ssl, timeval *out_clock) {
out_clock->tv_sec = 1000;
out_clock->tv_usec = 0;
}
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
static int RenewTicketCallback(SSL *ssl, uint8_t *key_name, uint8_t *iv,
EVP_CIPHER_CTX *ctx, HMAC_CTX *hmac_ctx,
int encrypt) {
static const uint8_t kZeros[16] = {0};
if (encrypt) {
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(key_name, kZeros, sizeof(kZeros));
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
RAND_bytes(iv, 16);
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
} else if (OPENSSL_memcmp(key_name, kZeros, 16) != 0) {
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
return 0;
}
if (!HMAC_Init_ex(hmac_ctx, kZeros, sizeof(kZeros), EVP_sha256(), NULL) ||
!EVP_CipherInit_ex(ctx, EVP_aes_128_cbc(), NULL, kZeros, iv, encrypt)) {
return -1;
}
// Returning two from the callback in decrypt mode renews the
// session in TLS 1.2 and below.
return encrypt ? 1 : 2;
}
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-03 20:59:25 +00:00
static bool GetServerTicketTime(long *out, const SSL_SESSION *session) {
if (session->tlsext_ticklen < 16 + 16 + SHA256_DIGEST_LENGTH) {
return false;
}
const uint8_t *ciphertext = session->tlsext_tick + 16 + 16;
size_t len = session->tlsext_ticklen - 16 - 16 - SHA256_DIGEST_LENGTH;
std::unique_ptr<uint8_t[]> plaintext(new uint8_t[len]);
Fix run_tests on fuzzer-mode builds. Change-Id: I0767cd4801924170ce13b8143a9586485b8f78af Reviewed-on: https://boringssl-review.googlesource.com/12280 Reviewed-by: Steven Valdez <svaldez@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-15 05:44:05 +00:00
#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
// Fuzzer-mode tickets are unencrypted.
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(plaintext.get(), ciphertext, len);
Fix run_tests on fuzzer-mode builds. Change-Id: I0767cd4801924170ce13b8143a9586485b8f78af Reviewed-on: https://boringssl-review.googlesource.com/12280 Reviewed-by: Steven Valdez <svaldez@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-15 05:44:05 +00:00
#else
static const uint8_t kZeros[16] = {0};
const uint8_t *iv = session->tlsext_tick + 16;
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-03 20:59:25 +00:00
bssl::ScopedEVP_CIPHER_CTX ctx;
int len1, len2;
if (!EVP_DecryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr, kZeros, iv) ||
!EVP_DecryptUpdate(ctx.get(), plaintext.get(), &len1, ciphertext, len) ||
!EVP_DecryptFinal_ex(ctx.get(), plaintext.get() + len1, &len2)) {
return false;
}
len = static_cast<size_t>(len1 + len2);
Fix run_tests on fuzzer-mode builds. Change-Id: I0767cd4801924170ce13b8143a9586485b8f78af Reviewed-on: https://boringssl-review.googlesource.com/12280 Reviewed-by: Steven Valdez <svaldez@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-15 05:44:05 +00:00
#endif
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-03 20:59:25 +00:00
Remove |X509| things from SSL_SESSION. |SSL_SESSION_from_bytes| now takes an |SSL_CTX*|, from which it uses the |X509_METHOD| and buffer pool. This is our API so we can do this. This also requires adding an |SSL_CTX*| argument to |SSL_SESSION_new| for the same reason. However, |SSL_SESSION_new| already has very few callers (and none in third-party code that I can see) so I think we can get away with this. Change-Id: I1337cd2bd8cff03d4b9405ea3146b3b59584aa72 Reviewed-on: https://boringssl-review.googlesource.com/13584 Reviewed-by: Adam Langley <alangley@gmail.com> Commit-Queue: Adam Langley <alangley@gmail.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-01 23:49:37 +00:00
bssl::UniquePtr<SSL_CTX> ssl_ctx(SSL_CTX_new(TLS_method()));
if (!ssl_ctx) {
return false;
}
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-03 20:59:25 +00:00
bssl::UniquePtr<SSL_SESSION> server_session(
Remove |X509| things from SSL_SESSION. |SSL_SESSION_from_bytes| now takes an |SSL_CTX*|, from which it uses the |X509_METHOD| and buffer pool. This is our API so we can do this. This also requires adding an |SSL_CTX*| argument to |SSL_SESSION_new| for the same reason. However, |SSL_SESSION_new| already has very few callers (and none in third-party code that I can see) so I think we can get away with this. Change-Id: I1337cd2bd8cff03d4b9405ea3146b3b59584aa72 Reviewed-on: https://boringssl-review.googlesource.com/13584 Reviewed-by: Adam Langley <alangley@gmail.com> Commit-Queue: Adam Langley <alangley@gmail.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-01 23:49:37 +00:00
SSL_SESSION_from_bytes(plaintext.get(), len, ssl_ctx.get()));
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-03 20:59:25 +00:00
if (!server_session) {
return false;
}
*out = server_session->time;
return true;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool TestSessionTimeout(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
if (!cert || !key) {
return false;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
for (bool server_test : std::vector<bool>{false, true}) {
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
static const time_t kStartTime = 1000;
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
g_current_time.tv_sec = kStartTime;
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
// We are willing to use a longer lifetime for TLS 1.3 sessions as
// resumptions still perform ECDHE.
const time_t timeout = version == TLS1_3_VERSION
? SSL_DEFAULT_SESSION_PSK_DHE_TIMEOUT
: SSL_DEFAULT_SESSION_TIMEOUT;
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(method));
if (!server_ctx || !client_ctx ||
!SSL_CTX_use_certificate(server_ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()) ||
!SSL_CTX_set_min_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_min_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(server_ctx.get(), version)) {
return false;
}
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
SSL_CTX_set_session_cache_mode(client_ctx.get(), SSL_SESS_CACHE_BOTH);
SSL_CTX_set_session_cache_mode(server_ctx.get(), SSL_SESS_CACHE_BOTH);
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
// Both client and server must enforce session timeouts. We configure the
// other side with a frozen clock so it never expires tickets.
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (server_test) {
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
SSL_CTX_set_current_time_cb(client_ctx.get(), FrozenTimeCallback);
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
SSL_CTX_set_current_time_cb(server_ctx.get(), CurrentTimeCallback);
} else {
SSL_CTX_set_current_time_cb(client_ctx.get(), CurrentTimeCallback);
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
SSL_CTX_set_current_time_cb(server_ctx.get(), FrozenTimeCallback);
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
}
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Configure a ticket callback which renews tickets.
SSL_CTX_set_tlsext_ticket_key_cb(server_ctx.get(), RenewTicketCallback);
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL_SESSION> session =
CreateClientSession(client_ctx.get(), server_ctx.get());
if (!session) {
fprintf(stderr, "Error getting session.\n");
return false;
}
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Advance the clock just behind the timeout.
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
g_current_time.tv_sec += timeout - 1;
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(), session.get(),
true /* expect session reused */)) {
fprintf(stderr, "Error resuming session.\n");
return false;
}
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Advance the clock one more second.
g_current_time.tv_sec++;
Reject tickets from the future. This shouldn't happen, but it is good to check to avoid the potential underflow in ssl_session_is_time_valid. This required tweaking the mock clock in bssl_shim to stop going back in time. Change-Id: Id3ab8755139e989190d0b53d4bf90fe1ac203022 Reviewed-on: https://boringssl-review.googlesource.com/11841 Reviewed-by: David Benjamin <davidben@google.com>
2016-10-27 21:36:32 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(), session.get(),
false /* expect session not reused */)) {
fprintf(stderr, "Error resuming session.\n");
return false;
}
Reject tickets from the future. This shouldn't happen, but it is good to check to avoid the potential underflow in ssl_session_is_time_valid. This required tweaking the mock clock in bssl_shim to stop going back in time. Change-Id: Id3ab8755139e989190d0b53d4bf90fe1ac203022 Reviewed-on: https://boringssl-review.googlesource.com/11841 Reviewed-by: David Benjamin <davidben@google.com>
2016-10-27 21:36:32 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Rewind the clock to before the session was minted.
g_current_time.tv_sec = kStartTime - 1;
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(), session.get(),
false /* expect session not reused */)) {
fprintf(stderr, "Error resuming session.\n");
return false;
}
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// SSL 3.0 cannot renew sessions.
if (version == SSL3_VERSION) {
continue;
}
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Renew the session 10 seconds before expiration.
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
time_t new_start_time = kStartTime + timeout - 10;
g_current_time.tv_sec = new_start_time;
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL_SESSION> new_session =
ExpectSessionRenewed(client_ctx.get(), server_ctx.get(), session.get());
if (!new_session) {
fprintf(stderr, "Error renewing session.\n");
return false;
}
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// This new session is not the same object as before.
if (session.get() == new_session.get()) {
fprintf(stderr, "New and old sessions alias.\n");
return false;
}
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-03 20:59:25 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Check the sessions have timestamps measured from issuance.
long session_time = 0;
if (server_test) {
if (!GetServerTicketTime(&session_time, new_session.get())) {
fprintf(stderr, "Failed to decode session ticket.\n");
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-03 20:59:25 +00:00
return false;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
} else {
session_time = new_session->time;
}
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-03 20:59:25 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (session_time != g_current_time.tv_sec) {
fprintf(stderr, "New session is not measured from issuance.\n");
return false;
}
Test that session renewals interact with lifetimes correctly. A renewed session does not refresh the timeout. Add tests for this in preparation for future changes which will revise this logic. Specifically, TLS 1.3 draft 18's ticket_age_add logic will require some tweaks in lifetime tracking to record when the ticket was minted. We'll also likely wish to tweak the parameters for 1.3 to account for (a) ECDHE-PSK means we're only worried about expiring a short-circuited authentication rather than forward secrecy and (b) two hours is too short for a QUIC 0-RTT replacement. Change-Id: I0f1edd09151e7fcb5aee2742ef8600fbd7080df6 Reviewed-on: https://boringssl-review.googlesource.com/12002 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-01 21:50:42 +00:00
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
if (version == TLS1_3_VERSION) {
// Renewal incorporates fresh key material in TLS 1.3, so we extend the
// lifetime TLS 1.3.
g_current_time.tv_sec = new_start_time + timeout - 1;
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(),
new_session.get(),
true /* expect session reused */)) {
fprintf(stderr, "Error resuming renewed session.\n");
return false;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
Use a separate timeout scheme for TLS 1.3. In TLS 1.2, resumption's benefits are more-or-less subsumed by False Start. TLS 1.2 resumption lifetime is bounded by how much traffic we are willing to encrypt without fresh key material, so the lifetime is short. Renewal uses the same key, so we do not allow it to increase lifetimes. In TLS 1.3, resumption unlocks 0-RTT. We do not implement psk_ke, so resumption incorporates fresh key material into both encrypted traffic (except for early data) and renewed tickets. Thus we are both more willing to and more interested in longer lifetimes for tickets. Renewal is also not useless. Thus in TLS 1.3, lifetime is bound separately by the lifetime of a given secret as a psk_dhe_ke authenticator and the lifetime of the online signature which authenticated the initial handshake. This change maintains two lifetimes on an SSL_SESSION: timeout which is the renewable lifetime of this ticket, and auth_timeout which is the non-renewable cliff. It also separates the TLS 1.2 and TLS 1.3 timeouts. The old session timeout defaults and configuration apply to TLS 1.3, and we define new ones for TLS 1.3. Finally, this makes us honor the NewSessionTicket timeout in TLS 1.3. It's no longer a "hint" in 1.3 and there's probably value in avoiding known-useless 0-RTT offers. BUG=120 Change-Id: Iac46d56e5a6a377d8b88b8fa31f492d534cb1b85 Reviewed-on: https://boringssl-review.googlesource.com/13503 Reviewed-by: Adam Langley <agl@google.com>
2017-01-28 19:00:32 +00:00
// The new session expires after the new timeout.
g_current_time.tv_sec = new_start_time + timeout + 1;
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(),
new_session.get(),
false /* expect session ot reused */)) {
fprintf(stderr, "Renewed session's lifetime is too long.\n");
return false;
}
// Renew the session until it begins just past the auth timeout.
