2016-03-17 22:14:30 +08:00
|
|
|
/*
|
|
|
|
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
|
|
|
|
*
|
2016-05-18 02:20:24 +08:00
|
|
|
* Licensed under the OpenSSL license (the "License"). You may not use
|
|
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
|
|
* in the file LICENSE in the source distribution or at
|
2016-03-17 22:14:30 +08:00
|
|
|
* https://www.openssl.org/source/license.html
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <string.h>
|
|
|
|
|
|
|
|
#include <openssl/bio.h>
|
2016-04-08 01:07:50 +08:00
|
|
|
#include <openssl/x509_vfy.h>
|
2016-03-17 22:14:30 +08:00
|
|
|
#include <openssl/ssl.h>
|
|
|
|
|
|
|
|
#include "handshake_helper.h"
|
2016-08-09 23:03:23 +08:00
|
|
|
#include "testutil.h"
|
2016-03-17 22:14:30 +08:00
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
HANDSHAKE_RESULT *HANDSHAKE_RESULT_new()
|
|
|
|
{
|
2016-08-09 23:03:23 +08:00
|
|
|
HANDSHAKE_RESULT *ret = OPENSSL_zalloc(sizeof(*ret));
|
|
|
|
TEST_check(ret != NULL);
|
2016-07-05 02:16:14 +08:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
void HANDSHAKE_RESULT_free(HANDSHAKE_RESULT *result)
|
|
|
|
{
|
2016-08-09 23:08:59 +08:00
|
|
|
if (result == NULL)
|
|
|
|
return;
|
2016-07-05 02:16:14 +08:00
|
|
|
OPENSSL_free(result->client_npn_negotiated);
|
|
|
|
OPENSSL_free(result->server_npn_negotiated);
|
|
|
|
OPENSSL_free(result->client_alpn_negotiated);
|
|
|
|
OPENSSL_free(result->server_alpn_negotiated);
|
|
|
|
OPENSSL_free(result);
|
|
|
|
}
|
|
|
|
|
2016-03-17 22:14:30 +08:00
|
|
|
/*
|
|
|
|
* Since there appears to be no way to extract the sent/received alert
|
|
|
|
* from the SSL object directly, we use the info callback and stash
|
|
|
|
* the result in ex_data.
|
|
|
|
*/
|
2016-08-12 02:51:57 +08:00
|
|
|
typedef struct handshake_ex_data_st {
|
2016-03-17 22:14:30 +08:00
|
|
|
int alert_sent;
|
2016-08-12 20:29:24 +08:00
|
|
|
int num_fatal_alerts_sent;
|
2016-03-17 22:14:30 +08:00
|
|
|
int alert_received;
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
int session_ticket_do_not_call;
|
2016-06-20 23:20:25 +08:00
|
|
|
ssl_servername_t servername;
|
2016-03-17 22:14:30 +08:00
|
|
|
} HANDSHAKE_EX_DATA;
|
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
typedef struct ctx_data_st {
|
2016-07-05 02:16:14 +08:00
|
|
|
unsigned char *npn_protocols;
|
|
|
|
size_t npn_protocols_len;
|
|
|
|
unsigned char *alpn_protocols;
|
|
|
|
size_t alpn_protocols_len;
|
|
|
|
} CTX_DATA;
|
|
|
|
|
|
|
|
/* |ctx_data| itself is stack-allocated. */
|
|
|
|
static void ctx_data_free_data(CTX_DATA *ctx_data)
|
|
|
|
{
|
|
|
|
OPENSSL_free(ctx_data->npn_protocols);
|
|
|
|
ctx_data->npn_protocols = NULL;
|
|
|
|
OPENSSL_free(ctx_data->alpn_protocols);
|
|
|
|
ctx_data->alpn_protocols = NULL;
|
|
|
|
}
|
|
|
|
|
2016-03-17 22:14:30 +08:00
|
|
|
static int ex_data_idx;
|
|
|
|
|
2016-06-14 06:44:29 +08:00
|
|
|
static void info_cb(const SSL *s, int where, int ret)
|
2016-03-17 22:14:30 +08:00
|
|
|
{
|
|
|
|
if (where & SSL_CB_ALERT) {
|
|
|
|
HANDSHAKE_EX_DATA *ex_data =
|
|
|
|
(HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));
|
|
|
|
if (where & SSL_CB_WRITE) {
|
|
|
|
ex_data->alert_sent = ret;
|
2016-08-12 20:29:24 +08:00
|
|
|
if (strcmp(SSL_alert_type_string(ret), "F") == 0
|
|
|
|
|| strcmp(SSL_alert_desc_string(ret), "CN") == 0)
|
|
|
|
ex_data->num_fatal_alerts_sent++;
|
2016-03-17 22:14:30 +08:00
|
|
|
} else {
|
|
|
|
ex_data->alert_received = ret;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
/* Select the appropriate server CTX.
|
2016-06-20 23:20:25 +08:00
|
|
|
* Returns SSL_TLSEXT_ERR_OK if a match was found.
|
|
|
|
* If |ignore| is 1, returns SSL_TLSEXT_ERR_NOACK on mismatch.
|
|
|
|
* Otherwise, returns SSL_TLSEXT_ERR_ALERT_FATAL on mismatch.
|
|
|
|
* An empty SNI extension also returns SSL_TSLEXT_ERR_NOACK.
|
|
|
|
*/
|
|
|
|
static int select_server_ctx(SSL *s, void *arg, int ignore)
|
2016-06-10 06:39:22 +08:00
|
|
|
{
|
|
|
|
const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
|
2016-06-20 23:20:25 +08:00
|
|
|
HANDSHAKE_EX_DATA *ex_data =
|
|
|
|
(HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));
|
|
|
|
|
|
|
|
if (servername == NULL) {
|
|
|
|
ex_data->servername = SSL_TEST_SERVERNAME_SERVER1;
|
|
|
|
return SSL_TLSEXT_ERR_NOACK;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (strcmp(servername, "server2") == 0) {
|
2016-06-10 06:39:22 +08:00
|
|
|
SSL_CTX *new_ctx = (SSL_CTX*)arg;
|
|
|
|
SSL_set_SSL_CTX(s, new_ctx);
|
|
|
|
/*
|
|
|
|
* Copy over all the SSL_CTX options - reasonable behavior
|
|
|
|
* allows testing of cases where the options between two
|
|
|
|
* contexts differ/conflict
|
|
|
|
*/
|
|
|
|
SSL_clear_options(s, 0xFFFFFFFFL);
|
|
|
|
SSL_set_options(s, SSL_CTX_get_options(new_ctx));
|
2016-06-20 23:20:25 +08:00
|
|
|
|
|
|
|
ex_data->servername = SSL_TEST_SERVERNAME_SERVER2;
|
|
|
|
return SSL_TLSEXT_ERR_OK;
|
|
|
|
} else if (strcmp(servername, "server1") == 0) {
|
|
|
|
ex_data->servername = SSL_TEST_SERVERNAME_SERVER1;
|
|
|
|
return SSL_TLSEXT_ERR_OK;
|
|
|
|
} else if (ignore) {
|
|
|
|
ex_data->servername = SSL_TEST_SERVERNAME_SERVER1;
|
|
|
|
return SSL_TLSEXT_ERR_NOACK;
|
|
|
|
} else {
|
|
|
|
/* Don't set an explicit alert, to test library defaults. */
|
|
|
|
return SSL_TLSEXT_ERR_ALERT_FATAL;
|
2016-06-10 06:39:22 +08:00
|
|
|
}
|
2016-06-20 23:20:25 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* (RFC 6066):
|
|
|
|
* If the server understood the ClientHello extension but
|
|
|
|
* does not recognize the server name, the server SHOULD take one of two
|
|
|
|
* actions: either abort the handshake by sending a fatal-level
|
|
|
|
* unrecognized_name(112) alert or continue the handshake.
|
|
|
|
*
|
|
|
|
* This behaviour is up to the application to configure; we test both
|
|
|
|
* configurations to ensure the state machine propagates the result
|
|
|
|
* correctly.
