/* BEGIN_HEADER */ #include #include #include #include #include #include #include "test/certs.h" #if defined(MBEDTLS_SSL_CACHE_C) #include "mbedtls/ssl_cache.h" #endif #include #include "hash_info.h" #include #include enum { #define MBEDTLS_SSL_TLS1_3_LABEL( name, string ) \ tls13_label_ ## name, MBEDTLS_SSL_TLS1_3_LABEL_LIST #undef MBEDTLS_SSL_TLS1_3_LABEL }; typedef struct log_pattern { const char *pattern; size_t counter; } log_pattern; #if defined(MBEDTLS_X509_CRT_PARSE_C) static int rng_seed = 0xBEEF; static int rng_get( void *p_rng, unsigned char *output, size_t output_len ) { (void) p_rng; for( size_t i = 0; i < output_len; i++ ) output[i] = rand(); return 0; } #endif /* * This function can be passed to mbedtls to receive output logs from it. In * this case, it will count the instances of a log_pattern in the received * logged messages. */ void log_analyzer( void *ctx, int level, const char *file, int line, const char *str ) { log_pattern *p = (log_pattern *) ctx; (void) level; (void) line; (void) file; if( NULL != p && NULL != p->pattern && NULL != strstr( str, p->pattern ) ) { p->counter++; } } typedef struct handshake_test_options { const char *cipher; mbedtls_ssl_protocol_version client_min_version; mbedtls_ssl_protocol_version client_max_version; mbedtls_ssl_protocol_version server_min_version; mbedtls_ssl_protocol_version server_max_version; mbedtls_ssl_protocol_version expected_negotiated_version; int expected_handshake_result; int expected_ciphersuite; int pk_alg; int opaque_alg; int opaque_alg2; int opaque_usage; data_t *psk_str; int dtls; int srv_auth_mode; int serialize; int mfl; int cli_msg_len; int srv_msg_len; int expected_cli_fragments; int expected_srv_fragments; int renegotiate; int legacy_renegotiation; void *srv_log_obj; void *cli_log_obj; void (*srv_log_fun)(void *, int, const char *, int, const char *); void (*cli_log_fun)(void *, int, const char *, int, const char *); int resize_buffers; #if defined(MBEDTLS_SSL_CACHE_C) mbedtls_ssl_cache_context *cache; #endif } handshake_test_options; void init_handshake_options( handshake_test_options *opts ) { #if defined(MBEDTLS_X509_CRT_PARSE_C) srand( rng_seed ); rng_seed += 0xD0; #endif opts->cipher = ""; opts->client_min_version = MBEDTLS_SSL_VERSION_UNKNOWN; opts->client_max_version = MBEDTLS_SSL_VERSION_UNKNOWN; opts->server_min_version = MBEDTLS_SSL_VERSION_UNKNOWN; opts->server_max_version = MBEDTLS_SSL_VERSION_UNKNOWN; opts->expected_negotiated_version = MBEDTLS_SSL_VERSION_TLS1_2; opts->expected_handshake_result = 0; opts->expected_ciphersuite = 0; opts->pk_alg = MBEDTLS_PK_RSA; opts->opaque_alg = 0; opts->opaque_alg2 = 0; opts->opaque_usage = 0; opts->psk_str = NULL; opts->dtls = 0; opts->srv_auth_mode = MBEDTLS_SSL_VERIFY_NONE; opts->serialize = 0; opts->mfl = MBEDTLS_SSL_MAX_FRAG_LEN_NONE; opts->cli_msg_len = 100; opts->srv_msg_len = 100; opts->expected_cli_fragments = 1; opts->expected_srv_fragments = 1; opts->renegotiate = 0; opts->legacy_renegotiation = MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION; opts->srv_log_obj = NULL; opts->srv_log_obj = NULL; opts->srv_log_fun = NULL; opts->cli_log_fun = NULL; opts->resize_buffers = 1; #if defined(MBEDTLS_SSL_CACHE_C) opts->cache = NULL; ASSERT_ALLOC( opts->cache, sizeof( mbedtls_ssl_cache_context ) ); mbedtls_ssl_cache_init( opts->cache ); exit: return; #endif } void free_handshake_options( handshake_test_options *opts ) { #if defined(MBEDTLS_SSL_CACHE_C) mbedtls_ssl_cache_free( opts->cache ); mbedtls_free( opts->cache ); #else (void) opts; #endif } #if defined(MBEDTLS_TEST_HOOKS) static void set_chk_buf_ptr_args( mbedtls_ssl_chk_buf_ptr_args *args, unsigned char *cur, unsigned char *end, size_t need ) { args->cur = cur; args->end = end; args->need = need; } static void reset_chk_buf_ptr_args( mbedtls_ssl_chk_buf_ptr_args *args ) { memset( args, 0, sizeof( *args ) ); } #endif /* MBEDTLS_TEST_HOOKS */ /* * Buffer structure for custom I/O callbacks. */ typedef struct mbedtls_test_buffer { size_t start; size_t content_length; size_t capacity; unsigned char *buffer; } mbedtls_test_buffer; /* * Initialises \p buf. After calling this function it is safe to call * `mbedtls_test_buffer_free()` on \p buf. */ void mbedtls_test_buffer_init( mbedtls_test_buffer *buf ) { memset( buf, 0, sizeof( *buf ) ); } /* * Sets up \p buf. After calling this function it is safe to call * `mbedtls_test_buffer_put()` and `mbedtls_test_buffer_get()` on \p buf. */ int mbedtls_test_buffer_setup( mbedtls_test_buffer *buf, size_t capacity ) { buf->buffer = (unsigned char*) mbedtls_calloc( capacity, sizeof(unsigned char) ); if( NULL == buf->buffer ) return MBEDTLS_ERR_SSL_ALLOC_FAILED; buf->capacity = capacity; return 0; } void mbedtls_test_buffer_free( mbedtls_test_buffer *buf ) { if( buf->buffer != NULL ) mbedtls_free( buf->buffer ); memset( buf, 0, sizeof( *buf ) ); } /* * Puts \p input_len bytes from the \p input buffer into the ring buffer \p buf. * * \p buf must have been initialized and set up by calling * `mbedtls_test_buffer_init()` and `mbedtls_test_buffer_setup()`. * * \retval \p input_len, if the data fits. * \retval 0 <= value < \p input_len, if the data does not fit. * \retval -1, if \p buf is NULL, it hasn't been set up or \p input_len is not * zero and \p input is NULL. */ int mbedtls_test_buffer_put( mbedtls_test_buffer *buf, const unsigned char *input, size_t input_len ) { size_t overflow = 0; if( ( buf == NULL ) || ( buf->buffer == NULL ) ) return -1; /* Reduce input_len to a number that fits in the buffer. */ if ( ( buf->content_length + input_len ) > buf->capacity ) { input_len = buf->capacity - buf->content_length; } if( input == NULL ) { return ( input_len == 0 ) ? 0 : -1; } /* Check if the buffer has not come full circle and free space is not in * the middle */ if( buf->start + buf->content_length < buf->capacity ) { /* Calculate the number of bytes that need to be placed at lower memory * address */ if( buf->start + buf->content_length + input_len > buf->capacity ) { overflow = ( buf->start + buf->content_length + input_len ) % buf->capacity; } memcpy( buf->buffer + buf->start + buf->content_length, input, input_len - overflow ); memcpy( buf->buffer, input + input_len - overflow, overflow ); } else { /* The buffer has come full circle and free space is in the middle */ memcpy( buf->buffer + buf->start + buf->content_length - buf->capacity, input, input_len ); } buf->content_length += input_len; return input_len; } /* * Gets \p output_len bytes from the ring buffer \p buf into the * \p output buffer. The output buffer can be NULL, in this case a part of the * ring buffer will be dropped, if the requested length is available. * * \p buf must have been initialized and set up by calling * `mbedtls_test_buffer_init()` and `mbedtls_test_buffer_setup()`. * * \retval \p output_len, if the data is available. * \retval 0 <= value < \p output_len, if the data is not available. * \retval -1, if \buf is NULL or it hasn't been set up. */ int mbedtls_test_buffer_get( mbedtls_test_buffer *buf, unsigned char* output, size_t output_len ) { size_t overflow = 0; if( ( buf == NULL ) || ( buf->buffer == NULL ) ) return -1; if( output == NULL && output_len == 0 ) return 0; if( buf->content_length < output_len ) output_len = buf->content_length; /* Calculate the number of bytes that need to be drawn from lower memory * address */ if( buf->start + output_len > buf->capacity ) { overflow = ( buf->start + output_len ) % buf->capacity; } if( output != NULL ) { memcpy( output, buf->buffer + buf->start, output_len - overflow ); memcpy( output + output_len - overflow, buf->buffer, overflow ); } buf->content_length -= output_len; buf->start = ( buf->start + output_len ) % buf->capacity; return output_len; } /* * Errors used in the message transport mock tests */ #define MBEDTLS_TEST_ERROR_ARG_NULL -11 #define MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED -44 /* * Context for a message metadata queue (fifo) that is on top of the ring buffer. */ typedef struct mbedtls_test_message_queue { size_t *messages; int pos; int num; int capacity; } mbedtls_test_message_queue; /* * Setup and free functions for the message metadata queue. * * \p capacity describes the