time_t auth_end_time = kStartTime + SSL_DEFAULT_SESSION_AUTH_TIMEOUT;
while (new_start_time < auth_end_time - 1000) {
// Get as close as possible to target start time.
new_start_time =
std::min(auth_end_time - 1000, new_start_time + timeout - 1);
g_current_time.tv_sec = new_start_time;
new_session = ExpectSessionRenewed(client_ctx.get(), server_ctx.get(),
new_session.get());
if (!new_session) {
fprintf(stderr, "Error renewing session.\n");
return false;
}
}
// Now the session's lifetime is bound by the auth timeout.
g_current_time.tv_sec = auth_end_time - 1;
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(),
new_session.get(),
true /* expect session reused */)) {
fprintf(stderr, "Error resuming renewed session.\n");
return false;
}
g_current_time.tv_sec = auth_end_time + 1;
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(),
new_session.get(),
false /* expect session ot reused */)) {
fprintf(stderr, "Renewed session's lifetime is too long.\n");
return false;
}
} else {
// The new session is usable just before the old expiration.
g_current_time.tv_sec = kStartTime + timeout - 1;
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(),
new_session.get(),
true /* expect session reused */)) {
fprintf(stderr, "Error resuming renewed session.\n");
return false;
}
// Renewal does not extend the lifetime, so it is not usable beyond the
// old expiration.
g_current_time.tv_sec = kStartTime + timeout + 1;
if (!ExpectSessionReused(client_ctx.get(), server_ctx.get(),
new_session.get(),
false /* expect session not reused */)) {
fprintf(stderr, "Renewed session's lifetime is too long.\n");
return false;
}
Reject tickets from the future. This shouldn't happen, but it is good to check to avoid the potential underflow in ssl_session_is_time_valid. This required tweaking the mock clock in bssl_shim to stop going back in time. Change-Id: Id3ab8755139e989190d0b53d4bf90fe1ac203022 Reviewed-on: https://boringssl-review.googlesource.com/11841 Reviewed-by: David Benjamin <davidben@google.com>
2016-10-27 21:36:32 +01:00
}
Test that servers enforce session timeouts. Extend the DTLS mock clock to apply to sessions too and test that resumption behaves as expected. Change-Id: Ib8fdec91b36e11cfa032872b63cf589f93b3da13 Reviewed-on: https://boringssl-review.googlesource.com/9110 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 18:13:17 +01:00
}
return true;
}
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
static int SwitchContext(SSL *ssl, int *out_alert, void *arg) {
SSL_CTX *ctx = reinterpret_cast<SSL_CTX*>(arg);
SSL_set_SSL_CTX(ssl, ctx);
return SSL_TLSEXT_ERR_OK;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool TestSNICallback(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
// SSL 3.0 lacks extensions.
if (version == SSL3_VERSION) {
return true;
}
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
bssl::UniquePtr<X509> cert2 = GetECDSATestCertificate();
bssl::UniquePtr<EVP_PKEY> key2 = GetECDSATestKey();
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
if (!cert || !key || !cert2 || !key2) {
return false;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Test that switching the |SSL_CTX| at the SNI callback behaves correctly.
static const uint16_t kECDSAWithSHA256 = SSL_SIGN_ECDSA_SECP256R1_SHA256;
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
Move SCT lists and OCSP responses to CERT. Recent changes added SSL-level setters to these APIs. Unfortunately, this has the side effect of breaking SSL_set_SSL_CTX, which is how SNI is typically handled. SSL_set_SSL_CTX is kind of a weird function in that it's very sensitive to which of the hodge-podge of config styles is in use. I previously listed out all the config styles here, but it was long and unhelpful. (I counted up to 7.) Of the various SSL_set_SSL_CTX-visible config styles, the sanest seems to be to move it to CERT. In this case, it's actually quite reasonable since they're very certificate-related. Later we may wish to think about whether we can cut down all 7 kinds of config styles because this is kinda nuts. I'm wondering we should do CERT => SSL_CONFIG, move everything there, and make that be the same structure that is dropped post-handshake (supposing the caller has disavowed SSL_clear and renego). Fruit for later thought. (Note though that comes with a behavior change for all the existing config.) Change-Id: I9aa47d8bd37bf2847869e0b577739d4d579ee4ae Reviewed-on: https://boringssl-review.googlesource.com/13864 Reviewed-by: Martin Kreichgauer <martinkr@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-14 23:34:54 +00:00
static const uint8_t kSCTList[] = {0, 6, 0, 4, 5, 6, 7, 8};
static const uint8_t kOCSPResponse[] = {1, 2, 3, 4};
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL_CTX> server_ctx2(SSL_CTX_new(method));
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(method));
if (!server_ctx || !server_ctx2 || !client_ctx ||
!SSL_CTX_use_certificate(server_ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()) ||
!SSL_CTX_use_certificate(server_ctx2.get(), cert2.get()) ||
!SSL_CTX_use_PrivateKey(server_ctx2.get(), key2.get()) ||
Move SCT lists and OCSP responses to CERT. Recent changes added SSL-level setters to these APIs. Unfortunately, this has the side effect of breaking SSL_set_SSL_CTX, which is how SNI is typically handled. SSL_set_SSL_CTX is kind of a weird function in that it's very sensitive to which of the hodge-podge of config styles is in use. I previously listed out all the config styles here, but it was long and unhelpful. (I counted up to 7.) Of the various SSL_set_SSL_CTX-visible config styles, the sanest seems to be to move it to CERT. In this case, it's actually quite reasonable since they're very certificate-related. Later we may wish to think about whether we can cut down all 7 kinds of config styles because this is kinda nuts. I'm wondering we should do CERT => SSL_CONFIG, move everything there, and make that be the same structure that is dropped post-handshake (supposing the caller has disavowed SSL_clear and renego). Fruit for later thought. (Note though that comes with a behavior change for all the existing config.) Change-Id: I9aa47d8bd37bf2847869e0b577739d4d579ee4ae Reviewed-on: https://boringssl-review.googlesource.com/13864 Reviewed-by: Martin Kreichgauer <martinkr@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-14 23:34:54 +00:00
!SSL_CTX_set_signed_cert_timestamp_list(server_ctx2.get(), kSCTList,
sizeof(kSCTList)) ||
!SSL_CTX_set_ocsp_response(server_ctx2.get(), kOCSPResponse,
sizeof(kOCSPResponse)) ||
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// Historically signing preferences would be lost in some cases with the
// SNI callback, which triggers the TLS 1.2 SHA-1 default. To ensure
// this doesn't happen when |version| is TLS 1.2, configure the private
// key to only sign SHA-256.
!SSL_CTX_set_signing_algorithm_prefs(server_ctx2.get(), &kECDSAWithSHA256,
1) ||
!SSL_CTX_set_min_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_min_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_min_proto_version(server_ctx2.get(), version) ||
!SSL_CTX_set_max_proto_version(server_ctx2.get(), version)) {
return false;
}
SSL_CTX_set_tlsext_servername_callback(server_ctx.get(), SwitchContext);
SSL_CTX_set_tlsext_servername_arg(server_ctx.get(), server_ctx2.get());
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
Move SCT lists and OCSP responses to CERT. Recent changes added SSL-level setters to these APIs. Unfortunately, this has the side effect of breaking SSL_set_SSL_CTX, which is how SNI is typically handled. SSL_set_SSL_CTX is kind of a weird function in that it's very sensitive to which of the hodge-podge of config styles is in use. I previously listed out all the config styles here, but it was long and unhelpful. (I counted up to 7.) Of the various SSL_set_SSL_CTX-visible config styles, the sanest seems to be to move it to CERT. In this case, it's actually quite reasonable since they're very certificate-related. Later we may wish to think about whether we can cut down all 7 kinds of config styles because this is kinda nuts. I'm wondering we should do CERT => SSL_CONFIG, move everything there, and make that be the same structure that is dropped post-handshake (supposing the caller has disavowed SSL_clear and renego). Fruit for later thought. (Note though that comes with a behavior change for all the existing config.) Change-Id: I9aa47d8bd37bf2847869e0b577739d4d579ee4ae Reviewed-on: https://boringssl-review.googlesource.com/13864 Reviewed-by: Martin Kreichgauer <martinkr@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-14 23:34:54 +00:00
SSL_CTX_enable_signed_cert_timestamps(client_ctx.get());
SSL_CTX_enable_ocsp_stapling(client_ctx.get());
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL> client, server;
if (!ConnectClientAndServer(&client, &server, client_ctx.get(),
server_ctx.get(), nullptr)) {
fprintf(stderr, "Handshake failed.\n");
return false;
}
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
// The client should have received |cert2|.
bssl::UniquePtr<X509> peer(SSL_get_peer_certificate(client.get()));
if (!peer || X509_cmp(peer.get(), cert2.get()) != 0) {
fprintf(stderr, "Incorrect certificate received.\n");
return false;
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
}
Move SCT lists and OCSP responses to CERT. Recent changes added SSL-level setters to these APIs. Unfortunately, this has the side effect of breaking SSL_set_SSL_CTX, which is how SNI is typically handled. SSL_set_SSL_CTX is kind of a weird function in that it's very sensitive to which of the hodge-podge of config styles is in use. I previously listed out all the config styles here, but it was long and unhelpful. (I counted up to 7.) Of the various SSL_set_SSL_CTX-visible config styles, the sanest seems to be to move it to CERT. In this case, it's actually quite reasonable since they're very certificate-related. Later we may wish to think about whether we can cut down all 7 kinds of config styles because this is kinda nuts. I'm wondering we should do CERT => SSL_CONFIG, move everything there, and make that be the same structure that is dropped post-handshake (supposing the caller has disavowed SSL_clear and renego). Fruit for later thought. (Note though that comes with a behavior change for all the existing config.) Change-Id: I9aa47d8bd37bf2847869e0b577739d4d579ee4ae Reviewed-on: https://boringssl-review.googlesource.com/13864 Reviewed-by: Martin Kreichgauer <martinkr@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-14 23:34:54 +00:00
// The client should have received |server_ctx2|'s SCT list.
const uint8_t *data;
size_t len;
SSL_get0_signed_cert_timestamp_list(client.get(), &data, &len);
if (Bytes(kSCTList) != Bytes(data, len)) {
fprintf(stderr, "Incorrect SCT list received.\n");
return false;
}
// The client should have received |server_ctx2|'s OCSP response.
SSL_get0_ocsp_response(client.get(), &data, &len);
if (Bytes(kOCSPResponse) != Bytes(data, len)) {
fprintf(stderr, "Incorrect OCSP response received.\n");
return false;
}
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
return true;
}
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
// Test that the early callback can swap the maximum version.