|
|
|
|
*/
|
|
|
|
static int servername_ignore_cb(SSL *s, int *ad, void *arg)
|
|
|
|
{
|
|
|
|
return select_server_ctx(s, arg, 1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int servername_reject_cb(SSL *s, int *ad, void *arg)
|
|
|
|
{
|
|
|
|
return select_server_ctx(s, arg, 0);
|
2016-06-10 06:39:22 +08:00
|
|
|
}
|
|
|
|
|
2016-08-30 21:20:18 +08:00
|
|
|
static unsigned char dummy_ocsp_resp_good_val = 0xff;
|
|
|
|
static unsigned char dummy_ocsp_resp_bad_val = 0xfe;
|
|
|
|
|
|
|
|
static int server_ocsp_cb(SSL *s, void *arg)
|
|
|
|
{
|
|
|
|
unsigned char *resp;
|
|
|
|
|
|
|
|
resp = OPENSSL_malloc(1);
|
|
|
|
if (resp == NULL)
|
|
|
|
return SSL_TLSEXT_ERR_ALERT_FATAL;
|
|
|
|
/*
|
|
|
|
* For the purposes of testing we just send back a dummy OCSP response
|
|
|
|
*/
|
|
|
|
*resp = *(unsigned char *)arg;
|
|
|
|
if (!SSL_set_tlsext_status_ocsp_resp(s, resp, 1))
|
|
|
|
return SSL_TLSEXT_ERR_ALERT_FATAL;
|
|
|
|
|
|
|
|
return SSL_TLSEXT_ERR_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int client_ocsp_cb(SSL *s, void *arg)
|
|
|
|
{
|
|
|
|
const unsigned char *resp;
|
|
|
|
int len;
|
|
|
|
|
|
|
|
len = SSL_get_tlsext_status_ocsp_resp(s, &resp);
|
|
|
|
if (len != 1 || *resp != dummy_ocsp_resp_good_val)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-06-14 06:44:29 +08:00
|
|
|
static int verify_reject_cb(X509_STORE_CTX *ctx, void *arg) {
|
2016-04-08 01:07:50 +08:00
|
|
|
X509_STORE_CTX_set_error(ctx, X509_V_ERR_APPLICATION_VERIFICATION);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-06-14 06:44:29 +08:00
|
|
|
static int verify_accept_cb(X509_STORE_CTX *ctx, void *arg) {
|
2016-04-08 01:07:50 +08:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
static int broken_session_ticket_cb(SSL *s, unsigned char *key_name, unsigned char *iv,
|
2016-06-14 06:44:29 +08:00
|
|
|
EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc)
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
static int do_not_call_session_ticket_cb(SSL *s, unsigned char *key_name,
|
2016-06-14 06:44:29 +08:00
|
|
|
unsigned char *iv,
|
|
|
|
EVP_CIPHER_CTX *ctx,
|
|
|
|
HMAC_CTX *hctx, int enc)
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
{
|
|
|
|
HANDSHAKE_EX_DATA *ex_data =
|
|
|
|
(HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));
|
|
|
|
ex_data->session_ticket_do_not_call = 1;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
/* Parse the comma-separated list into TLS format. */
|
|
|
|
static void parse_protos(const char *protos, unsigned char **out, size_t *outlen)
|
|
|
|
{
|
|
|
|
size_t len, i, prefix;
|
|
|
|
|
|
|
|
len = strlen(protos);
|
|
|
|
|
|
|
|
/* Should never have reuse. */
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(*out == NULL);
|
2016-07-05 02:16:14 +08:00
|
|
|
|
|
|
|
/* Test values are small, so we omit length limit checks. */
|
|
|
|
*out = OPENSSL_malloc(len + 1);
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(*out != NULL);
|
2016-07-05 02:16:14 +08:00
|
|
|
*outlen = len + 1;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* foo => '3', 'f', 'o', 'o'
|
|
|
|
* foo,bar => '3', 'f', 'o', 'o', '3', 'b', 'a', 'r'
|
|
|
|
*/
|
|
|
|
memcpy(*out + 1, protos, len);
|
|
|
|
|
|
|
|
prefix = 0;
|
|
|
|
i = prefix + 1;
|
|
|
|
while (i <= len) {
|
|
|
|
if ((*out)[i] == ',') {
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(i - 1 - prefix > 0);
|
2016-07-05 02:16:14 +08:00
|
|
|
(*out)[prefix] = i - 1 - prefix;
|
|
|
|
prefix = i;
|
|
|
|
}
|
|
|
|
i++;
|
|
|
|
}
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(len - prefix > 0);
|
2016-07-05 02:16:14 +08:00
|
|
|
(*out)[prefix] = len - prefix;
|
|
|
|
}
|
|
|
|
|
2016-08-05 23:17:00 +08:00
|
|
|
#ifndef OPENSSL_NO_NEXTPROTONEG
|
2016-07-05 02:16:14 +08:00
|
|
|
/*
|
|
|
|
* The client SHOULD select the first protocol advertised by the server that it
|
|
|
|
* also supports. In the event that the client doesn't support any of server's
|
|
|
|
* protocols, or the server doesn't advertise any, it SHOULD select the first
|
|
|
|
* protocol that it supports.
|
|
|
|
*/
|
|
|
|
static int client_npn_cb(SSL *s, unsigned char **out, unsigned char *outlen,
|
|
|
|
const unsigned char *in, unsigned int inlen,
|
|
|
|
void *arg)
|
|
|
|
{
|
|
|
|
CTX_DATA *ctx_data = (CTX_DATA*)(arg);
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
ret = SSL_select_next_proto(out, outlen, in, inlen,
|
|
|
|
ctx_data->npn_protocols,
|
|
|
|
ctx_data->npn_protocols_len);
|
|
|
|
/* Accept both OPENSSL_NPN_NEGOTIATED and OPENSSL_NPN_NO_OVERLAP. */
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(ret == OPENSSL_NPN_NEGOTIATED || ret == OPENSSL_NPN_NO_OVERLAP);
|
2016-07-05 02:16:14 +08:00
|
|
|
return SSL_TLSEXT_ERR_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int server_npn_cb(SSL *s, const unsigned char **data,
|
|
|
|
unsigned int *len, void *arg)
|
|
|
|
{
|
|
|
|
CTX_DATA *ctx_data = (CTX_DATA*)(arg);
|
|
|
|
*data = ctx_data->npn_protocols;
|
|
|
|
*len = ctx_data->npn_protocols_len;
|
|
|
|
return SSL_TLSEXT_ERR_OK;
|
|
|
|
}
|
2016-08-05 23:17:00 +08:00
|
|
|
#endif
|
2016-07-05 02:16:14 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* The server SHOULD select the most highly preferred protocol that it supports
|
|
|
|
* and that is also advertised by the client. In the event that the server
|
|
|
|
* supports no protocols that the client advertises, then the server SHALL
|
|
|
|
* respond with a fatal "no_application_protocol" alert.
|
|
|
|
*/
|
|
|
|
static int server_alpn_cb(SSL *s, const unsigned char **out,
|
|
|
|
unsigned char *outlen, const unsigned char *in,
|
|
|
|
unsigned int inlen, void *arg)
|
|
|
|
{
|
|
|
|
CTX_DATA *ctx_data = (CTX_DATA*)(arg);
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
/* SSL_select_next_proto isn't const-correct... */
|
|
|
|
unsigned char *tmp_out;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The result points either to |in| or to |ctx_data->alpn_protocols|.
|
|
|
|
* The callback is allowed to point to |in| or to a long-lived buffer,
|
|
|
|
* so we can return directly without storing a copy.
|
|
|
|
*/
|
|
|
|
ret = SSL_select_next_proto(&tmp_out, outlen,
|
|
|
|
ctx_data->alpn_protocols,
|
|
|
|
ctx_data->alpn_protocols_len, in, inlen);
|
|
|
|
|
|
|
|
*out = tmp_out;
|
|
|
|
/* Unlike NPN, we don't tolerate a mismatch. */
|
|
|
|
return ret == OPENSSL_NPN_NEGOTIATED ? SSL_TLSEXT_ERR_OK
|
|
|
|
: SSL_TLSEXT_ERR_NOACK;
|
|
|
|
}
|
|
|
|
|
2016-04-08 01:07:50 +08:00
|
|
|
/*
|
|
|
|
* Configure callbacks and other properties that can't be set directly
|
|
|
|
* in the server/client CONF.
