diff --git a/ssl/test/runner/common.go b/ssl/test/runner/common.go index fd9fb3d5..be7d88ec 100644 --- a/ssl/test/runner/common.go +++ b/ssl/test/runner/common.go @@ -1389,9 +1389,13 @@ type ProtocolBugs struct { // and ServerHello messages to be omitted. OmitExtensions bool - // EmptyExtensions, if true, causese the extensions field in ClientHello + // EmptyExtensions, if true, causes the extensions field in ClientHello // and ServerHello messages to be present, but empty. EmptyExtensions bool + + // ExpectRecordSplitting, if true, causes application records to only be + // accepted if they follow a 1/n-1 record split. + ExpectRecordSplitting bool } func (c *Config) serverInit() { diff --git a/ssl/test/runner/conn.go b/ssl/test/runner/conn.go index c974bd43..047c3c5b 100644 --- a/ssl/test/runner/conn.go +++ b/ssl/test/runner/conn.go @@ -98,6 +98,7 @@ type Conn struct { pendingFragments [][]byte // pending outgoing handshake fragments. keyUpdateRequested bool + seenOneByteRecord bool tmp [16]byte } @@ -844,6 +845,13 @@ RestartReadRecord: } typ = encTyp } + + length := len(b.data[b.off:]) + if c.config.Bugs.ExpectRecordSplitting && typ == recordTypeApplicationData && length != 1 && !c.seenOneByteRecord { + return 0, nil, c.in.setErrorLocked(fmt.Errorf("tls: application data records were not split")) + } + + c.seenOneByteRecord = typ == recordTypeApplicationData && length == 1 return typ, b, nil } diff --git a/ssl/test/runner/fuzzer_mode.json b/ssl/test/runner/fuzzer_mode.json index 3957bea1..834be404 100644 --- a/ssl/test/runner/fuzzer_mode.json +++ b/ssl/test/runner/fuzzer_mode.json @@ -48,6 +48,8 @@ "*-EarlyData-Reject-Client": "Trial decryption does not work with the NULL cipher.", "*-EarlyData-RejectTicket-Client": "Trial decryption does not work with the NULL cipher.", - "Renegotiate-Client-BadExt*": "Fuzzer mode does not check renegotiation_info." + "Renegotiate-Client-BadExt*": "Fuzzer mode does not check renegotiation_info.", + + "CBCRecordSplitting*": "Fuzzer mode does not implement record-splitting." } } diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go index 29747db6..e526576d 100644 --- a/ssl/test/runner/runner.go +++ b/ssl/test/runner/runner.go @@ -3324,6 +3324,9 @@ func addCBCSplittingTests() { MaxVersion: VersionTLS10, MinVersion: VersionTLS10, CipherSuites: []uint16{t.cipher}, + Bugs: ProtocolBugs{ + ExpectRecordSplitting: true, + }, }, messageLen: -1, // read until EOF resumeSession: true, @@ -3339,6 +3342,9 @@ func addCBCSplittingTests() { MaxVersion: VersionTLS10, MinVersion: VersionTLS10, CipherSuites: []uint16{t.cipher}, + Bugs: ProtocolBugs{ + ExpectRecordSplitting: true, + }, }, messageLen: -1, // read until EOF flags: []string{