TEST(SSLTest, EarlyCallbackVersionSwitch) {
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(TLS_method()));
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(TLS_method()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(cert);
ASSERT_TRUE(key);
ASSERT_TRUE(server_ctx);
ASSERT_TRUE(client_ctx);
ASSERT_TRUE(SSL_CTX_use_certificate(server_ctx.get(), cert.get()));
ASSERT_TRUE(SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()));
ASSERT_TRUE(SSL_CTX_set_max_proto_version(client_ctx.get(), TLS1_3_VERSION));
ASSERT_TRUE(SSL_CTX_set_max_proto_version(server_ctx.get(), TLS1_3_VERSION));
SSL_CTX_set_select_certificate_cb(
Name |select_certificate_cb| return values The |select_certificate_cb| return values are somewhat confusing due to the fact that they don't match the |cert_cb| ones, despite the similarities between the two callbacks (they both have "certificate" in the name! well, sort of). This also documents the error return value (-1) which was previously undocumented, and it expands the |SSL_CTX_set_select_certificate_cb| documentation regarding retrial (by shamelessly copying from |SSL_CTX_set_ticket_aead_method|). Also updates other scattered documentation that was missed by previous changes. Change-Id: Ib962b31d08e6475e09954cbc3c939988b0ba13f7 Reviewed-on: https://boringssl-review.googlesource.com/14245 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-14 23:36:00 +00:00
server_ctx.get(),
[](const SSL_CLIENT_HELLO *client_hello) -> ssl_select_cert_result_t {
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
if (!SSL_set_max_proto_version(client_hello->ssl, TLS1_2_VERSION)) {
Name |select_certificate_cb| return values The |select_certificate_cb| return values are somewhat confusing due to the fact that they don't match the |cert_cb| ones, despite the similarities between the two callbacks (they both have "certificate" in the name! well, sort of). This also documents the error return value (-1) which was previously undocumented, and it expands the |SSL_CTX_set_select_certificate_cb| documentation regarding retrial (by shamelessly copying from |SSL_CTX_set_ticket_aead_method|). Also updates other scattered documentation that was missed by previous changes. Change-Id: Ib962b31d08e6475e09954cbc3c939988b0ba13f7 Reviewed-on: https://boringssl-review.googlesource.com/14245 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-14 23:36:00 +00:00
return ssl_select_cert_error;
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
}
Test that the early callback can affect max_version. The early callback needs to run before even version negotiation has been resolved. Change-Id: Ibb449ccec07dedef19b7827400ef318fa2f422c0 Reviewed-on: https://boringssl-review.googlesource.com/10722 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-30 05:35:36 +01:00
Name |select_certificate_cb| return values The |select_certificate_cb| return values are somewhat confusing due to the fact that they don't match the |cert_cb| ones, despite the similarities between the two callbacks (they both have "certificate" in the name! well, sort of). This also documents the error return value (-1) which was previously undocumented, and it expands the |SSL_CTX_set_select_certificate_cb| documentation regarding retrial (by shamelessly copying from |SSL_CTX_set_ticket_aead_method|). Also updates other scattered documentation that was missed by previous changes. Change-Id: Ib962b31d08e6475e09954cbc3c939988b0ba13f7 Reviewed-on: https://boringssl-review.googlesource.com/14245 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-14 23:36:00 +00:00
return ssl_select_cert_success;
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
});
Test that the early callback can affect max_version. The early callback needs to run before even version negotiation has been resolved. Change-Id: Ibb449ccec07dedef19b7827400ef318fa2f422c0 Reviewed-on: https://boringssl-review.googlesource.com/10722 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-30 05:35:36 +01:00
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-18 04:10:28 +01:00
bssl::UniquePtr<SSL> client, server;
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ConnectClientAndServer(&client, &server, client_ctx.get(),
server_ctx.get(), nullptr));
EXPECT_EQ(TLS1_2_VERSION, SSL_version(client.get()));
Test that the early callback can affect max_version. The early callback needs to run before even version negotiation has been resolved. Change-Id: Ibb449ccec07dedef19b7827400ef318fa2f422c0 Reviewed-on: https://boringssl-review.googlesource.com/10722 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-30 05:35:36 +01:00
}
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
TEST(SSLTest, SetVersion) {
Don't return invalid versions in version_from_wire. This is in preparation for using the supported_versions extension to experiment with draft TLS 1.3 versions, since we don't wish to restore the fallback. With versions begin opaque values, we will want version_from_wire to reject unknown values, not attempt to preserve order in some way. This means ClientHello.version processing needs to be separate code. That's just written out fully in negotiate_version now. It also means SSL_set_{min,max}_version will notice invalid inputs which aligns us better with upstream's versions of those APIs. This CL doesn't replace ssl->version with an internal-representation version, though follow work should do it once a couple of changes land in consumers. BUG=90 Change-Id: Id2f5e1fa72847c823ee7f082e9e69f55e51ce9da Reviewed-on: https://boringssl-review.googlesource.com/11122 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-20 00:57:37 +01:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ctx);
Support default versions with set_{min,max}_proto_version. Upstream makes 0 mean "min/max supported version". Match that behavior, although call it "default" instead. It shouldn't get you TLS 1.3 until we're ready to turn it on everywhere. BUG=90 Change-Id: I9f122fceb701b7d4de2ff70afbc1ffdf370cb97e Reviewed-on: https://boringssl-review.googlesource.com/11181 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21 21:53:09 +01:00
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
// Set valid TLS versions.
EXPECT_TRUE(SSL_CTX_set_max_proto_version(ctx.get(), TLS1_VERSION));
EXPECT_TRUE(SSL_CTX_set_max_proto_version(ctx.get(), TLS1_1_VERSION));
EXPECT_TRUE(SSL_CTX_set_min_proto_version(ctx.get(), TLS1_VERSION));
EXPECT_TRUE(SSL_CTX_set_min_proto_version(ctx.get(), TLS1_1_VERSION));
// Invalid TLS versions are rejected.
EXPECT_FALSE(SSL_CTX_set_max_proto_version(ctx.get(), DTLS1_VERSION));
EXPECT_FALSE(SSL_CTX_set_max_proto_version(ctx.get(), 0x0200));
EXPECT_FALSE(SSL_CTX_set_max_proto_version(ctx.get(), 0x1234));
EXPECT_FALSE(SSL_CTX_set_min_proto_version(ctx.get(), DTLS1_VERSION));
EXPECT_FALSE(SSL_CTX_set_min_proto_version(ctx.get(), 0x0200));
EXPECT_FALSE(SSL_CTX_set_min_proto_version(ctx.get(), 0x1234));
// Zero is the default version.
EXPECT_TRUE(SSL_CTX_set_max_proto_version(ctx.get(), 0));
EXPECT_EQ(TLS1_2_VERSION, ctx->max_version);
EXPECT_TRUE(SSL_CTX_set_min_proto_version(ctx.get(), 0));
Disable SSLv3 by default. As a precursor to removing the code entirely later, disable the protocol by default. Callers must use SSL_CTX_set_min_version to enable it. This change also makes SSLv3_method *not* enable SSL 3.0. Normally version-specific methods set the minimum and maximum version to their version. SSLv3_method leaves the minimum at the default, so we will treat it as all versions disabled. To help debugging, the error code is switched from WRONG_SSL_VERSION to a new NO_SUPPORTED_VERSIONS_ENABLED. This also defines OPENSSL_NO_SSL3 and OPENSSL_NO_SSL3_METHOD to kick in any no-ssl3 build paths in consumers which should provide a convenient hook for any upstreaming changes that may be needed. (OPENSSL_NO_SSL3 existed in older versions of OpenSSL, so in principle one may encounter an OpenSSL with the same settings.) Change-Id: I96a8f2f568eb77b2537b3a774b2f7108bd67dd0c Reviewed-on: https://boringssl-review.googlesource.com/14031 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-01 21:48:38 +00:00
EXPECT_EQ(TLS1_VERSION, ctx->min_version);
// SSL 3.0 and TLS 1.3 are available, but not by default.
EXPECT_TRUE(SSL_CTX_set_min_proto_version(ctx.get(), SSL3_VERSION));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
EXPECT_EQ(SSL3_VERSION, ctx->min_version);
Disable SSLv3 by default. As a precursor to removing the code entirely later, disable the protocol by default. Callers must use SSL_CTX_set_min_version to enable it. This change also makes SSLv3_method *not* enable SSL 3.0. Normally version-specific methods set the minimum and maximum version to their version. SSLv3_method leaves the minimum at the default, so we will treat it as all versions disabled. To help debugging, the error code is switched from WRONG_SSL_VERSION to a new NO_SUPPORTED_VERSIONS_ENABLED. This also defines OPENSSL_NO_SSL3 and OPENSSL_NO_SSL3_METHOD to kick in any no-ssl3 build paths in consumers which should provide a convenient hook for any upstreaming changes that may be needed. (OPENSSL_NO_SSL3 existed in older versions of OpenSSL, so in principle one may encounter an OpenSSL with the same settings.) Change-Id: I96a8f2f568eb77b2537b3a774b2f7108bd67dd0c Reviewed-on: https://boringssl-review.googlesource.com/14031 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-01 21:48:38 +00:00
EXPECT_TRUE(SSL_CTX_set_max_proto_version(ctx.get(), TLS1_3_VERSION));
EXPECT_EQ(TLS1_3_VERSION, ctx->max_version);
Support default versions with set_{min,max}_proto_version. Upstream makes 0 mean "min/max supported version". Match that behavior, although call it "default" instead. It shouldn't get you TLS 1.3 until we're ready to turn it on everywhere. BUG=90 Change-Id: I9f122fceb701b7d4de2ff70afbc1ffdf370cb97e Reviewed-on: https://boringssl-review.googlesource.com/11181 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21 21:53:09 +01:00
Don't return invalid versions in version_from_wire. This is in preparation for using the supported_versions extension to experiment with draft TLS 1.3 versions, since we don't wish to restore the fallback. With versions begin opaque values, we will want version_from_wire to reject unknown values, not attempt to preserve order in some way. This means ClientHello.version processing needs to be separate code. That's just written out fully in negotiate_version now. It also means SSL_set_{min,max}_version will notice invalid inputs which aligns us better with upstream's versions of those APIs. This CL doesn't replace ssl->version with an internal-representation version, though follow work should do it once a couple of changes land in consumers. BUG=90 Change-Id: Id2f5e1fa72847c823ee7f082e9e69f55e51ce9da Reviewed-on: https://boringssl-review.googlesource.com/11122 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-20 00:57:37 +01:00
ctx.reset(SSL_CTX_new(DTLS_method()));
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
ASSERT_TRUE(ctx);
Don't return invalid versions in version_from_wire. This is in preparation for using the supported_versions extension to experiment with draft TLS 1.3 versions, since we don't wish to restore the fallback. With versions begin opaque values, we will want version_from_wire to reject unknown values, not attempt to preserve order in some way. This means ClientHello.version processing needs to be separate code. That's just written out fully in negotiate_version now. It also means SSL_set_{min,max}_version will notice invalid inputs which aligns us better with upstream's versions of those APIs. This CL doesn't replace ssl->version with an internal-representation version, though follow work should do it once a couple of changes land in consumers. BUG=90 Change-Id: Id2f5e1fa72847c823ee7f082e9e69f55e51ce9da Reviewed-on: https://boringssl-review.googlesource.com/11122 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-20 00:57:37 +01:00
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
EXPECT_TRUE(SSL_CTX_set_max_proto_version(ctx.get(), DTLS1_VERSION));
EXPECT_TRUE(SSL_CTX_set_max_proto_version(ctx.get(), DTLS1_2_VERSION));
EXPECT_TRUE(SSL_CTX_set_min_proto_version(ctx.get(), DTLS1_VERSION));
EXPECT_TRUE(SSL_CTX_set_min_proto_version(ctx.get(), DTLS1_2_VERSION));
Support default versions with set_{min,max}_proto_version. Upstream makes 0 mean "min/max supported version". Match that behavior, although call it "default" instead. It shouldn't get you TLS 1.3 until we're ready to turn it on everywhere. BUG=90 Change-Id: I9f122fceb701b7d4de2ff70afbc1ffdf370cb97e Reviewed-on: https://boringssl-review.googlesource.com/11181 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21 21:53:09 +01:00
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
EXPECT_FALSE(SSL_CTX_set_max_proto_version(ctx.get(), TLS1_VERSION));
EXPECT_FALSE(SSL_CTX_set_max_proto_version(ctx.get(), 0xfefe /* DTLS 1.1 */));
EXPECT_FALSE(SSL_CTX_set_max_proto_version(ctx.get(), 0xfffe /* DTLS 0.1 */));
EXPECT_FALSE(SSL_CTX_set_max_proto_version(ctx.get(), 0x1234));
EXPECT_FALSE(SSL_CTX_set_min_proto_version(ctx.get(), TLS1_VERSION));