|
|
|
|
*/
|
2016-06-10 06:39:22 +08:00
|
|
|
static void configure_handshake_ctx(SSL_CTX *server_ctx, SSL_CTX *server2_ctx,
|
|
|
|
SSL_CTX *client_ctx,
|
2016-08-16 21:11:08 +08:00
|
|
|
const SSL_TEST_CTX *test,
|
2016-07-21 22:29:48 +08:00
|
|
|
const SSL_TEST_EXTRA_CONF *extra,
|
2016-07-05 02:16:14 +08:00
|
|
|
CTX_DATA *server_ctx_data,
|
|
|
|
CTX_DATA *server2_ctx_data,
|
|
|
|
CTX_DATA *client_ctx_data)
|
2016-04-08 01:07:50 +08:00
|
|
|
{
|
2016-07-06 01:06:23 +08:00
|
|
|
unsigned char *ticket_keys;
|
|
|
|
size_t ticket_key_len;
|
|
|
|
|
2016-08-16 21:11:08 +08:00
|
|
|
TEST_check(SSL_CTX_set_max_send_fragment(server_ctx,
|
|
|
|
test->max_fragment_size) == 1);
|
|
|
|
if (server2_ctx != NULL) {
|
|
|
|
TEST_check(SSL_CTX_set_max_send_fragment(server2_ctx,
|
|
|
|
test->max_fragment_size) == 1);
|
|
|
|
}
|
|
|
|
TEST_check(SSL_CTX_set_max_send_fragment(client_ctx,
|
|
|
|
test->max_fragment_size) == 1);
|
|
|
|
|
2016-07-21 22:29:48 +08:00
|
|
|
switch (extra->client.verify_callback) {
|
2016-04-08 01:07:50 +08:00
|
|
|
case SSL_TEST_VERIFY_ACCEPT_ALL:
|
2016-06-14 06:44:29 +08:00
|
|
|
SSL_CTX_set_cert_verify_callback(client_ctx, &verify_accept_cb,
|
2016-04-08 01:07:50 +08:00
|
|
|
NULL);
|
|
|
|
break;
|
|
|
|
case SSL_TEST_VERIFY_REJECT_ALL:
|
2016-06-14 06:44:29 +08:00
|
|
|
SSL_CTX_set_cert_verify_callback(client_ctx, &verify_reject_cb,
|
2016-04-08 01:07:50 +08:00
|
|
|
NULL);
|
|
|
|
break;
|
2016-08-31 01:31:18 +08:00
|
|
|
case SSL_TEST_VERIFY_NONE:
|
2016-04-08 01:07:50 +08:00
|
|
|
break;
|
|
|
|
}
|
2016-06-10 06:39:22 +08:00
|
|
|
|
|
|
|
/* link the two contexts for SNI purposes */
|
2016-07-21 22:29:48 +08:00
|
|
|
switch (extra->server.servername_callback) {
|
2016-06-20 23:20:25 +08:00
|
|
|
case SSL_TEST_SERVERNAME_IGNORE_MISMATCH:
|
|
|
|
SSL_CTX_set_tlsext_servername_callback(server_ctx, servername_ignore_cb);
|
|
|
|
SSL_CTX_set_tlsext_servername_arg(server_ctx, server2_ctx);
|
|
|
|
break;
|
|
|
|
case SSL_TEST_SERVERNAME_REJECT_MISMATCH:
|
|
|
|
SSL_CTX_set_tlsext_servername_callback(server_ctx, servername_reject_cb);
|
|
|
|
SSL_CTX_set_tlsext_servername_arg(server_ctx, server2_ctx);
|
|
|
|
break;
|
2016-08-31 01:31:18 +08:00
|
|
|
case SSL_TEST_SERVERNAME_CB_NONE:
|
2016-06-20 23:20:25 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2016-08-30 21:20:18 +08:00
|
|
|
if (extra->server.cert_status != SSL_TEST_CERT_STATUS_NONE) {
|
|
|
|
SSL_CTX_set_tlsext_status_type(client_ctx, TLSEXT_STATUSTYPE_ocsp);
|
|
|
|
SSL_CTX_set_tlsext_status_cb(client_ctx, client_ocsp_cb);
|
|
|
|
SSL_CTX_set_tlsext_status_arg(client_ctx, NULL);
|
|
|
|
SSL_CTX_set_tlsext_status_cb(server_ctx, server_ocsp_cb);
|
|
|
|
SSL_CTX_set_tlsext_status_arg(server_ctx,
|
|
|
|
((extra->server.cert_status == SSL_TEST_CERT_STATUS_GOOD_RESPONSE)
|
|
|
|
? &dummy_ocsp_resp_good_val : &dummy_ocsp_resp_bad_val));
|
|
|
|
}
|
|
|
|
|
2016-06-10 06:39:22 +08:00
|
|
|
/*
|
|
|
|
* The initial_ctx/session_ctx always handles the encrypt/decrypt of the
|
|
|
|
* session ticket. This ticket_key callback is assigned to the second
|
|
|
|
* session (assigned via SNI), and should never be invoked
|
|
|
|
*/
|
2016-06-20 23:20:25 +08:00
|
|
|
if (server2_ctx != NULL)
|
|
|
|
SSL_CTX_set_tlsext_ticket_key_cb(server2_ctx,
|
|
|
|
do_not_call_session_ticket_cb);
|
2016-06-10 06:39:22 +08:00
|
|
|
|
2016-07-21 22:29:48 +08:00
|
|
|
if (extra->server.broken_session_ticket) {
|
2016-06-14 06:44:29 +08:00
|
|
|
SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, broken_session_ticket_cb);
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
}
|
2016-07-31 18:42:04 +08:00
|
|
|
#ifndef OPENSSL_NO_NEXTPROTONEG
|
2016-07-21 22:29:48 +08:00
|
|
|
if (extra->server.npn_protocols != NULL) {
|
|
|
|
parse_protos(extra->server.npn_protocols,
|
2016-07-05 02:16:14 +08:00
|
|
|
&server_ctx_data->npn_protocols,
|
|
|
|
&server_ctx_data->npn_protocols_len);
|
2016-12-09 03:18:40 +08:00
|
|
|
SSL_CTX_set_npn_advertised_cb(server_ctx, server_npn_cb,
|
|
|
|
server_ctx_data);
|
2016-07-05 02:16:14 +08:00
|
|
|
}
|
2016-07-21 22:29:48 +08:00
|
|
|
if (extra->server2.npn_protocols != NULL) {
|
|
|
|
parse_protos(extra->server2.npn_protocols,
|
2016-07-05 02:16:14 +08:00
|
|
|
&server2_ctx_data->npn_protocols,
|
|
|
|
&server2_ctx_data->npn_protocols_len);
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(server2_ctx != NULL);
|
2016-12-09 03:18:40 +08:00
|
|
|
SSL_CTX_set_npn_advertised_cb(server2_ctx, server_npn_cb,
|
|
|
|
server2_ctx_data);
|
2016-07-05 02:16:14 +08:00
|
|
|
}
|
2016-07-21 22:29:48 +08:00
|
|
|
if (extra->client.npn_protocols != NULL) {
|
|
|
|
parse_protos(extra->client.npn_protocols,
|
2016-07-05 02:16:14 +08:00
|
|
|
&client_ctx_data->npn_protocols,
|
|
|
|
&client_ctx_data->npn_protocols_len);
|
|
|
|
SSL_CTX_set_next_proto_select_cb(client_ctx, client_npn_cb,
|
|
|
|
client_ctx_data);
|
|
|
|
}
|
2016-08-05 23:17:00 +08:00
|
|
|
#endif
|
2016-07-21 22:29:48 +08:00
|
|
|
if (extra->server.alpn_protocols != NULL) {
|
|
|
|
parse_protos(extra->server.alpn_protocols,
|
2016-07-05 02:16:14 +08:00
|
|
|
&server_ctx_data->alpn_protocols,
|
|
|
|
&server_ctx_data->alpn_protocols_len);
|
|
|
|
SSL_CTX_set_alpn_select_cb(server_ctx, server_alpn_cb, server_ctx_data);
|
|
|
|
}
|
2016-07-21 22:29:48 +08:00
|
|
|
if (extra->server2.alpn_protocols != NULL) {
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(server2_ctx != NULL);
|
2016-07-21 22:29:48 +08:00
|
|
|
parse_protos(extra->server2.alpn_protocols,
|
2016-07-05 02:16:14 +08:00
|
|
|
&server2_ctx_data->alpn_protocols,
|
|
|
|
&server2_ctx_data->alpn_protocols_len);
|
|
|
|
SSL_CTX_set_alpn_select_cb(server2_ctx, server_alpn_cb, server2_ctx_data);
|
|
|
|
}
|
2016-07-21 22:29:48 +08:00
|
|
|
if (extra->client.alpn_protocols != NULL) {
|
2016-07-05 02:16:14 +08:00
|
|
|
unsigned char *alpn_protos = NULL;
|
|
|
|
size_t alpn_protos_len;
|
2016-07-21 22:29:48 +08:00
|
|
|
parse_protos(extra->client.alpn_protocols,
|
2016-07-05 02:16:14 +08:00
|
|
|
&alpn_protos, &alpn_protos_len);
|
|
|
|
/* Reversed return value convention... */
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(SSL_CTX_set_alpn_protos(client_ctx, alpn_protos,
|
|
|
|
alpn_protos_len) == 0);
|
2016-07-05 02:16:14 +08:00
|
|
|
OPENSSL_free(alpn_protos);
|
|
|
|
}
|
2016-08-05 23:17:00 +08:00
|
|
|
|
2016-07-06 01:06:23 +08:00
|
|
|
/*
|
|
|
|
* Use fixed session ticket keys so that we can decrypt a ticket created with
|
|
|
|
* one CTX in another CTX. Don't address server2 for the moment.
|
|
|
|
*/
|
|
|
|
ticket_key_len = SSL_CTX_set_tlsext_ticket_keys(server_ctx, NULL, 0);
|
|
|
|
ticket_keys = OPENSSL_zalloc(ticket_key_len);
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(ticket_keys != NULL);
|
|
|
|
TEST_check(SSL_CTX_set_tlsext_ticket_keys(server_ctx, ticket_keys,
|
|
|
|
ticket_key_len) == 1);
|
2016-07-06 01:06:23 +08:00
|
|
|
OPENSSL_free(ticket_keys);
|
2016-08-09 22:47:26 +08:00
|
|
|
|
2016-08-11 00:36:47 +08:00
|
|
|
/* The default log list includes EC keys, so CT can't work without EC. */
|
|
|
|
#if !defined(OPENSSL_NO_CT) && !defined(OPENSSL_NO_EC)
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(SSL_CTX_set_default_ctlog_list_file(client_ctx));
|
2016-08-09 22:47:26 +08:00
|
|
|
switch (extra->client.ct_validation) {
|
|
|
|
case SSL_TEST_CT_VALIDATION_PERMISSIVE:
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(SSL_CTX_enable_ct(client_ctx, SSL_CT_VALIDATION_PERMISSIVE));
|
2016-08-09 22:47:26 +08:00
|
|
|
break;
|
|
|
|
case SSL_TEST_CT_VALIDATION_STRICT:
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(SSL_CTX_enable_ct(client_ctx, SSL_CT_VALIDATION_STRICT));
|
2016-08-09 22:47:26 +08:00
|
|
|
break;
|
|
|
|
case SSL_TEST_CT_VALIDATION_NONE:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
#endif
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
}
|
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
/* Configure per-SSL callbacks and other properties. */
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
static void configure_handshake_ssl(SSL *server, SSL *client,
|
2016-07-21 22:29:48 +08:00
|
|
|
const SSL_TEST_EXTRA_CONF *extra)
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
{
|
2016-07-21 22:29:48 +08:00
|
|
|
if (extra->client.servername != SSL_TEST_SERVERNAME_NONE)
|
2016-06-10 06:39:22 +08:00
|
|
|
SSL_set_tlsext_host_name(client,
|
2016-07-21 22:29:48 +08:00
|
|
|
ssl_servername_name(extra->client.servername));
|
2016-04-08 01:07:50 +08:00
|
|
|
}
|
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
/* The status for each connection phase. */
|
2016-03-17 22:14:30 +08:00
|
|
|
typedef enum {
|
|
|
|
PEER_SUCCESS,
|
|
|
|
PEER_RETRY,
|
|
|
|
PEER_ERROR
|
|
|
|
} peer_status_t;
|
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
/* An SSL object and associated read-write buffers. */
|
|
|
|
typedef struct peer_st {
|
|
|
|
SSL *ssl;
|
|
|
|
/* Buffer lengths are int to match the SSL read/write API. */
|
|
|
|
unsigned char *write_buf;
|
|
|
|
int write_buf_len;
|
|
|
|
unsigned char *read_buf;
|
|
|
|
int read_buf_len;
|
|
|
|
int bytes_to_write;
|
|
|
|
int bytes_to_read;
|
|
|
|
peer_status_t status;
|
|
|
|
} PEER;
|
|
|
|
|
|
|
|
static void create_peer(PEER *peer, SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
static const int peer_buffer_size = 64 * 1024;
|
|
|
|
|
|
|
|
peer->ssl = SSL_new(ctx);
|
|
|
|
TEST_check(peer->ssl != NULL);
|
|
|
|
peer->write_buf = OPENSSL_zalloc(peer_buffer_size);
|
|
|
|
TEST_check(peer->write_buf != NULL);
|
|
|
|
peer->read_buf = OPENSSL_zalloc(peer_buffer_size);
|
|
|
|
TEST_check(peer->read_buf != NULL);
|
|
|
|
peer->write_buf_len = peer->read_buf_len = peer_buffer_size;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void peer_free_data(PEER *peer)
|
|
|
|
{
|
|
|
|
SSL_free(peer->ssl);
|
|
|
|
OPENSSL_free(peer->write_buf);
|
|
|
|
OPENSSL_free(peer->read_buf);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Note that we could do the handshake transparently under an SSL_write,
|
|
|
|
* but separating the steps is more helpful for debugging test failures.
|
|
|
|
*/
|
|
|
|
static void do_handshake_step(PEER *peer)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
TEST_check(peer->status == PEER_RETRY);
|
|
|
|
ret = SSL_do_handshake(peer->ssl);
|
|
|
|
|
|
|
|
if (ret == 1) {
|
|
|
|
peer->status = PEER_SUCCESS;
|
|
|
|
} else if (ret == 0) {
|
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
} else {
|
|
|
|
int error = SSL_get_error(peer->ssl, ret);
|
|
|
|
/* Memory bios should never block with SSL_ERROR_WANT_WRITE. */
|
|
|
|
if (error != SSL_ERROR_WANT_READ)
|
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*-
|
|
|
|
* Send/receive some application data. The read-write sequence is
|
|
|
|
* Peer A: (R) W - first read will yield no data
|
|
|
|
* Peer B: R W
|
|
|
|
* ...
|
|
|
|
* Peer A: R W
|
|
|
|
* Peer B: R W
|
|
|
|
* Peer A: R
|
|
|
|
*/
|
|
|
|
static void do_app_data_step(PEER *peer)
|
|
|
|
{
|
|
|
|
int ret = 1, write_bytes;
|
|
|
|
|
|
|
|
TEST_check(peer->status == PEER_RETRY);
|
|
|
|
|
|
|
|
/* We read everything available... */
|
|
|
|
while (ret > 0 && peer->bytes_to_read) {
|
|
|
|
ret = SSL_read(peer->ssl, peer->read_buf, peer->read_buf_len);
|
|
|
|
if (ret > 0) {
|
|
|
|
TEST_check(ret <= peer->bytes_to_read);
|
|
|
|
peer->bytes_to_read -= ret;
|
|
|
|
} else if (ret == 0) {
|
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
return;
|
|
|
|
} else {
|
|
|
|
int error = SSL_get_error(peer->ssl, ret);
|
|
|
|
if (error != SSL_ERROR_WANT_READ) {
|
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
return;
|
|
|
|
} /* Else continue with write. */
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* ... but we only write one write-buffer-full of data. */
|
|
|
|
write_bytes = peer->bytes_to_write < peer->write_buf_len ? peer->bytes_to_write :
|
|
|
|
peer->write_buf_len;
|
|
|
|
if (write_bytes) {
|
|
|
|
ret = SSL_write(peer->ssl, peer->write_buf, write_bytes);
|
|
|
|
if (ret > 0) {
|
|
|
|
/* SSL_write will only succeed with a complete write. */
|
|
|
|
TEST_check(ret == write_bytes);
|
|
|
|
peer->bytes_to_write -= ret;
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* We should perhaps check for SSL_ERROR_WANT_READ/WRITE here
|
|
|
|
* but this doesn't yet occur with current app data sizes.