EXPECT_FALSE(SSL_CTX_set_min_proto_version(ctx.get(), 0xfefe /* DTLS 1.1 */));
EXPECT_FALSE(SSL_CTX_set_min_proto_version(ctx.get(), 0xfffe /* DTLS 0.1 */));
EXPECT_FALSE(SSL_CTX_set_min_proto_version(ctx.get(), 0x1234));
Support default versions with set_{min,max}_proto_version. Upstream makes 0 mean "min/max supported version". Match that behavior, although call it "default" instead. It shouldn't get you TLS 1.3 until we're ready to turn it on everywhere. BUG=90 Change-Id: I9f122fceb701b7d4de2ff70afbc1ffdf370cb97e Reviewed-on: https://boringssl-review.googlesource.com/11181 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21 21:53:09 +01:00
Convert some of ssl_test to GTest more thoroughly. The more complex ones will want a TEST_P, but here are a few easy ones to start with. BUG=129 Change-Id: I2e341d04910c0b05a5bc7afec961c4541ca7db41 Reviewed-on: https://boringssl-review.googlesource.com/13622 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 15:58:26 +00:00
EXPECT_TRUE(SSL_CTX_set_max_proto_version(ctx.get(), 0));
EXPECT_EQ(TLS1_2_VERSION, ctx->max_version);
EXPECT_TRUE(SSL_CTX_set_min_proto_version(ctx.get(), 0));
EXPECT_EQ(TLS1_1_VERSION, ctx->min_version);
Don't return invalid versions in version_from_wire. This is in preparation for using the supported_versions extension to experiment with draft TLS 1.3 versions, since we don't wish to restore the fallback. With versions begin opaque values, we will want version_from_wire to reject unknown values, not attempt to preserve order in some way. This means ClientHello.version processing needs to be separate code. That's just written out fully in negotiate_version now. It also means SSL_set_{min,max}_version will notice invalid inputs which aligns us better with upstream's versions of those APIs. This CL doesn't replace ssl->version with an internal-representation version, though follow work should do it once a couple of changes land in consumers. BUG=90 Change-Id: Id2f5e1fa72847c823ee7f082e9e69f55e51ce9da Reviewed-on: https://boringssl-review.googlesource.com/11122 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-20 00:57:37 +01:00
}
Test name-based version APIs are reported as expected. Notably, Conscrypt uses SSL_SESSION_get_version, so we should have tests for it. Change-Id: I670f1b1b9951f840f27cb62dd36ef4f05042c974 Reviewed-on: https://boringssl-review.googlesource.com/12881 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-12-15 18:53:25 +00:00
static const char *GetVersionName(uint16_t version) {
switch (version) {
case SSL3_VERSION:
return "SSLv3";
case TLS1_VERSION:
return "TLSv1";
case TLS1_1_VERSION:
return "TLSv1.1";
case TLS1_2_VERSION:
return "TLSv1.2";
case TLS1_3_VERSION:
return "TLSv1.3";
case DTLS1_VERSION:
return "DTLSv1";
case DTLS1_2_VERSION:
return "DTLSv1.2";
default:
return "???";
}
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool TestVersion(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
Add a test for SSL_version. We were never really testing this. Change-Id: Ia953870053d16d3994ae48172017d384c7bc3601 Reviewed-on: https://boringssl-review.googlesource.com/11341 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27 19:09:15 +01:00
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
if (!cert || !key) {
return false;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL> client, server;
if (!server_ctx || !client_ctx ||
!SSL_CTX_use_certificate(server_ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()) ||
!SSL_CTX_set_min_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_min_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(server_ctx.get(), version) ||
!ConnectClientAndServer(&client, &server, client_ctx.get(),
server_ctx.get(), nullptr /* no session */)) {
fprintf(stderr, "Failed to connect.\n");
return false;
}
Add a test for SSL_version. We were never really testing this. Change-Id: Ia953870053d16d3994ae48172017d384c7bc3601 Reviewed-on: https://boringssl-review.googlesource.com/11341 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27 19:09:15 +01:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (SSL_version(client.get()) != version ||
SSL_version(server.get()) != version) {
fprintf(stderr, "Version mismatch. Got %04x and %04x, wanted %04x.\n",
SSL_version(client.get()), SSL_version(server.get()), version);
return false;
Add a test for SSL_version. We were never really testing this. Change-Id: Ia953870053d16d3994ae48172017d384c7bc3601 Reviewed-on: https://boringssl-review.googlesource.com/11341 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27 19:09:15 +01:00
}
Test name-based version APIs are reported as expected. Notably, Conscrypt uses SSL_SESSION_get_version, so we should have tests for it. Change-Id: I670f1b1b9951f840f27cb62dd36ef4f05042c974 Reviewed-on: https://boringssl-review.googlesource.com/12881 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-12-15 18:53:25 +00:00
// Test the version name is reported as expected.
const char *version_name = GetVersionName(version);
if (strcmp(version_name, SSL_get_version(client.get())) != 0 ||
strcmp(version_name, SSL_get_version(server.get())) != 0) {
fprintf(stderr, "Version name mismatch. Got '%s' and '%s', wanted '%s'.\n",
SSL_get_version(client.get()), SSL_get_version(server.get()),
version_name);
return false;
}
// Test SSL_SESSION reports the same name.
const char *client_name =
SSL_SESSION_get_version(SSL_get_session(client.get()));
const char *server_name =
SSL_SESSION_get_version(SSL_get_session(server.get()));
if (strcmp(version_name, client_name) != 0 ||
strcmp(version_name, server_name) != 0) {
fprintf(stderr,
"Session version name mismatch. Got '%s' and '%s', wanted '%s'.\n",
client_name, server_name, version_name);
return false;
}
Add a test for SSL_version. We were never really testing this. Change-Id: Ia953870053d16d3994ae48172017d384c7bc3601 Reviewed-on: https://boringssl-review.googlesource.com/11341 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27 19:09:15 +01:00
return true;
}
Negotiate the cipher suite before ALPN. HTTP/2 places requirements on the cipher suite. So that servers can decline HTTP/2 when these requirements aren't met, defer ALPN negotiation. See also b/32553041. Change-Id: Idbcf049f9c8bda06a8be52a0154fe76e84607268 Reviewed-on: https://boringssl-review.googlesource.com/11982 Reviewed-by: Adam Langley <agl@google.com>
2016-10-31 22:01:13 +00:00
// Tests that that |SSL_get_pending_cipher| is available during the ALPN
// selection callback.
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool TestALPNCipherAvailable(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
// SSL 3.0 lacks extensions.
if (version == SSL3_VERSION) {
return true;
}
Negotiate the cipher suite before ALPN. HTTP/2 places requirements on the cipher suite. So that servers can decline HTTP/2 when these requirements aren't met, defer ALPN negotiation. See also b/32553041. Change-Id: Idbcf049f9c8bda06a8be52a0154fe76e84607268 Reviewed-on: https://boringssl-review.googlesource.com/11982 Reviewed-by: Adam Langley <agl@google.com>
2016-10-31 22:01:13 +00:00
static const uint8_t kALPNProtos[] = {0x03, 'f', 'o', 'o'};
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
if (!cert || !key) {
return false;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(method));
if (!ctx || !SSL_CTX_use_certificate(ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(ctx.get(), key.get()) ||
!SSL_CTX_set_min_proto_version(ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(ctx.get(), version) ||
SSL_CTX_set_alpn_protos(ctx.get(), kALPNProtos, sizeof(kALPNProtos)) !=
0) {
return false;
}
// The ALPN callback does not fail the handshake on error, so have the
// callback write a boolean.
std::pair<uint16_t, bool> callback_state(version, false);
SSL_CTX_set_alpn_select_cb(
ctx.get(),
[](SSL *ssl, const uint8_t **out, uint8_t *out_len, const uint8_t *in,
unsigned in_len, void *arg) -> int {
auto state = reinterpret_cast<std::pair<uint16_t, bool> *>(arg);
if (SSL_get_pending_cipher(ssl) != nullptr &&
SSL_version(ssl) == state->first) {
state->second = true;
}
return SSL_TLSEXT_ERR_NOACK;
},
&callback_state);
Negotiate the cipher suite before ALPN. HTTP/2 places requirements on the cipher suite. So that servers can decline HTTP/2 when these requirements aren't met, defer ALPN negotiation. See also b/32553041. Change-Id: Idbcf049f9c8bda06a8be52a0154fe76e84607268 Reviewed-on: https://boringssl-review.googlesource.com/11982 Reviewed-by: Adam Langley <agl@google.com>
2016-10-31 22:01:13 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
bssl::UniquePtr<SSL> client, server;
if (!ConnectClientAndServer(&client, &server, ctx.get(), ctx.get(),
nullptr /* no session */)) {
return false;
}
Negotiate the cipher suite before ALPN. HTTP/2 places requirements on the cipher suite. So that servers can decline HTTP/2 when these requirements aren't met, defer ALPN negotiation. See also b/32553041. Change-Id: Idbcf049f9c8bda06a8be52a0154fe76e84607268 Reviewed-on: https://boringssl-review.googlesource.com/11982 Reviewed-by: Adam Langley <agl@google.com>
2016-10-31 22:01:13 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
if (!callback_state.second) {
fprintf(stderr, "The pending cipher was not known in the ALPN callback.\n");
return false;
}
return true;
}
Negotiate the cipher suite before ALPN. HTTP/2 places requirements on the cipher suite. So that servers can decline HTTP/2 when these requirements aren't met, defer ALPN negotiation. See also b/32553041. Change-Id: Idbcf049f9c8bda06a8be52a0154fe76e84607268 Reviewed-on: https://boringssl-review.googlesource.com/11982 Reviewed-by: Adam Langley <agl@google.com>
2016-10-31 22:01:13 +00:00
Fix SSL_clear's interaction with session resumption. Prior to 87eab4902d1003983079881d3ee8a66ec2eaccc2, due to some confusions between configuration and connection state, SSL_clear had the side effect of offering the previously established session on the new connection. wpa_supplicant relies on this behavior, so restore it for TLS 1.2 and below and add a test. (This behavior is largely incompatible with TLS 1.3's post-handshake tickets, so it won't work in 1.3. It'll act as if we configured an unresumable session instead.) Change-Id: Iaee8c0afc1cb65c0ab7397435602732b901b1c2d Reviewed-on: https://boringssl-review.googlesource.com/12632 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-07 20:57:14 +00:00
static bool TestSSLClearSessionResumption(bool is_dtls,
const SSL_METHOD *method,
uint16_t version) {
// Skip this for TLS 1.3. TLS 1.3's ticket mechanism is incompatible with this
// API pattern.
if (version == TLS1_3_VERSION) {
return true;
}
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(method));
if (!cert || !key || !server_ctx || !client_ctx ||
!SSL_CTX_use_certificate(server_ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()) ||
!SSL_CTX_set_min_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(client_ctx.get(), version) ||
!SSL_CTX_set_min_proto_version(server_ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(server_ctx.get(), version)) {
return false;
}
// Connect a client and a server.
bssl::UniquePtr<SSL> client, server;
if (!ConnectClientAndServer(&client, &server, client_ctx.get(),
server_ctx.get(), nullptr /* no session */)) {
return false;
}
if (SSL_session_reused(client.get()) ||
SSL_session_reused(server.get())) {
fprintf(stderr, "Session unexpectedly reused.\n");
return false;
}
// Reset everything.
if (!SSL_clear(client.get()) ||
!SSL_clear(server.get())) {
fprintf(stderr, "SSL_clear failed.\n");
return false;
}
// Attempt to connect a second time.
if (!CompleteHandshakes(client.get(), server.get())) {
fprintf(stderr, "Could not reuse SSL objects.\n");
return false;
}
// |SSL_clear| should implicitly offer the previous session to the server.
if (!SSL_session_reused(client.get()) ||
!SSL_session_reused(server.get())) {
fprintf(stderr, "Session was not reused in second try.\n");
return false;
}
return true;
}
Add tests for auto-chaining. Alas, wpa_supplicant relies on the auto-chaining feature, so we can't easily remove it. Write tests for it to ensure it stays working. These test currently do not work for TLS 1.3 because the feature is broken in 1.3. A follow-up change will fix this. BUG=70 Change-Id: I2c04f55b712d66f5af1556254a5b017ebc3244f7 Reviewed-on: https://boringssl-review.googlesource.com/12965 Reviewed-by: Adam Langley <agl@google.com>
2016-12-20 22:23:11 +00:00
static bool ChainsEqual(STACK_OF(X509) *chain,
const std::vector<X509 *> &expected) {
if (sk_X509_num(chain) != expected.size()) {
return false;
}
for (size_t i = 0; i < expected.size(); i++) {
if (X509_cmp(sk_X509_value(chain, i), expected[i]) != 0) {
return false;
}
}
return true;
}
static bool TestAutoChain(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
bssl::UniquePtr<X509> cert = GetChainTestCertificate();
bssl::UniquePtr<X509> intermediate = GetChainTestIntermediate();
bssl::UniquePtr<EVP_PKEY> key = GetChainTestKey();
if (!cert || !intermediate || !key) {
return false;
}
// Configure both client and server to accept any certificate. Add
// |intermediate| to the cert store.