|
|
|
|
*/
|
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We could simply finish when there was nothing to read, and we have
|
|
|
|
* nothing left to write. But keeping track of the expected number of bytes
|
|
|
|
* to read gives us somewhat better guarantees that all data sent is in fact
|
|
|
|
* received.
|
|
|
|
*/
|
|
|
|
if (!peer->bytes_to_write && !peer->bytes_to_read) {
|
|
|
|
peer->status = PEER_SUCCESS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-09-27 18:50:43 +08:00
|
|
|
static void do_reneg_setup_step(const SSL_TEST_CTX *test_ctx, PEER *peer)
|
2016-09-27 00:25:43 +08:00
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
char buf;
|
|
|
|
|
|
|
|
TEST_check(peer->status == PEER_RETRY);
|
2016-09-27 18:50:43 +08:00
|
|
|
TEST_check(test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RENEG_SERVER
|
|
|
|
|| test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RENEG_CLIENT);
|
|
|
|
|
|
|
|
/* Check if we are the peer that is going to initiate */
|
|
|
|
if ((test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RENEG_SERVER
|
|
|
|
&& SSL_is_server(peer->ssl))
|
|
|
|
|| (test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RENEG_CLIENT
|
|
|
|
&& !SSL_is_server(peer->ssl))) {
|
2016-09-27 00:25:43 +08:00
|
|
|
/*
|
2016-09-27 18:50:43 +08:00
|
|
|
* If we already asked for a renegotiation then fall through to the
|
|
|
|
* SSL_read() below.
|
2016-09-27 00:25:43 +08:00
|
|
|
*/
|
2016-09-27 18:50:43 +08:00
|
|
|
if (!SSL_renegotiate_pending(peer->ssl)) {
|
|
|
|
/*
|
|
|
|
* If we are the client we will always attempt to resume the
|
|
|
|
* session. The server may or may not resume dependant on the
|
|
|
|
* setting of SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
|
|
|
|
*/
|
|
|
|
if (SSL_is_server(peer->ssl))
|
|
|
|
ret = SSL_renegotiate(peer->ssl);
|
|
|
|
else
|
|
|
|
ret = SSL_renegotiate_abbreviated(peer->ssl);
|
|
|
|
if (!ret) {
|
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
do_handshake_step(peer);
|
|
|
|
/*
|
|
|
|
* If status is PEER_RETRY it means we're waiting on the peer to
|
|
|
|
* continue the handshake. As far as setting up the renegotiation is
|
|
|
|
* concerned that is a success. The next step will continue the
|
|
|
|
* handshake to its conclusion.
|
|
|
|
*
|
|
|
|
* If status is PEER_SUCCESS then we are the server and we have
|
|
|
|
* successfully sent the HelloRequest. We need to continue to wait
|
|
|
|
* until the handshake arrives from the client.
|
|
|
|
*/
|
|
|
|
if (peer->status == PEER_RETRY)
|
|
|
|
peer->status = PEER_SUCCESS;
|
|
|
|
else if (peer->status == PEER_SUCCESS)
|
|
|
|
peer->status = PEER_RETRY;
|
|
|
|
return;
|
|
|
|
}
|
2016-09-27 00:25:43 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The SSL object is still expecting app data, even though it's going to
|
|
|
|
* get a handshake message. We try to read, and it should fail - after which
|
|
|
|
* we should be in a handshake
|
|
|
|
*/
|
|
|
|
ret = SSL_read(peer->ssl, &buf, sizeof(buf));
|
|
|
|
if (ret >= 0) {
|
2016-09-27 18:50:43 +08:00
|
|
|
/*
|
|
|
|
* We're not actually expecting data - we're expecting a reneg to
|
|
|
|
* start
|
|
|
|
*/
|
2016-09-27 00:25:43 +08:00
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
return;
|
|
|
|
} else {
|
|
|
|
int error = SSL_get_error(peer->ssl, ret);
|
2016-09-27 18:50:43 +08:00
|
|
|
if (error != SSL_ERROR_WANT_READ) {
|
2016-09-27 00:25:43 +08:00
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
return;
|
|
|
|
}
|
2016-09-27 18:50:43 +08:00
|
|
|
/* If we're no in init yet then we're not done with setup yet */
|
|
|
|
if (!SSL_in_init(peer->ssl))
|
|
|
|
return;
|
2016-09-27 00:25:43 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
peer->status = PEER_SUCCESS;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2016-07-06 01:06:23 +08:00
|
|
|
/*
|
|
|
|
* RFC 5246 says:
|
|
|
|
*
|
|
|
|
* Note that as of TLS 1.1,
|
|
|
|
* failure to properly close a connection no longer requires that a
|
|
|
|
* session not be resumed. This is a change from TLS 1.0 to conform
|
|
|
|
* with widespread implementation practice.
|
|
|
|
*
|
|
|
|
* However,
|
|
|
|
* (a) OpenSSL requires that a connection be shutdown for all protocol versions.
|
|
|
|
* (b) We test lower versions, too.
|
|
|
|
* So we just implement shutdown. We do a full bidirectional shutdown so that we
|
|
|
|
* can compare sent and received close_notify alerts and get some test coverage
|
|
|
|
* for SSL_shutdown as a bonus.
|
|
|
|
*/
|
2016-08-12 02:51:57 +08:00
|
|
|
static void do_shutdown_step(PEER *peer)
|
2016-03-17 22:14:30 +08:00
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
TEST_check(peer->status == PEER_RETRY);
|
|
|
|
ret = SSL_shutdown(peer->ssl);
|
2016-03-17 22:14:30 +08:00
|
|
|
|
|
|
|
if (ret == 1) {
|
2016-08-12 02:51:57 +08:00
|
|
|
peer->status = PEER_SUCCESS;
|
|
|
|
} else if (ret < 0) { /* On 0, we retry. */
|
|
|
|
int error = SSL_get_error(peer->ssl, ret);
|
2016-03-17 22:14:30 +08:00
|
|
|
/* Memory bios should never block with SSL_ERROR_WANT_WRITE. */
|
2016-08-12 02:51:57 +08:00
|
|
|
if (error != SSL_ERROR_WANT_READ)
|
|
|
|
peer->status = PEER_ERROR;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
typedef enum {
|
|
|
|
HANDSHAKE,
|
2016-09-27 00:25:43 +08:00
|
|
|
RENEG_APPLICATION_DATA,
|
|
|
|
RENEG_SETUP,
|
|
|
|
RENEG_HANDSHAKE,
|
2016-08-12 02:51:57 +08:00
|
|
|
APPLICATION_DATA,
|
|
|
|
SHUTDOWN,
|
|
|
|
CONNECTION_DONE
|
|
|
|
} connect_phase_t;
|
|
|
|
|
2016-09-27 00:25:43 +08:00
|
|
|
static connect_phase_t next_phase(const SSL_TEST_CTX *test_ctx,
|
|
|
|
connect_phase_t phase)
|
2016-08-12 02:51:57 +08:00
|
|
|
{
|
|
|
|
switch (phase) {
|
|
|
|
case HANDSHAKE:
|
2016-09-27 18:50:43 +08:00
|
|
|
if (test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RENEG_SERVER
|
|
|
|
|| test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RENEG_CLIENT)
|
2016-09-27 00:25:43 +08:00
|
|
|
return RENEG_APPLICATION_DATA;
|
|
|
|
return APPLICATION_DATA;
|
|
|
|
case RENEG_APPLICATION_DATA:
|
|
|
|
return RENEG_SETUP;
|
|
|