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(method));
if (!ctx ||
!SSL_CTX_use_certificate(ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(ctx.get(), key.get()) ||
!SSL_CTX_set_min_proto_version(ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(ctx.get(), version) ||
!X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx.get()),
intermediate.get())) {
return false;
}
SSL_CTX_set_verify(
ctx.get(), SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, nullptr);
SSL_CTX_set_cert_verify_callback(ctx.get(), VerifySucceed, NULL);
// By default, the client and server should each only send the leaf.
bssl::UniquePtr<SSL> client, server;
if (!ConnectClientAndServer(&client, &server, ctx.get(), ctx.get(),
nullptr /* no session */)) {
return false;
}
if (!ChainsEqual(SSL_get_peer_full_cert_chain(client.get()), {cert.get()})) {
fprintf(stderr, "Client-received chain did not match.\n");
return false;
}
if (!ChainsEqual(SSL_get_peer_full_cert_chain(server.get()), {cert.get()})) {
fprintf(stderr, "Server-received chain did not match.\n");
return false;
}
// If auto-chaining is enabled, then the intermediate is sent.
SSL_CTX_clear_mode(ctx.get(), SSL_MODE_NO_AUTO_CHAIN);
if (!ConnectClientAndServer(&client, &server, ctx.get(), ctx.get(),
nullptr /* no session */)) {
return false;
}
if (!ChainsEqual(SSL_get_peer_full_cert_chain(client.get()),
{cert.get(), intermediate.get()})) {
fprintf(stderr, "Client-received chain did not match (auto-chaining).\n");
return false;
}
if (!ChainsEqual(SSL_get_peer_full_cert_chain(server.get()),
{cert.get(), intermediate.get()})) {
fprintf(stderr, "Server-received chain did not match (auto-chaining).\n");
return false;
}
// Auto-chaining does not override explicitly-configured intermediates.
if (!SSL_CTX_add1_chain_cert(ctx.get(), cert.get()) ||
!ConnectClientAndServer(&client, &server, ctx.get(), ctx.get(),
nullptr /* no session */)) {
return false;
}
if (!ChainsEqual(SSL_get_peer_full_cert_chain(client.get()),
{cert.get(), cert.get()})) {
fprintf(stderr,
"Client-received chain did not match (auto-chaining, explicit "
"intermediate).\n");
return false;
}
if (!ChainsEqual(SSL_get_peer_full_cert_chain(server.get()),
{cert.get(), cert.get()})) {
fprintf(stderr,
"Server-received chain did not match (auto-chaining, explicit "
"intermediate).\n");
return false;
}
return true;
}
Add tests around SSL_write's retry behavior. SSL_write is remarkably complicated. Change-Id: I1cb8d00af1b4c5e2d90187d5f87951f25e27f224 Reviewed-on: https://boringssl-review.googlesource.com/13050 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-01-02 04:56:36 +00:00
static bool ExpectBadWriteRetry() {
int err = ERR_get_error();
if (ERR_GET_LIB(err) != ERR_LIB_SSL ||
ERR_GET_REASON(err) != SSL_R_BAD_WRITE_RETRY) {
char buf[ERR_ERROR_STRING_BUF_LEN];
ERR_error_string_n(err, buf, sizeof(buf));
fprintf(stderr, "Wanted SSL_R_BAD_WRITE_RETRY, got: %s.\n", buf);
return false;
}
if (ERR_peek_error() != 0) {
fprintf(stderr, "Unexpected error following SSL_R_BAD_WRITE_RETRY.\n");
return false;
}
return true;
}
static bool TestSSLWriteRetry(bool is_dtls, const SSL_METHOD *method,
uint16_t version) {
if (is_dtls) {
return true;
}
for (bool enable_partial_write : std::vector<bool>{false, true}) {
// Connect a client and server.
bssl::UniquePtr<X509> cert = GetTestCertificate();
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(method));
bssl::UniquePtr<SSL> client, server;
if (!cert || !key || !ctx ||
!SSL_CTX_use_certificate(ctx.get(), cert.get()) ||
!SSL_CTX_use_PrivateKey(ctx.get(), key.get()) ||
!SSL_CTX_set_min_proto_version(ctx.get(), version) ||
!SSL_CTX_set_max_proto_version(ctx.get(), version) ||
!ConnectClientAndServer(&client, &server, ctx.get(), ctx.get(),
nullptr /* no session */)) {
return false;
}
if (enable_partial_write) {
SSL_set_mode(client.get(), SSL_MODE_ENABLE_PARTIAL_WRITE);
}
// Write without reading until the buffer is full and we have an unfinished
// write. Keep a count so we may reread it again later. "hello!" will be
// written in two chunks, "hello" and "!".
char data[] = "hello!";
static const int kChunkLen = 5; // The length of "hello".
unsigned count = 0;
for (;;) {
int ret = SSL_write(client.get(), data, kChunkLen);
if (ret <= 0) {
int err = SSL_get_error(client.get(), ret);
if (SSL_get_error(client.get(), ret) == SSL_ERROR_WANT_WRITE) {
break;
}
fprintf(stderr, "SSL_write failed in unexpected way: %d\n", err);
return false;
}
if (ret != 5) {
fprintf(stderr, "SSL_write wrote %d bytes, expected 5.\n", ret);
return false;
}
count++;
}
// Retrying with the same parameters is legal.
if (SSL_get_error(client.get(), SSL_write(client.get(), data, kChunkLen)) !=
SSL_ERROR_WANT_WRITE) {
fprintf(stderr, "SSL_write retry unexpectedly failed.\n");
return false;
}
// Retrying with the same buffer but shorter length is not legal.
if (SSL_get_error(client.get(),
SSL_write(client.get(), data, kChunkLen - 1)) !=
SSL_ERROR_SSL ||
!ExpectBadWriteRetry()) {
fprintf(stderr, "SSL_write retry did not fail as expected.\n");
return false;
}
// Retrying with a different buffer pointer is not legal.
char data2[] = "hello";
if (SSL_get_error(client.get(), SSL_write(client.get(), data2,
kChunkLen)) != SSL_ERROR_SSL ||
!ExpectBadWriteRetry()) {
fprintf(stderr, "SSL_write retry did not fail as expected.\n");
return false;
}
// With |SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER|, the buffer may move.
SSL_set_mode(client.get(), SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
if (SSL_get_error(client.get(),
SSL_write(client.get(), data2, kChunkLen)) !=
SSL_ERROR_WANT_WRITE) {
fprintf(stderr, "SSL_write retry unexpectedly failed.\n");
return false;
}
// |SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER| does not disable length checks.
if (SSL_get_error(client.get(),
SSL_write(client.get(), data2, kChunkLen - 1)) !=
SSL_ERROR_SSL ||
!ExpectBadWriteRetry()) {
fprintf(stderr, "SSL_write retry did not fail as expected.\n");
return false;
}
// Retrying with a larger buffer is legal.
if (SSL_get_error(client.get(),
SSL_write(client.get(), data, kChunkLen + 1)) !=
SSL_ERROR_WANT_WRITE) {
fprintf(stderr, "SSL_write retry unexpectedly failed.\n");
return false;
}
// Drain the buffer.
char buf[20];
for (unsigned i = 0; i < count; i++) {
if (SSL_read(server.get(), buf, sizeof(buf)) != kChunkLen ||
OPENSSL_memcmp(buf, "hello", kChunkLen) != 0) {
fprintf(stderr, "Failed to read initial records.\n");
return false;
}
}
// Now that there is space, a retry with a larger buffer should flush the
// pending record, skip over that many bytes of input (on assumption they
// are the same), and write the remainder. If SSL_MODE_ENABLE_PARTIAL_WRITE
// is set, this will complete in two steps.
char data3[] = "_____!";
if (enable_partial_write) {
if (SSL_write(client.get(), data3, kChunkLen + 1) != kChunkLen ||
SSL_write(client.get(), data3 + kChunkLen, 1) != 1) {
fprintf(stderr, "SSL_write retry failed.\n");
return false;
}
} else if (SSL_write(client.get(), data3, kChunkLen + 1) != kChunkLen + 1) {
fprintf(stderr, "SSL_write retry failed.\n");
return false;
}
// Check the last write was correct. The data will be spread over two
// records, so SSL_read returns twice.
if (SSL_read(server.get(), buf, sizeof(buf)) != kChunkLen ||
OPENSSL_memcmp(buf, "hello", kChunkLen) != 0 ||
SSL_read(server.get(), buf, sizeof(buf)) != 1 ||
buf[0] != '!') {
fprintf(stderr, "Failed to read write retry.\n");
return false;
}
}
return true;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
static bool ForEachVersion(bool (*test_func)(bool is_dtls,
const SSL_METHOD *method,
uint16_t version)) {
static uint16_t kTLSVersions[] = {
Fix ssl_test with BORINGSSL_ANDROID_SYSTEM. We need to suppress a few tests on the system Android build until RSA-PSS is shipped there. Change-Id: I5843997aae9fa499ec08d76f44fdf3b523599e1c Reviewed-on: https://boringssl-review.googlesource.com/13267 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-01-25 03:47:18 +00:00
SSL3_VERSION,
TLS1_VERSION,
TLS1_1_VERSION,
TLS1_2_VERSION,
// TLS 1.3 requires RSA-PSS, which is disabled for Android system builds.
#if !defined(BORINGSSL_ANDROID_SYSTEM)
TLS1_3_VERSION,
#endif
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
};
static uint16_t kDTLSVersions[] = {
DTLS1_VERSION, DTLS1_2_VERSION,
};
for (uint16_t version : kTLSVersions) {
if (!test_func(false, TLS_method(), version)) {
fprintf(stderr, "Test failed at TLS version %04x.\n", version);
Negotiate the cipher suite before ALPN. HTTP/2 places requirements on the cipher suite. So that servers can decline HTTP/2 when these requirements aren't met, defer ALPN negotiation. See also b/32553041. Change-Id: Idbcf049f9c8bda06a8be52a0154fe76e84607268 Reviewed-on: https://boringssl-review.googlesource.com/11982 Reviewed-by: Adam Langley <agl@google.com>
2016-10-31 22:01:13 +00:00
return false;
}
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
}
Negotiate the cipher suite before ALPN. HTTP/2 places requirements on the cipher suite. So that servers can decline HTTP/2 when these requirements aren't met, defer ALPN negotiation. See also b/32553041. Change-Id: Idbcf049f9c8bda06a8be52a0154fe76e84607268 Reviewed-on: https://boringssl-review.googlesource.com/11982 Reviewed-by: Adam Langley <agl@google.com>
2016-10-31 22:01:13 +00:00
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
for (uint16_t version : kDTLSVersions) {
if (!test_func(true, DTLS_method(), version)) {
fprintf(stderr, "Test failed at DTLS version %04x.\n", version);
Negotiate the cipher suite before ALPN. HTTP/2 places requirements on the cipher suite. So that servers can decline HTTP/2 when these requirements aren't met, defer ALPN negotiation. See also b/32553041. Change-Id: Idbcf049f9c8bda06a8be52a0154fe76e84607268 Reviewed-on: https://boringssl-review.googlesource.com/11982 Reviewed-by: Adam Langley <agl@google.com>
2016-10-31 22:01:13 +00:00
return false;
}
}
return true;
}
Keep a reference to |X509|s appended to a chain. The recent CRYPTO_BUFFER changes meant that |X509| objects passed to SSL_CTX_add_extra_chain_cert would be |free|ed immediately. However, some third-party code (at least serf and curl) continue to use the |X509| even after handing over ownership. In order to unblock things, keep the past |X509| around for a while to paper over the issues with those libraries while we try and upstream changes. Change-Id: I832b458af9b265749fed964658c5c34c84d518df Reviewed-on: https://boringssl-review.googlesource.com/13480 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-01-31 23:24:31 +00:00
TEST(SSLTest, AddChainCertHack) {
// Ensure that we don't accidently break the hack that we have in place to
// keep curl and serf happy when they use an |X509| even after transfering
// ownership.
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(ctx);
X509 *cert = GetTestCertificate().release();
ASSERT_TRUE(cert);
SSL_CTX_add0_chain_cert(ctx.get(), cert);
// This should not trigger a use-after-free.
X509_cmp(cert, cert);
}
Add a basic SSL_get_certificate test. With the CRYPTO_BUFFER stuff, this API is now slightly more complex. Add some tests as a sanity-check. Change-Id: I9da20e3eb6391fc86ed215c5fabec71aa32ef56f Reviewed-on: https://boringssl-review.googlesource.com/13620 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-03 22:06:18 +00:00
TEST(SSLTest, GetCertificate) {
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(ctx);
bssl::UniquePtr<X509> cert = GetTestCertificate();
ASSERT_TRUE(cert);
ASSERT_TRUE(SSL_CTX_use_certificate(ctx.get(), cert.get()));
bssl::UniquePtr<SSL> ssl(SSL_new(ctx.get()));
ASSERT_TRUE(ssl);
X509 *cert2 = SSL_CTX_get0_certificate(ctx.get());
ASSERT_TRUE(cert2);
X509 *cert3 = SSL_get_certificate(ssl.get());
ASSERT_TRUE(cert3);
// The old and new certificates must be identical.
EXPECT_EQ(0, X509_cmp(cert.get(), cert2));
EXPECT_EQ(0, X509_cmp(cert.get(), cert3));
uint8_t *der = nullptr;
long der_len = i2d_X509(cert.get(), &der);
ASSERT_LT(0, der_len);
bssl::UniquePtr<uint8_t> free_der(der);
uint8_t *der2 = nullptr;
long der2_len = i2d_X509(cert2, &der2);
ASSERT_LT(0, der2_len);
bssl::UniquePtr<uint8_t> free_der2(der2);
uint8_t *der3 = nullptr;
long der3_len = i2d_X509(cert3, &der3);
ASSERT_LT(0, der3_len);
bssl::UniquePtr<uint8_t> free_der3(der3);
// They must also encode identically.
Add a helper for comparing byte strings. We compare pointer/length pairs constantly. To avoid needing to type it everywhere and get GTest's output, add a StringPiece-alike for byte slices which supports ==, !=, and std::ostream. BUG=129 Change-Id: I108342cbd2c6a58fec0b9cb87ebdf50364bda099 Reviewed-on: https://boringssl-review.googlesource.com/13625 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-04 16:48:59 +00:00
EXPECT_EQ(Bytes(der, der_len), Bytes(der2, der2_len));
EXPECT_EQ(Bytes(der, der_len), Bytes(der3, der3_len));
Add a basic SSL_get_certificate test. With the CRYPTO_BUFFER stuff, this API is now slightly more complex. Add some tests as a sanity-check. Change-Id: I9da20e3eb6391fc86ed215c5fabec71aa32ef56f Reviewed-on: https://boringssl-review.googlesource.com/13620 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-03 22:06:18 +00:00
}
Add |SSL[_CTX]_set_chain_and_key|. This allows a caller to configure a serving chain without dealing with crypto/x509. Change-Id: Ib42bb2ab9227d32071cf13ab07f92d029643a9a6 Reviewed-on: https://boringssl-review.googlesource.com/14126 Commit-Queue: Adam Langley <alangley@gmail.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-28 19:26:51 +00:00
TEST(SSLTest, SetChainAndKeyMismatch) {
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_with_buffers_method()));
ASSERT_TRUE(ctx);
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
ASSERT_TRUE(key);
bssl::UniquePtr<CRYPTO_BUFFER> leaf = GetChainTestCertificateBuffer();
ASSERT_TRUE(leaf);
std::vector<CRYPTO_BUFFER*> chain = {
leaf.get(),
};
// Should fail because |GetTestKey| doesn't match the chain-test certificate.
ASSERT_FALSE(SSL_CTX_set_chain_and_key(ctx.get(), &chain[0], chain.size(),
key.get(), nullptr));
ERR_clear_error();
}
TEST(SSLTest, SetChainAndKey) {
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(TLS_with_buffers_method()));
ASSERT_TRUE(client_ctx);
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(TLS_with_buffers_method()));
ASSERT_TRUE(server_ctx);
bssl::UniquePtr<EVP_PKEY> key = GetChainTestKey();
ASSERT_TRUE(key);
bssl::UniquePtr<CRYPTO_BUFFER> leaf = GetChainTestCertificateBuffer();
ASSERT_TRUE(leaf);
bssl::UniquePtr<CRYPTO_BUFFER> intermediate =
GetChainTestIntermediateBuffer();
ASSERT_TRUE(intermediate);
std::vector<CRYPTO_BUFFER*> chain = {
leaf.get(), intermediate.get(),
};
ASSERT_TRUE(SSL_CTX_set_chain_and_key(server_ctx.get(), &chain[0],
chain.size(), key.get(), nullptr));
SSL_CTX_i_promise_to_verify_certs_after_the_handshake(client_ctx.get());
bssl::UniquePtr<SSL> client, server;
ASSERT_TRUE(ConnectClientAndServer(&client, &server, client_ctx.get(),
server_ctx.get(),
nullptr /* no session */));
}
Fix configuring the empty cipher list. Although it returns failure, the cipher list should still be updated. Conscrypt relies on this behavior to support a Java API edge case. Change-Id: If58efafc6a4a81e85a0e2ee2c38873a7a4938123 Reviewed-on: https://boringssl-review.googlesource.com/14165 Reviewed-by: Kenny Root <kroot@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-10 01:10:56 +00:00
// Configuring the empty cipher list, though an error, should still modify the
// configuration.
TEST(SSLTest, EmptyCipherList) {
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(ctx);
// Initially, the cipher list is not empty.
EXPECT_NE(0u, sk_SSL_CIPHER_num(SSL_CTX_get_ciphers(ctx.get())));
// Configuring the empty cipher list fails.
EXPECT_FALSE(SSL_CTX_set_cipher_list(ctx.get(), ""));
ERR_clear_error();
// But the cipher list is still updated to empty.
EXPECT_EQ(0u, sk_SSL_CIPHER_num(SSL_CTX_get_ciphers(ctx.get())));
}
Support asynchronous ticket decryption with TLS 1.0–1.2. This change adds support for setting an |SSL_TICKET_AEAD_METHOD| which allows a caller to control ticket encryption and decryption to a greater extent than previously possible and also permits asynchronous ticket decryption. This change only includes partial support: TLS 1.3 work remains to be done. Change-Id: Ia2e10ebb3257e1a119630c463b6bf389cf20ef18 Reviewed-on: https://boringssl-review.googlesource.com/14144 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-09 03:33:21 +00:00
// ssl_test_ticket_aead_failure_mode enumerates the possible ways in which the
// test |SSL_TICKET_AEAD_METHOD| can fail.
enum ssl_test_ticket_aead_failure_mode {
ssl_test_ticket_aead_ok = 0,
ssl_test_ticket_aead_seal_fail,
ssl_test_ticket_aead_open_soft_fail,
ssl_test_ticket_aead_open_hard_fail,
};
struct ssl_test_ticket_aead_state {
unsigned retry_count;
ssl_test_ticket_aead_failure_mode failure_mode;
};
static int ssl_test_ticket_aead_ex_index_dup(CRYPTO_EX_DATA *to,
const CRYPTO_EX_DATA *from,
void **from_d, int index,
long argl, void *argp) {
abort();
}
static void ssl_test_ticket_aead_ex_index_free(void *parent, void *ptr,
CRYPTO_EX_DATA *ad, int index,
long argl, void *argp) {
auto state = reinterpret_cast<ssl_test_ticket_aead_state*>(ptr);
if (state == nullptr) {
return;
}
OPENSSL_free(state);
}
static CRYPTO_once_t g_ssl_test_ticket_aead_ex_index_once = CRYPTO_ONCE_INIT;
static int g_ssl_test_ticket_aead_ex_index;
static int ssl_test_ticket_aead_get_ex_index() {
CRYPTO_once(&g_ssl_test_ticket_aead_ex_index_once, [] {
g_ssl_test_ticket_aead_ex_index = SSL_get_ex_new_index(
0, nullptr, nullptr, ssl_test_ticket_aead_ex_index_dup,
ssl_test_ticket_aead_ex_index_free);
});
return g_ssl_test_ticket_aead_ex_index;
}
static size_t ssl_test_ticket_aead_max_overhead(SSL *ssl) {
return 1;
}
static int ssl_test_ticket_aead_seal(SSL *ssl, uint8_t *out, size_t *out_len,
size_t max_out_len, const uint8_t *in,
size_t in_len) {
auto state = reinterpret_cast<ssl_test_ticket_aead_state *>(
SSL_get_ex_data(ssl, ssl_test_ticket_aead_get_ex_index()));
if (state->failure_mode == ssl_test_ticket_aead_seal_fail ||
max_out_len < in_len + 1) {
return 0;
}
OPENSSL_memmove(out, in, in_len);
out[in_len] = 0xff;
*out_len = in_len + 1;
return 1;
}
static ssl_ticket_aead_result_t ssl_test_ticket_aead_open(
SSL *ssl, uint8_t *out, size_t *out_len, size_t max_out_len,
const uint8_t *in, size_t in_len) {
auto state = reinterpret_cast<ssl_test_ticket_aead_state *>(
SSL_get_ex_data(ssl, ssl_test_ticket_aead_get_ex_index()));
if (state->retry_count > 0) {
state->retry_count--;
return ssl_ticket_aead_retry;
}
switch (state->failure_mode) {
case ssl_test_ticket_aead_ok:
break;
case ssl_test_ticket_aead_seal_fail:
// If |seal| failed then there shouldn't be any ticket to try and
// decrypt.
abort();
break;
case ssl_test_ticket_aead_open_soft_fail:
return ssl_ticket_aead_ignore_ticket;
case ssl_test_ticket_aead_open_hard_fail:
return ssl_ticket_aead_error;
}
if (in_len == 0 || in[in_len - 1] != 0xff) {
return ssl_ticket_aead_ignore_ticket;
}
if (max_out_len < in_len - 1) {
return ssl_ticket_aead_error;
}
OPENSSL_memmove(out, in, in_len - 1);
*out_len = in_len - 1;
return ssl_ticket_aead_success;
}
static const SSL_TICKET_AEAD_METHOD kSSLTestTicketMethod = {
ssl_test_ticket_aead_max_overhead,
ssl_test_ticket_aead_seal,
ssl_test_ticket_aead_open,
};
static void ConnectClientAndServerWithTicketMethod(
bssl::UniquePtr<SSL> *out_client, bssl::UniquePtr<SSL> *out_server,
SSL_CTX *client_ctx, SSL_CTX *server_ctx, unsigned retry_count,
ssl_test_ticket_aead_failure_mode failure_mode, SSL_SESSION *session) {
bssl::UniquePtr<SSL> client(SSL_new(client_ctx)), server(SSL_new(server_ctx));
ASSERT_TRUE(client);
ASSERT_TRUE(server);
SSL_set_connect_state(client.get());
SSL_set_accept_state(server.get());
auto state = reinterpret_cast<ssl_test_ticket_aead_state *>(
OPENSSL_malloc(sizeof(ssl_test_ticket_aead_state)));
ASSERT_TRUE(state);
OPENSSL_memset(state, 0, sizeof(ssl_test_ticket_aead_state));
state->retry_count = retry_count;
state->failure_mode = failure_mode;
ASSERT_TRUE(SSL_set_ex_data(server.get(), ssl_test_ticket_aead_get_ex_index(),
state));
SSL_set_session(client.get(), session);
BIO *bio1, *bio2;
ASSERT_TRUE(BIO_new_bio_pair(&bio1, 0, &bio2, 0));
// SSL_set_bio takes ownership.