|
case RENEG_SETUP:
|
|
|
|
return RENEG_HANDSHAKE;
|
|
|
|
case RENEG_HANDSHAKE:
|
2016-08-12 02:51:57 +08:00
|
|
|
return APPLICATION_DATA;
|
|
|
|
case APPLICATION_DATA:
|
|
|
|
return SHUTDOWN;
|
|
|
|
case SHUTDOWN:
|
|
|
|
return CONNECTION_DONE;
|
2016-08-31 01:31:18 +08:00
|
|
|
case CONNECTION_DONE:
|
|
|
|
TEST_check(0);
|
|
|
|
break;
|
2016-08-12 02:51:57 +08:00
|
|
|
}
|
2016-08-31 01:31:18 +08:00
|
|
|
return -1;
|
2016-08-12 02:51:57 +08:00
|
|
|
}
|
|
|
|
|
2016-09-27 18:50:43 +08:00
|
|
|
static void do_connect_step(const SSL_TEST_CTX *test_ctx, PEER *peer,
|
|
|
|
connect_phase_t phase)
|
2016-08-12 02:51:57 +08:00
|
|
|
{
|
|
|
|
switch (phase) {
|
|
|
|
case HANDSHAKE:
|
|
|
|
do_handshake_step(peer);
|
|
|
|
break;
|
2016-09-27 00:25:43 +08:00
|
|
|
case RENEG_APPLICATION_DATA:
|
|
|
|
do_app_data_step(peer);
|
|
|
|
break;
|
|
|
|
case RENEG_SETUP:
|
2016-09-27 18:50:43 +08:00
|
|
|
do_reneg_setup_step(test_ctx, peer);
|
2016-09-27 00:25:43 +08:00
|
|
|
break;
|
|
|
|
case RENEG_HANDSHAKE:
|
|
|
|
do_handshake_step(peer);
|
|
|
|
break;
|
2016-08-12 02:51:57 +08:00
|
|
|
case APPLICATION_DATA:
|
|
|
|
do_app_data_step(peer);
|
|
|
|
break;
|
|
|
|
case SHUTDOWN:
|
|
|
|
do_shutdown_step(peer);
|
|
|
|
break;
|
2016-08-31 01:31:18 +08:00
|
|
|
case CONNECTION_DONE:
|
2016-08-12 02:51:57 +08:00
|
|
|
TEST_check(0);
|
2016-08-31 01:31:18 +08:00
|
|
|
break;
|
2016-03-17 22:14:30 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
typedef enum {
|
|
|
|
/* Both parties succeeded. */
|
|
|
|
HANDSHAKE_SUCCESS,
|
|
|
|
/* Client errored. */
|
|
|
|
CLIENT_ERROR,
|
|
|
|
/* Server errored. */
|
|
|
|
SERVER_ERROR,
|
|
|
|
/* Peers are in inconsistent state. */
|
|
|
|
INTERNAL_ERROR,
|
|
|
|
/* One or both peers not done. */
|
|
|
|
HANDSHAKE_RETRY
|
|
|
|
} handshake_status_t;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Determine the handshake outcome.
|
|
|
|
* last_status: the status of the peer to have acted last.
|
|
|
|
* previous_status: the status of the peer that didn't act last.
|
|
|
|
* client_spoke_last: 1 if the client went last.
|
|
|
|
*/
|
|
|
|
static handshake_status_t handshake_status(peer_status_t last_status,
|
|
|
|
peer_status_t previous_status,
|
|
|
|
int client_spoke_last)
|
|
|
|
{
|
|
|
|
switch (last_status) {
|
|
|
|
case PEER_SUCCESS:
|
|
|
|
switch (previous_status) {
|
|
|
|
case PEER_SUCCESS:
|
|
|
|
/* Both succeeded. */
|
|
|
|
return HANDSHAKE_SUCCESS;
|
|
|
|
case PEER_RETRY:
|
|
|
|
/* Let the first peer finish. */
|
|
|
|
return HANDSHAKE_RETRY;
|
|
|
|
case PEER_ERROR:
|
|
|
|
/*
|
|
|
|
* Second peer succeeded despite the fact that the first peer
|
|
|
|
* already errored. This shouldn't happen.
|
|
|
|
*/
|
|
|
|
return INTERNAL_ERROR;
|
|
|
|
}
|
|
|
|
|
|
|
|
case PEER_RETRY:
|
|
|
|
if (previous_status == PEER_RETRY) {
|
|
|
|
/* Neither peer is done. */
|
|
|
|
return HANDSHAKE_RETRY;
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* Deadlock: second peer is waiting for more input while first
|
|
|
|
* peer thinks they're done (no more input is coming).
|
|
|
|
*/
|
|
|
|
return INTERNAL_ERROR;
|
|
|
|
}
|
|
|
|
case PEER_ERROR:
|
|
|
|
switch (previous_status) {
|
|
|
|
case PEER_SUCCESS:
|
|
|
|
/*
|
|
|
|
* First peer succeeded but second peer errored.
|
|
|
|
* TODO(emilia): we should be able to continue here (with some
|
|
|
|
* application data?) to ensure the first peer receives the
|
|
|
|
* alert / close_notify.
|
2016-08-12 02:51:57 +08:00
|
|
|
* (No tests currently exercise this branch.)
|
2016-03-17 22:14:30 +08:00
|
|
|
*/
|
|
|
|
return client_spoke_last ? CLIENT_ERROR : SERVER_ERROR;
|
|
|
|
case PEER_RETRY:
|
|
|
|
/* We errored; let the peer finish. */
|
|
|
|
return HANDSHAKE_RETRY;
|
|
|
|
case PEER_ERROR:
|
|
|
|
/* Both peers errored. Return the one that errored first. */
|
|
|
|
return client_spoke_last ? SERVER_ERROR : CLIENT_ERROR;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* Control should never reach here. */
|
|
|
|
return INTERNAL_ERROR;
|
|
|
|
}
|
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
/* Convert unsigned char buf's that shouldn't contain any NUL-bytes to char. */
|
|
|
|
static char *dup_str(const unsigned char *in, size_t len)
|
|
|
|
{
|
|
|
|
char *ret;
|
|
|
|
|
2016-08-24 06:17:31 +08:00
|
|
|
if (len == 0)
|
2016-07-05 02:16:14 +08:00
|
|
|
return NULL;
|
|
|
|
|
|
|
|
/* Assert that the string does not contain NUL-bytes. */
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(OPENSSL_strnlen((const char*)(in), len) == len);
|
2016-07-05 02:16:14 +08:00
|
|
|
ret = OPENSSL_strndup((const char*)(in), len);
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(ret != NULL);
|
2016-07-05 02:16:14 +08:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2017-01-09 03:30:41 +08:00
|
|
|
static int pkey_type(EVP_PKEY *pkey)
|
|
|
|
{
|
|
|
|
int nid = EVP_PKEY_id(pkey);
|
|
|
|
|
|
|
|
#ifndef OPENSSL_NO_EC
|
|
|
|
if (nid == EVP_PKEY_EC) {
|
|
|
|
const EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
|
|
|
|
return EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
return nid;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int peer_pkey_type(SSL *s)
|
|
|
|
{
|
|
|
|
X509 *x = SSL_get_peer_certificate(s);
|
|
|
|
|
|
|
|
if (x != NULL) {
|
|
|
|
int nid = pkey_type(X509_get0_pubkey(x));
|
|
|
|
|
|
|
|
X509_free(x);
|
|
|
|
return nid;
|
|
|
|
}
|
|
|
|
return NID_undef;
|
|
|
|
}
|
|
|
|
|
2016-08-16 21:11:08 +08:00
|
|
|
/*
|
|
|
|
* Note that |extra| points to the correct client/server configuration
|
|
|
|
* within |test_ctx|. When configuring the handshake, general mode settings
|
|
|
|
* are taken from |test_ctx|, and client/server-specific settings should be
|
|
|
|
* taken from |extra|.
|
|
|
|
*
|
|
|
|
* The configuration code should never reach into |test_ctx->extra| or
|
|
|
|
* |test_ctx->resume_extra| directly.
|
|
|
|
*
|
|
|
|
* (We could refactor test mode settings into a substructure. This would result
|
|
|
|
* in cleaner argument passing but would complicate the test configuration
|
|
|
|
* parsing.)
|
|
|
|
*/
|
2016-07-06 01:06:23 +08:00
|
|
|
static HANDSHAKE_RESULT *do_handshake_internal(
|
|
|
|
SSL_CTX *server_ctx, SSL_CTX *server2_ctx, SSL_CTX *client_ctx,
|
2016-08-16 21:11:08 +08:00
|
|
|
const SSL_TEST_CTX *test_ctx, const SSL_TEST_EXTRA_CONF *extra,
|
2016-08-12 02:51:57 +08:00
|
|
|
SSL_SESSION *session_in, SSL_SESSION **session_out)
|
2016-03-17 22:14:30 +08:00
|
|
|
{
|
2016-08-12 02:51:57 +08:00
|
|
|
PEER server, client;
|
2016-03-17 22:14:30 +08:00
|
|
|
BIO *client_to_server, *server_to_client;
|
|
|
|
HANDSHAKE_EX_DATA server_ex_data, client_ex_data;
|
2016-07-05 02:16:14 +08:00
|
|
|
CTX_DATA client_ctx_data, server_ctx_data, server2_ctx_data;
|
|
|
|
HANDSHAKE_RESULT *ret = HANDSHAKE_RESULT_new();
|
2016-12-16 18:18:47 +08:00
|
|
|
int client_turn = 1, client_turn_count = 0;
|
2016-08-12 02:51:57 +08:00
|
|
|
connect_phase_t phase = HANDSHAKE;
|
2016-03-17 22:14:30 +08:00
|
|
|
handshake_status_t status = HANDSHAKE_RETRY;
|
2016-08-13 21:29:41 +08:00
|
|
|
const unsigned char* tick = NULL;
|
2016-07-05 02:16:14 +08:00
|
|
|
size_t tick_len = 0;
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
SSL_SESSION* sess = NULL;
|
2016-07-05 02:16:14 +08:00
|
|
|
const unsigned char *proto = NULL;
|
|
|
|
/* API dictates unsigned int rather than size_t. */
|
|
|
|
unsigned int proto_len = 0;
|
2017-01-08 08:09:08 +08:00
|
|
|
EVP_PKEY *tmp_key;
|
2016-03-17 22:14:30 +08:00
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
memset(&server_ctx_data, 0, sizeof(server_ctx_data));
|
|
|
|
memset(&server2_ctx_data, 0, sizeof(server2_ctx_data));
|
|
|
|
memset(&client_ctx_data, 0, sizeof(client_ctx_data));
|
2016-08-12 02:51:57 +08:00
|
|
|
memset(&server, 0, sizeof(server));
|
|
|
|
memset(&client, 0, sizeof(client));
|
2016-07-05 02:16:14 +08:00
|
|
|
|
2016-08-16 21:11:08 +08:00
|
|
|
configure_handshake_ctx(server_ctx, server2_ctx, client_ctx, test_ctx, extra,
|
2016-07-05 02:16:14 +08:00
|
|
|
&server_ctx_data, &server2_ctx_data, &client_ctx_data);
|
2016-04-08 01:07:50 +08:00
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
/* Setup SSL and buffers; additional configuration happens below. */
|
|
|
|
create_peer(&server, server_ctx);
|
|
|
|
create_peer(&client, client_ctx);
|
2016-03-17 22:14:30 +08:00
|
|
|
|
2016-08-16 21:11:08 +08:00
|
|
|
server.bytes_to_write = client.bytes_to_read = test_ctx->app_data_size;
|
|
|
|
client.bytes_to_write = server.bytes_to_read = test_ctx->app_data_size;
|
2016-08-12 02:51:57 +08:00
|
|
|
|
|
|
|
configure_handshake_ssl(server.ssl, client.ssl, extra);
|
2016-07-06 01:06:23 +08:00
|
|
|
if (session_in != NULL) {
|
|
|
|
/* In case we're testing resumption without tickets. */
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(SSL_CTX_add_session(server_ctx, session_in));
|
2016-08-12 02:51:57 +08:00
|
|
|
TEST_check(SSL_set_session(client.ssl, session_in));
|
2016-07-06 01:06:23 +08:00
|
|
|
}
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
|
2016-03-17 22:14:30 +08:00
|
|
|
memset(&server_ex_data, 0, sizeof(server_ex_data));
|
|
|
|
memset(&client_ex_data, 0, sizeof(client_ex_data));
|
2016-07-05 02:16:14 +08:00
|
|
|
|
|
|
|
ret->result = SSL_TEST_INTERNAL_ERROR;
|
2016-03-17 22:14:30 +08:00
|
|
|
|
|
|
|
client_to_server = BIO_new(BIO_s_mem());
|
|
|
|
server_to_client = BIO_new(BIO_s_mem());
|
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
TEST_check(client_to_server != NULL);
|
|
|
|
TEST_check(server_to_client != NULL);
|
2016-03-17 22:14:30 +08:00
|
|
|
|
|
|
|
/* Non-blocking bio. */
|
|
|
|
BIO_set_nbio(client_to_server, 1);
|
|
|
|
BIO_set_nbio(server_to_client, 1);
|
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
SSL_set_connect_state(client.ssl);
|
|
|
|
SSL_set_accept_state(server.ssl);
|
2016-03-17 22:14:30 +08:00
|
|
|
|
|
|
|
/* The bios are now owned by the SSL object. */
|
2016-08-12 02:51:57 +08:00
|
|
|
SSL_set_bio(client.ssl, server_to_client, client_to_server);
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(BIO_up_ref(server_to_client) > 0);
|
|
|
|
TEST_check(BIO_up_ref(client_to_server) > 0);
|
2016-08-12 02:51:57 +08:00
|
|
|
SSL_set_bio(server.ssl, client_to_server, server_to_client);
|
2016-03-17 22:14:30 +08:00
|
|
|
|
|
|
|
ex_data_idx = SSL_get_ex_new_index(0, "ex data", NULL, NULL, NULL);
|
2016-08-09 23:03:23 +08:00
|
|
|
TEST_check(ex_data_idx >= 0);
|
2016-03-17 22:14:30 +08:00
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
TEST_check(SSL_set_ex_data(server.ssl, ex_data_idx, &server_ex_data) == 1);
|
|
|
|
TEST_check(SSL_set_ex_data(client.ssl, ex_data_idx, &client_ex_data) == 1);
|
|
|
|
|
|
|
|
SSL_set_info_callback(server.ssl, &info_cb);
|
|
|
|
SSL_set_info_callback(client.ssl, &info_cb);
|
2016-03-17 22:14:30 +08:00
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
client.status = server.status = PEER_RETRY;
|
2016-03-17 22:14:30 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Half-duplex handshake loop.
|
|
|
|
* Client and server speak to each other synchronously in the same process.
|
|
|
|
* We use non-blocking BIOs, so whenever one peer blocks for read, it
|
|
|
|
* returns PEER_RETRY to indicate that it's the other peer's turn to write.
|
|
|
|
* The handshake succeeds once both peers have succeeded. If one peer
|
|
|
|
* errors out, we also let the other peer retry (and presumably fail).
|
|
|
|
*/
|
|
|
|
for(;;) {
|
|
|
|
if (client_turn) {
|
2016-09-27 18:50:43 +08:00
|
|
|
do_connect_step(test_ctx, &client, phase);
|
2016-08-12 02:51:57 +08:00
|
|
|
status = handshake_status(client.status, server.status,
|
2016-03-17 22:14:30 +08:00
|
|
|
1 /* client went last */);
|
|
|
|
} else {
|
2016-09-27 18:50:43 +08:00
|
|
|
do_connect_step(test_ctx, &server, phase);
|
2016-08-12 02:51:57 +08:00
|
|
|
status = handshake_status(server.status, client.status,
|
2016-03-17 22:14:30 +08:00
|
|
|
0 /* server went last */);
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (status) {
|
|
|
|
case HANDSHAKE_SUCCESS:
|
2016-12-16 18:18:47 +08:00
|
|
|
client_turn_count = 0;
|
2016-09-27 00:25:43 +08:00
|
|
|
phase = next_phase(test_ctx, phase);
|
2016-08-12 02:51:57 +08:00
|
|
|
if (phase == CONNECTION_DONE) {
|
2016-07-06 01:06:23 +08:00
|
|
|
ret->result = SSL_TEST_SUCCESS;
|
|
|
|
goto err;
|
|
|
|
} else {
|
2016-08-12 02:51:57 +08:00
|
|
|
client.status = server.status = PEER_RETRY;
|
|
|
|
/*
|
|
|
|
* For now, client starts each phase. Since each phase is
|
|
|
|
* started separately, we can later control this more
|
|
|
|
* precisely, for example, to test client-initiated and
|
|
|
|
* server-initiated shutdown.