SSL_set_bio(client.get(), bio1, bio1);
SSL_set_bio(server.get(), bio2, bio2);
if (CompleteHandshakes(client.get(), server.get())) {
*out_client = std::move(client);
*out_server = std::move(server);
} else {
out_client->reset();
out_server->reset();
}
}
class TicketAEADMethodTest
: public ::testing::TestWithParam<testing::tuple<
uint16_t, unsigned, ssl_test_ticket_aead_failure_mode>> {};
TEST_P(TicketAEADMethodTest, Resume) {
bssl::UniquePtr<X509> cert = GetTestCertificate();
ASSERT_TRUE(cert);
bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
ASSERT_TRUE(key);
bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(server_ctx);
bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(client_ctx);
const uint16_t version = testing::get<0>(GetParam());
const unsigned retry_count = testing::get<1>(GetParam());
const ssl_test_ticket_aead_failure_mode failure_mode =
testing::get<2>(GetParam());
ASSERT_TRUE(SSL_CTX_use_certificate(server_ctx.get(), cert.get()));
ASSERT_TRUE(SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()));
ASSERT_TRUE(SSL_CTX_set_min_proto_version(client_ctx.get(), version));
ASSERT_TRUE(SSL_CTX_set_max_proto_version(client_ctx.get(), version));
ASSERT_TRUE(SSL_CTX_set_min_proto_version(server_ctx.get(), version));
ASSERT_TRUE(SSL_CTX_set_max_proto_version(server_ctx.get(), version));
SSL_CTX_set_session_cache_mode(client_ctx.get(), SSL_SESS_CACHE_BOTH);
SSL_CTX_set_session_cache_mode(server_ctx.get(), SSL_SESS_CACHE_BOTH);
SSL_CTX_set_current_time_cb(client_ctx.get(), FrozenTimeCallback);
SSL_CTX_set_current_time_cb(server_ctx.get(), FrozenTimeCallback);
Support asynchronous ticket decryption with TLS 1.3. This shuffles a bit of the code around session resumption in TLS 1.3 to make the async point cleaner to inject. It also fills in cipher and tlsext_hostname more uniformly. Filling in the cipher on resumption is a no-op as SSL_SESSION_dup already copies it, but avoids confusion should we ever implement TLS 1.3's laxer cipher matching on the server. Not filling in tlsext_hostname on resumption was an oversight; the relevant check isn't whether we are resuming but whether we have a fresh SSL_SESSION to fill things into. Change-Id: Ic02eb079ff228ce4a4d3e0de7445e18cd367e8b2 Reviewed-on: https://boringssl-review.googlesource.com/14205 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-10 22:47:18 +00:00
SSL_CTX_sess_set_new_cb(client_ctx.get(), SaveLastSession);
Support asynchronous ticket decryption with TLS 1.0–1.2. This change adds support for setting an |SSL_TICKET_AEAD_METHOD| which allows a caller to control ticket encryption and decryption to a greater extent than previously possible and also permits asynchronous ticket decryption. This change only includes partial support: TLS 1.3 work remains to be done. Change-Id: Ia2e10ebb3257e1a119630c463b6bf389cf20ef18 Reviewed-on: https://boringssl-review.googlesource.com/14144 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-09 03:33:21 +00:00
SSL_CTX_set_ticket_aead_method(server_ctx.get(), &kSSLTestTicketMethod);
bssl::UniquePtr<SSL> client, server;
ConnectClientAndServerWithTicketMethod(&client, &server, client_ctx.get(),
server_ctx.get(), retry_count,
failure_mode, nullptr);
switch (failure_mode) {
case ssl_test_ticket_aead_ok:
case ssl_test_ticket_aead_open_hard_fail:
case ssl_test_ticket_aead_open_soft_fail:
ASSERT_TRUE(client);
break;
case ssl_test_ticket_aead_seal_fail:
EXPECT_FALSE(client);
return;
}
EXPECT_FALSE(SSL_session_reused(client.get()));
EXPECT_FALSE(SSL_session_reused(server.get()));
Support asynchronous ticket decryption with TLS 1.3. This shuffles a bit of the code around session resumption in TLS 1.3 to make the async point cleaner to inject. It also fills in cipher and tlsext_hostname more uniformly. Filling in the cipher on resumption is a no-op as SSL_SESSION_dup already copies it, but avoids confusion should we ever implement TLS 1.3's laxer cipher matching on the server. Not filling in tlsext_hostname on resumption was an oversight; the relevant check isn't whether we are resuming but whether we have a fresh SSL_SESSION to fill things into. Change-Id: Ic02eb079ff228ce4a4d3e0de7445e18cd367e8b2 Reviewed-on: https://boringssl-review.googlesource.com/14205 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-10 22:47:18 +00:00
// Run the read loop to account for post-handshake tickets in TLS 1.3.
SSL_read(client.get(), nullptr, 0);
bssl::UniquePtr<SSL_SESSION> session = std::move(g_last_session);
Support asynchronous ticket decryption with TLS 1.0–1.2. This change adds support for setting an |SSL_TICKET_AEAD_METHOD| which allows a caller to control ticket encryption and decryption to a greater extent than previously possible and also permits asynchronous ticket decryption. This change only includes partial support: TLS 1.3 work remains to be done. Change-Id: Ia2e10ebb3257e1a119630c463b6bf389cf20ef18 Reviewed-on: https://boringssl-review.googlesource.com/14144 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-09 03:33:21 +00:00
ConnectClientAndServerWithTicketMethod(&client, &server, client_ctx.get(),
server_ctx.get(), retry_count,
Support asynchronous ticket decryption with TLS 1.3. This shuffles a bit of the code around session resumption in TLS 1.3 to make the async point cleaner to inject. It also fills in cipher and tlsext_hostname more uniformly. Filling in the cipher on resumption is a no-op as SSL_SESSION_dup already copies it, but avoids confusion should we ever implement TLS 1.3's laxer cipher matching on the server. Not filling in tlsext_hostname on resumption was an oversight; the relevant check isn't whether we are resuming but whether we have a fresh SSL_SESSION to fill things into. Change-Id: Ic02eb079ff228ce4a4d3e0de7445e18cd367e8b2 Reviewed-on: https://boringssl-review.googlesource.com/14205 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-10 22:47:18 +00:00
failure_mode, session.get());
Support asynchronous ticket decryption with TLS 1.0–1.2. This change adds support for setting an |SSL_TICKET_AEAD_METHOD| which allows a caller to control ticket encryption and decryption to a greater extent than previously possible and also permits asynchronous ticket decryption. This change only includes partial support: TLS 1.3 work remains to be done. Change-Id: Ia2e10ebb3257e1a119630c463b6bf389cf20ef18 Reviewed-on: https://boringssl-review.googlesource.com/14144 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-09 03:33:21 +00:00
switch (failure_mode) {
case ssl_test_ticket_aead_ok:
ASSERT_TRUE(client);
EXPECT_TRUE(SSL_session_reused(client.get()));
EXPECT_TRUE(SSL_session_reused(server.get()));
break;
case ssl_test_ticket_aead_seal_fail:
abort();
break;
case ssl_test_ticket_aead_open_hard_fail:
EXPECT_FALSE(client);
break;
case ssl_test_ticket_aead_open_soft_fail:
ASSERT_TRUE(client);
EXPECT_FALSE(SSL_session_reused(client.get()));
EXPECT_FALSE(SSL_session_reused(server.get()));
}
}
INSTANTIATE_TEST_CASE_P(
TicketAEADMethodTests, TicketAEADMethodTest,
testing::Combine(
Support asynchronous ticket decryption with TLS 1.3. This shuffles a bit of the code around session resumption in TLS 1.3 to make the async point cleaner to inject. It also fills in cipher and tlsext_hostname more uniformly. Filling in the cipher on resumption is a no-op as SSL_SESSION_dup already copies it, but avoids confusion should we ever implement TLS 1.3's laxer cipher matching on the server. Not filling in tlsext_hostname on resumption was an oversight; the relevant check isn't whether we are resuming but whether we have a fresh SSL_SESSION to fill things into. Change-Id: Ic02eb079ff228ce4a4d3e0de7445e18cd367e8b2 Reviewed-on: https://boringssl-review.googlesource.com/14205 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-10 22:47:18 +00:00
testing::Values(TLS1_2_VERSION, TLS1_3_VERSION),
Support asynchronous ticket decryption with TLS 1.0–1.2. This change adds support for setting an |SSL_TICKET_AEAD_METHOD| which allows a caller to control ticket encryption and decryption to a greater extent than previously possible and also permits asynchronous ticket decryption. This change only includes partial support: TLS 1.3 work remains to be done. Change-Id: Ia2e10ebb3257e1a119630c463b6bf389cf20ef18 Reviewed-on: https://boringssl-review.googlesource.com/14144 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-09 03:33:21 +00:00
testing::Values(0, 1, 2),
testing::Values(ssl_test_ticket_aead_ok,
ssl_test_ticket_aead_seal_fail,
ssl_test_ticket_aead_open_soft_fail,
ssl_test_ticket_aead_open_hard_fail)));
Disable SSLv3 by default. As a precursor to removing the code entirely later, disable the protocol by default. Callers must use SSL_CTX_set_min_version to enable it. This change also makes SSLv3_method *not* enable SSL 3.0. Normally version-specific methods set the minimum and maximum version to their version. SSLv3_method leaves the minimum at the default, so we will treat it as all versions disabled. To help debugging, the error code is switched from WRONG_SSL_VERSION to a new NO_SUPPORTED_VERSIONS_ENABLED. This also defines OPENSSL_NO_SSL3 and OPENSSL_NO_SSL3_METHOD to kick in any no-ssl3 build paths in consumers which should provide a convenient hook for any upstreaming changes that may be needed. (OPENSSL_NO_SSL3 existed in older versions of OpenSSL, so in principle one may encounter an OpenSSL with the same settings.) Change-Id: I96a8f2f568eb77b2537b3a774b2f7108bd67dd0c Reviewed-on: https://boringssl-review.googlesource.com/14031 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-01 21:48:38 +00:00
TEST(SSLTest, SSL3Method) {
bssl::UniquePtr<X509> cert = GetTestCertificate();
ASSERT_TRUE(cert);
// For compatibility, SSLv3_method should work up to SSL_CTX_new and SSL_new.
bssl::UniquePtr<SSL_CTX> ssl3_ctx(SSL_CTX_new(SSLv3_method()));
ASSERT_TRUE(ssl3_ctx);
ASSERT_TRUE(SSL_CTX_use_certificate(ssl3_ctx.get(), cert.get()));
bssl::UniquePtr<SSL> ssl(SSL_new(ssl3_ctx.get()));
EXPECT_TRUE(ssl);
// Create a normal TLS context to test against.
bssl::UniquePtr<SSL_CTX> tls_ctx(SSL_CTX_new(TLS_method()));
ASSERT_TRUE(tls_ctx);
ASSERT_TRUE(SSL_CTX_use_certificate(tls_ctx.get(), cert.get()));
// However, handshaking an SSLv3_method server should fail to resolve the
// version range. Explicit calls to SSL_CTX_set_min_proto_version are the only
// way to enable SSL 3.0.
bssl::UniquePtr<SSL> client, server;
EXPECT_FALSE(ConnectClientAndServer(&client, &server, tls_ctx.get(),
ssl3_ctx.get(),
nullptr /* no session */));
uint32_t err = ERR_get_error();
EXPECT_EQ(ERR_LIB_SSL, ERR_GET_LIB(err));
EXPECT_EQ(SSL_R_NO_SUPPORTED_VERSIONS_ENABLED, ERR_GET_REASON(err));
// Likewise for SSLv3_method clients.