|
|
|
|
*/
|
2016-07-06 01:06:23 +08:00
|
|
|
client_turn = 1;
|
|
|
|
break;
|
|
|
|
}
|
2016-03-17 22:14:30 +08:00
|
|
|
case CLIENT_ERROR:
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->result = SSL_TEST_CLIENT_FAIL;
|
2016-03-17 22:14:30 +08:00
|
|
|
goto err;
|
|
|
|
case SERVER_ERROR:
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->result = SSL_TEST_SERVER_FAIL;
|
2016-03-17 22:14:30 +08:00
|
|
|
goto err;
|
|
|
|
case INTERNAL_ERROR:
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->result = SSL_TEST_INTERNAL_ERROR;
|
2016-03-17 22:14:30 +08:00
|
|
|
goto err;
|
|
|
|
case HANDSHAKE_RETRY:
|
2016-12-16 18:18:47 +08:00
|
|
|
if (client_turn_count++ >= 2000) {
|
|
|
|
/*
|
|
|
|
* At this point, there's been so many PEER_RETRY in a row
|
|
|
|
* that it's likely both sides are stuck waiting for a read.
|
|
|
|
* It's time to give up.
|
|
|
|
*/
|
|
|
|
ret->result = SSL_TEST_INTERNAL_ERROR;
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
2016-03-17 22:14:30 +08:00
|
|
|
/* Continue. */
|
|
|
|
client_turn ^= 1;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
err:
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->server_alert_sent = server_ex_data.alert_sent;
|
2016-08-12 20:29:24 +08:00
|
|
|
ret->server_num_fatal_alerts_sent = server_ex_data.num_fatal_alerts_sent;
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->server_alert_received = client_ex_data.alert_received;
|
|
|
|
ret->client_alert_sent = client_ex_data.alert_sent;
|
2016-08-12 20:29:24 +08:00
|
|
|
ret->client_num_fatal_alerts_sent = client_ex_data.num_fatal_alerts_sent;
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->client_alert_received = server_ex_data.alert_received;
|
2016-08-12 02:51:57 +08:00
|
|
|
ret->server_protocol = SSL_version(server.ssl);
|
|
|
|
ret->client_protocol = SSL_version(client.ssl);
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->servername = server_ex_data.servername;
|
2016-08-12 02:51:57 +08:00
|
|
|
if ((sess = SSL_get0_session(client.ssl)) != NULL)
|
2016-07-05 02:16:14 +08:00
|
|
|
SSL_SESSION_get0_ticket(sess, &tick, &tick_len);
|
|
|
|
if (tick == NULL || tick_len == 0)
|
|
|
|
ret->session_ticket = SSL_TEST_SESSION_TICKET_NO;
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
|
|
|
else
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->session_ticket = SSL_TEST_SESSION_TICKET_YES;
|
|
|
|
ret->session_ticket_do_not_call = server_ex_data.session_ticket_do_not_call;
|
|
|
|
|
2016-07-31 18:42:04 +08:00
|
|
|
#ifndef OPENSSL_NO_NEXTPROTONEG
|
2016-08-12 02:51:57 +08:00
|
|
|
SSL_get0_next_proto_negotiated(client.ssl, &proto, &proto_len);
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->client_npn_negotiated = dup_str(proto, proto_len);
|
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
SSL_get0_next_proto_negotiated(server.ssl, &proto, &proto_len);
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->server_npn_negotiated = dup_str(proto, proto_len);
|
2016-08-05 23:17:00 +08:00
|
|
|
#endif
|
2016-07-05 02:16:14 +08:00
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
SSL_get0_alpn_selected(client.ssl, &proto, &proto_len);
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->client_alpn_negotiated = dup_str(proto, proto_len);
|
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
SSL_get0_alpn_selected(server.ssl, &proto, &proto_len);
|
2016-07-05 02:16:14 +08:00
|
|
|
ret->server_alpn_negotiated = dup_str(proto, proto_len);
|
2016-03-17 22:14:30 +08:00
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
ret->client_resumed = SSL_session_reused(client.ssl);
|
|
|
|
ret->server_resumed = SSL_session_reused(server.ssl);
|
2016-07-06 01:06:23 +08:00
|
|
|
|
|
|
|
if (session_out != NULL)
|
2016-08-12 02:51:57 +08:00
|
|
|
*session_out = SSL_get1_session(client.ssl);
|
2016-07-06 01:06:23 +08:00
|
|
|
|
2017-01-08 08:09:08 +08:00
|
|
|
if (SSL_get_server_tmp_key(client.ssl, &tmp_key)) {
|
2017-01-09 03:30:41 +08:00
|
|
|
ret->tmp_key_type = pkey_type(tmp_key);
|
2017-01-08 08:09:08 +08:00
|
|
|
EVP_PKEY_free(tmp_key);
|
|
|
|
}
|
|
|
|
|
2017-01-13 23:20:42 +08:00
|
|
|
SSL_get_peer_signature_nid(client.ssl, &ret->server_sign_hash);
|
|
|
|
SSL_get_peer_signature_nid(server.ssl, &ret->client_sign_hash);
|
|
|
|
|
2017-01-09 03:30:41 +08:00
|
|
|
ret->server_cert_type = peer_pkey_type(client.ssl);
|
|
|
|
ret->client_cert_type = peer_pkey_type(server.ssl);
|
|
|
|
|
2016-07-05 02:16:14 +08:00
|
|
|
ctx_data_free_data(&server_ctx_data);
|
|
|
|
ctx_data_free_data(&server2_ctx_data);
|
|
|
|
ctx_data_free_data(&client_ctx_data);
|
2016-07-06 01:06:23 +08:00
|
|
|
|
2016-08-12 02:51:57 +08:00
|
|
|
peer_free_data(&server);
|
|
|
|
peer_free_data(&client);
|
2016-03-17 22:14:30 +08:00
|
|
|
return ret;
|
|
|
|
}
|
2016-07-06 01:06:23 +08:00
|
|
|
|
|
|
|
HANDSHAKE_RESULT *do_handshake(SSL_CTX *server_ctx, SSL_CTX *server2_ctx,
|
|
|
|
SSL_CTX *client_ctx, SSL_CTX *resume_server_ctx,
|
2016-07-21 20:04:00 +08:00
|
|
|
SSL_CTX *resume_client_ctx,
|
2016-07-06 01:06:23 +08:00
|
|
|
const SSL_TEST_CTX *test_ctx)
|
|
|
|
{
|
|
|
|
HANDSHAKE_RESULT *result;
|
|
|
|
SSL_SESSION *session = NULL;
|
|
|
|
|
|
|
|
result = do_handshake_internal(server_ctx, server2_ctx, client_ctx,
|
2016-08-16 21:11:08 +08:00
|
|
|
test_ctx, &test_ctx->extra,
|
2016-08-12 02:51:57 +08:00
|
|
|
NULL, &session);
|
2016-09-27 00:25:43 +08:00
|
|
|
if (test_ctx->handshake_mode != SSL_TEST_HANDSHAKE_RESUME)
|
2016-07-06 01:06:23 +08:00
|
|
|
goto end;
|
|
|
|
|
|
|
|
if (result->result != SSL_TEST_SUCCESS) {
|
|
|
|
result->result = SSL_TEST_FIRST_HANDSHAKE_FAILED;
|
2016-08-12 02:51:57 +08:00
|
|
|
goto end;
|
2016-07-06 01:06:23 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
HANDSHAKE_RESULT_free(result);
|
|
|
|
/* We don't support SNI on second handshake yet, so server2_ctx is NULL. */
|
2016-07-21 20:04:00 +08:00
|
|
|
result = do_handshake_internal(resume_server_ctx, NULL, resume_client_ctx,
|
2016-08-16 21:11:08 +08:00
|
|
|
test_ctx, &test_ctx->resume_extra,
|
2016-08-12 02:51:57 +08:00
|
|
|
session, NULL);
|
2016-07-06 01:06:23 +08:00
|
|
|
end:
|
|
|
|
SSL_SESSION_free(session);
|
|
|
|
return result;
|
|
|
|
}
|