EXPECT_FALSE(ConnectClientAndServer(&client, &server, ssl3_ctx.get(),
tls_ctx.get(),
nullptr /* no session */));
err = ERR_get_error();
EXPECT_EQ(ERR_LIB_SSL, ERR_GET_LIB(err));
EXPECT_EQ(SSL_R_NO_SUPPORTED_VERSIONS_ENABLED, ERR_GET_REASON(err));
}
Do a cursory conversion of a few tests to GTest. For now, this is the laziest conversion possible. The intent is to just get the build setup ready so that we can get everything working in our consumers. The intended end state is: - The standalone build produces three test targets, one per library: {crypto,ssl,decrepit}_tests. - Each FOO_test is made up of: FOO/**/*_test.cc crypto/test/gtest_main.cc test_support - generate_build_files.py emits variables crypto_test_sources and ssl_test_sources. These variables are populated with FindCFiles, looking for *_test.cc. - The consuming file assembles those variables into the two test targets (plus decrepit) from there. This avoids having generate_build_files.py emit actual build rules. - Our standalone builders, Chromium, and Android just run the top-level test targets using whatever GTest-based reporting story they have. In transition, we start by converting one of two tests in each library to populate the three test targets. Those are added to all_tests.json and all_tests.go hacked to handle them transparently. This keeps our standalone builder working. generate_build_files.py, to start with, populates the new source lists manually and subtracts them out of the old machinery. We emit both for the time being. When this change rolls in, we'll write all the build glue needed to build the GTest-based tests and add it to consumers' continuous builders. Next, we'll subsume a file-based test and get the consumers working with that. (I.e. make sure the GTest targets can depend on a data file.) Once that's all done, we'll be sure all this will work. At that point, we start subsuming the remaining tests into the GTest targets and, asynchronously, rewriting tests to use GTest properly rather than cursory conversion here. When all non-GTest tests are gone, the old generate_build_files.py hooks will be removed, consumers updated to not depend on them, and standalone builders converted to not rely on all_tests.go, which can then be removed. (Unless bits end up being needed as a malloc test driver. I'm thinking we'll want to do something with --gtest_filter.) As part of this CL, I've bumped the CMake requirements (for target_include_directories) and added a few suppressions for warnings that GTest doesn't pass. BUG=129 Change-Id: I881b26b07a8739cc0b52dbb51a30956908e1b71a Reviewed-on: https://boringssl-review.googlesource.com/13232 Reviewed-by: Adam Langley <agl@google.com>
2017-01-20 00:05:47 +00:00
// TODO(davidben): Convert this file to GTest properly.
TEST(SSLTest, AllTests) {
Properly convert more of ssl_test. BUG=129 Change-Id: Ic7133d269be8a069734153efc36e9cfeb10c698e Reviewed-on: https://boringssl-review.googlesource.com/15466 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-23 17:14:28 +01:00
if (!TestSSL_SESSIONEncoding(kOpenSSLSession) ||
Revert "Move C++ helpers into |bssl| namespace." This reverts commit 09feb0f3d95a2bc58ce0faaf14256d3bd30f52a4. (In order to make WebRTC happy this also needs to be reverted.)
2016-07-12 16:09:33 +01:00
!TestSSL_SESSIONEncoding(kCustomSession) ||
!TestSSL_SESSIONEncoding(kBoringSSLSession) ||
!TestBadSSL_SESSIONEncoding(kBadSessionExtraField) ||
!TestBadSSL_SESSIONEncoding(kBadSessionVersion) ||
!TestBadSSL_SESSIONEncoding(kBadSessionTrailingData) ||
Always set min_version / max_version. Saves us some mess if they're never zero. This also fixes a bug in ssl3_get_max_client_version where it didn't account for all versions being disabled properly. Change-Id: I4c95ff57cf8953cb4a528263b252379f252f3e01 Reviewed-on: https://boringssl-review.googlesource.com/8512 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-21 03:20:47 +01:00
// TODO(svaldez): Update this when TLS 1.3 is enabled by default.
Disable SSLv3 by default. As a precursor to removing the code entirely later, disable the protocol by default. Callers must use SSL_CTX_set_min_version to enable it. This change also makes SSLv3_method *not* enable SSL 3.0. Normally version-specific methods set the minimum and maximum version to their version. SSLv3_method leaves the minimum at the default, so we will treat it as all versions disabled. To help debugging, the error code is switched from WRONG_SSL_VERSION to a new NO_SUPPORTED_VERSIONS_ENABLED. This also defines OPENSSL_NO_SSL3 and OPENSSL_NO_SSL3_METHOD to kick in any no-ssl3 build paths in consumers which should provide a convenient hook for any upstreaming changes that may be needed. (OPENSSL_NO_SSL3 existed in older versions of OpenSSL, so in principle one may encounter an OpenSSL with the same settings.) Change-Id: I96a8f2f568eb77b2537b3a774b2f7108bd67dd0c Reviewed-on: https://boringssl-review.googlesource.com/14031 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-01 21:48:38 +00:00
!TestDefaultVersion(TLS1_VERSION, TLS1_2_VERSION, &TLS_method) ||
Revert "Move C++ helpers into |bssl| namespace." This reverts commit 09feb0f3d95a2bc58ce0faaf14256d3bd30f52a4. (In order to make WebRTC happy this also needs to be reverted.)
2016-07-12 16:09:33 +01:00
!TestDefaultVersion(TLS1_VERSION, TLS1_VERSION, &TLSv1_method) ||
!TestDefaultVersion(TLS1_1_VERSION, TLS1_1_VERSION, &TLSv1_1_method) ||
!TestDefaultVersion(TLS1_2_VERSION, TLS1_2_VERSION, &TLSv1_2_method) ||
!TestDefaultVersion(TLS1_1_VERSION, TLS1_2_VERSION, &DTLS_method) ||
!TestDefaultVersion(TLS1_1_VERSION, TLS1_1_VERSION, &DTLSv1_method) ||
!TestDefaultVersion(TLS1_2_VERSION, TLS1_2_VERSION, &DTLSv1_2_method) ||
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
// Test the padding extension at TLS 1.2.
!TestPaddingExtension(TLS1_2_VERSION, TLS1_2_VERSION) ||
// Test the padding extension at TLS 1.3 with a TLS 1.2 session, so there
// will be no PSK binder after the padding extension.
!TestPaddingExtension(TLS1_3_VERSION, TLS1_2_VERSION) ||
// Test the padding extension at TLS 1.3 with a TLS 1.3 session, so there
// will be a PSK binder after the padding extension.
!TestPaddingExtension(TLS1_3_VERSION, TLS1_3_DRAFT_VERSION) ||
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
!ForEachVersion(TestSequenceNumber) ||
Run TestOneSidedShutdown at all versions. Change-Id: I3a5d949eec9241ea43da40ce23e0e7f2a25e30e5 Reviewed-on: https://boringssl-review.googlesource.com/12381 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-18 06:14:42 +00:00
!ForEachVersion(TestOneSidedShutdown) ||
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
!ForEachVersion(TestGetPeerCertificate) ||
!ForEachVersion(TestRetainOnlySHA256OfCerts) ||
Add a test for session ID context logic. We almost forgot to handle this in TLS 1.3, so add a test for it. Change-Id: I28600325d8fb6c09365e909db607cbace12ecac7 Reviewed-on: https://boringssl-review.googlesource.com/9093 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 00:09:41 +01:00
!TestClientHello() ||
Add a ForEachVersion function to ssl_test. This aligns with ec_test which has a ForEachCurve helper and avoids writing these loops all the time. As a bonus, these tests start working in DTLS now. Change-Id: I613fc08b641ddc12a819d8a1268a1e6a29043663 Reviewed-on: https://boringssl-review.googlesource.com/12380 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-18 06:11:10 +00:00
!ForEachVersion(TestSessionIDContext) ||
!ForEachVersion(TestSessionTimeout) ||
!ForEachVersion(TestSNICallback) ||
!ForEachVersion(TestVersion) ||
Fix SSL_clear's interaction with session resumption. Prior to 87eab4902d1003983079881d3ee8a66ec2eaccc2, due to some confusions between configuration and connection state, SSL_clear had the side effect of offering the previously established session on the new connection. wpa_supplicant relies on this behavior, so restore it for TLS 1.2 and below and add a test. (This behavior is largely incompatible with TLS 1.3's post-handshake tickets, so it won't work in 1.3. It'll act as if we configured an unresumable session instead.) Change-Id: Iaee8c0afc1cb65c0ab7397435602732b901b1c2d Reviewed-on: https://boringssl-review.googlesource.com/12632 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-07 20:57:14 +00:00
!ForEachVersion(TestALPNCipherAvailable) ||
Add tests for auto-chaining. Alas, wpa_supplicant relies on the auto-chaining feature, so we can't easily remove it. Write tests for it to ensure it stays working. These test currently do not work for TLS 1.3 because the feature is broken in 1.3. A follow-up change will fix this. BUG=70 Change-Id: I2c04f55b712d66f5af1556254a5b017ebc3244f7 Reviewed-on: https://boringssl-review.googlesource.com/12965 Reviewed-by: Adam Langley <agl@google.com>
2016-12-20 22:23:11 +00:00
!ForEachVersion(TestSSLClearSessionResumption) ||
Add tests around SSL_write's retry behavior. SSL_write is remarkably complicated. Change-Id: I1cb8d00af1b4c5e2d90187d5f87951f25e27f224 Reviewed-on: https://boringssl-review.googlesource.com/13050 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-01-02 04:56:36 +00:00
!ForEachVersion(TestAutoChain) ||
!ForEachVersion(TestSSLWriteRetry)) {
Do a cursory conversion of a few tests to GTest. For now, this is the laziest conversion possible. The intent is to just get the build setup ready so that we can get everything working in our consumers. The intended end state is: - The standalone build produces three test targets, one per library: {crypto,ssl,decrepit}_tests. - Each FOO_test is made up of: FOO/**/*_test.cc crypto/test/gtest_main.cc test_support - generate_build_files.py emits variables crypto_test_sources and ssl_test_sources. These variables are populated with FindCFiles, looking for *_test.cc. - The consuming file assembles those variables into the two test targets (plus decrepit) from there. This avoids having generate_build_files.py emit actual build rules. - Our standalone builders, Chromium, and Android just run the top-level test targets using whatever GTest-based reporting story they have. In transition, we start by converting one of two tests in each library to populate the three test targets. Those are added to all_tests.json and all_tests.go hacked to handle them transparently. This keeps our standalone builder working. generate_build_files.py, to start with, populates the new source lists manually and subtracts them out of the old machinery. We emit both for the time being. When this change rolls in, we'll write all the build glue needed to build the GTest-based tests and add it to consumers' continuous builders. Next, we'll subsume a file-based test and get the consumers working with that. (I.e. make sure the GTest targets can depend on a data file.) Once that's all done, we'll be sure all this will work. At that point, we start subsuming the remaining tests into the GTest targets and, asynchronously, rewriting tests to use GTest properly rather than cursory conversion here. When all non-GTest tests are gone, the old generate_build_files.py hooks will be removed, consumers updated to not depend on them, and standalone builders converted to not rely on all_tests.go, which can then be removed. (Unless bits end up being needed as a malloc test driver. I'm thinking we'll want to do something with --gtest_filter.) As part of this CL, I've bumped the CMake requirements (for target_include_directories) and added a few suppressions for warnings that GTest doesn't pass. BUG=129 Change-Id: I881b26b07a8739cc0b52dbb51a30956908e1b71a Reviewed-on: https://boringssl-review.googlesource.com/13232 Reviewed-by: Adam Langley <agl@google.com>
2017-01-20 00:05:47 +00:00
ADD_FAILURE() << "Tests failed";
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
}
Fix magic SSL reason codes. SSL reason codes corresponding to alerts have special values. Teach make_errors.go that values above 1000 are reserved (otherwise it will assign new values in that namespace). Also fix all the existing reason codes which corresponded to alerts. Change-Id: Ieabdf8fd59f4802938616934e1d84e659227cf84 Reviewed-on: https://boringssl-review.googlesource.com/1212 Reviewed-by: Adam Langley <agl@google.com>
2014-07-16 19:37:51 +01:00
}
Reference in New Issue Copy Permalink