number of message metadata chunks that can be held * within the queue. * * \retval 0, if a metadata queue of a given length can be allocated. * \retval MBEDTLS_ERR_SSL_ALLOC_FAILED, if allocation failed. */ int mbedtls_test_message_queue_setup( mbedtls_test_message_queue *queue, size_t capacity ) { queue->messages = (size_t*) mbedtls_calloc( capacity, sizeof(size_t) ); if( NULL == queue->messages ) return MBEDTLS_ERR_SSL_ALLOC_FAILED; queue->capacity = capacity; queue->pos = 0; queue->num = 0; return 0; } void mbedtls_test_message_queue_free( mbedtls_test_message_queue *queue ) { if( queue == NULL ) return; if( queue->messages != NULL ) mbedtls_free( queue->messages ); memset( queue, 0, sizeof( *queue ) ); } /* * Push message length information onto the message metadata queue. * This will become the last element to leave it (fifo). * * \retval MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null. * \retval MBEDTLS_ERR_SSL_WANT_WRITE, if the queue is full. * \retval \p len, if the push was successful. */ int mbedtls_test_message_queue_push_info( mbedtls_test_message_queue *queue, size_t len ) { int place; if( queue == NULL ) return MBEDTLS_TEST_ERROR_ARG_NULL; if( queue->num >= queue->capacity ) return MBEDTLS_ERR_SSL_WANT_WRITE; place = ( queue->pos + queue->num ) % queue->capacity; queue->messages[place] = len; queue->num++; return len; } /* * Pop information about the next message length from the queue. This will be * the oldest inserted message length(fifo). \p msg_len can be null, in which * case the data will be popped from the queue but not copied anywhere. * * \retval MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null. * \retval MBEDTLS_ERR_SSL_WANT_READ, if the queue is empty. * \retval message length, if the pop was successful, up to the given \p buf_len. */ int mbedtls_test_message_queue_pop_info( mbedtls_test_message_queue *queue, size_t buf_len ) { size_t message_length; if( queue == NULL ) return MBEDTLS_TEST_ERROR_ARG_NULL; if( queue->num == 0 ) return MBEDTLS_ERR_SSL_WANT_READ; message_length = queue->messages[queue->pos]; queue->messages[queue->pos] = 0; queue->num--; queue->pos++; queue->pos %= queue->capacity; if( queue->pos < 0 ) queue->pos += queue->capacity; return ( message_length > buf_len ) ? buf_len : message_length; } /* * Take a peek on the info about the next message length from the queue. * This will be the oldest inserted message length(fifo). * * \retval MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null. * \retval MBEDTLS_ERR_SSL_WANT_READ, if the queue is empty. * \retval 0, if the peek was successful. * \retval MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED, if the given buffer length is * too small to fit the message. In this case the \p msg_len will be * set to the full message length so that the * caller knows what portion of the message can be dropped. */ int mbedtls_test_message_queue_peek_info( mbedtls_test_message_queue *queue, size_t buf_len, size_t* msg_len ) { if( queue == NULL || msg_len == NULL ) return MBEDTLS_TEST_ERROR_ARG_NULL; if( queue->num == 0 ) return MBEDTLS_ERR_SSL_WANT_READ; *msg_len = queue->messages[queue->pos]; return ( *msg_len > buf_len ) ? MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED : 0; } /* * Context for the I/O callbacks simulating network connection. */ #define MBEDTLS_MOCK_SOCKET_CONNECTED 1 typedef struct mbedtls_mock_socket { int status; mbedtls_test_buffer *input; mbedtls_test_buffer *output; struct mbedtls_mock_socket *peer; } mbedtls_mock_socket; /* * Setup and teardown functions for mock sockets. */ void mbedtls_mock_socket_init( mbedtls_mock_socket *socket ) { memset( socket, 0, sizeof( *socket ) ); } /* * Closes the socket \p socket. * * \p socket must have been previously initialized by calling * mbedtls_mock_socket_init(). * * This function frees all allocated resources and both sockets are aware of the * new connection state. * * That is, this function does not simulate half-open TCP connections and the * phenomenon that when closing a UDP connection the peer is not aware of the * connection having been closed. */ void mbedtls_mock_socket_close( mbedtls_mock_socket* socket ) { if( socket == NULL ) return; if( socket->input != NULL ) { mbedtls_test_buffer_free( socket->input ); mbedtls_free( socket->input ); } if( socket->output != NULL ) { mbedtls_test_buffer_free( socket->output ); mbedtls_free( socket->output ); } if( socket->peer != NULL ) memset( socket->peer, 0, sizeof( *socket->peer ) ); memset( socket, 0, sizeof( *socket ) ); } /* * Establishes a connection between \p peer1 and \p peer2. * * \p peer1 and \p peer2 must have been previously initialized by calling * mbedtls_mock_socket_init(). * * The capacites of the internal buffers are set to \p bufsize. Setting this to * the correct value allows for simulation of MTU, sanity testing the mock * implementation and mocking TCP connections with lower memory cost. */ int mbedtls_mock_socket_connect( mbedtls_mock_socket* peer1, mbedtls_mock_socket* peer2, size_t bufsize ) { int ret = -1; peer1->output = (mbedtls_test_buffer*) mbedtls_calloc( 1, sizeof(mbedtls_test_buffer) ); if( peer1->output == NULL ) { ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; goto exit; } mbedtls_test_buffer_init( peer1->output ); if( 0 != ( ret = mbedtls_test_buffer_setup( peer1->output, bufsize ) ) ) { goto exit; } peer2->output = (mbedtls_test_buffer*) mbedtls_calloc( 1, sizeof(mbedtls_test_buffer) ); if( peer2->output == NULL ) { ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; goto exit; } mbedtls_test_buffer_init( peer2->output ); if( 0 != ( ret = mbedtls_test_buffer_setup( peer2->output, bufsize ) ) ) { goto exit; } peer1->peer = peer2; peer2->peer = peer1; peer1->input = peer2->output; peer2->input = peer1->output; peer1->status = peer2->status = MBEDTLS_MOCK_SOCKET_CONNECTED; ret = 0; exit: if( ret != 0 ) { mbedtls_mock_socket_close( peer1 ); mbedtls_mock_socket_close( peer2 ); } return ret; } /* * Callbacks for simulating blocking I/O over connection-oriented transport. */ int mbedtls_mock_tcp_send_b( void *ctx, const unsigned char *buf, size_t len ) { mbedtls_mock_socket *socket = (mbedtls_mock_socket*) ctx; if( socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED ) return -1; return mbedtls_test_buffer_put( socket->output, buf, len ); } int mbedtls_mock_tcp_recv_b( void *ctx, unsigned char *buf, size_t len ) { mbedtls_mock_socket *socket = (mbedtls_mock_socket*) ctx; if( socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED ) return -1; return mbedtls_test_buffer_get( socket->input, buf, len ); } /* * Callbacks for simulating non-blocking I/O over connection-oriented transport. */ int mbedtls_mock_tcp_send_nb( void *ctx, const unsigned char *buf, size_t len ) { mbedtls_mock_socket *socket = (mbedtls_mock_socket*) ctx; if( socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED ) return -1; if( socket->output->capacity == socket->output->content_length ) { return MBEDTLS_ERR_SSL_WANT_WRITE; } return mbedtls_test_buffer_put( socket->output, buf, len ); } int mbedtls_mock_tcp_recv_nb( void *ctx, unsigned char *buf, size_t len ) { mbedtls_mock_socket *socket = (mbedtls_mock_socket*) ctx; if( socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED ) return -1; if( socket->input->content_length == 0 ) { return MBEDTLS_ERR_SSL_WANT_READ; } return mbedtls_test_buffer_get( socket->input, buf, len ); } /* Errors used in the message socket mocks */ #define MBEDTLS_TEST_ERROR_CONTEXT_ERROR -55 #define MBEDTLS_TEST_ERROR_SEND_FAILED -66 #define MBEDTLS_TEST_ERROR_RECV_FAILED -77 /* * Structure used as an addon, or a wrapper, around the mocked sockets. * Contains an input queue, to which the other socket pushes metadata, * and an output queue, to which this one pushes metadata. This context is * considered as an owner of the input queue only, which is initialized and * freed in the respective setup and free calls. */ typedef struct mbedtls_test_message_socket_context { mbedtls_test_message_queue* queue_input; mbedtls_test_message_queue* queue_output; mbedtls_mock_socket* socket; } mbedtls_test_message_socket_context; void mbedtls_message_socket_init( mbedtls_test_message_socket_context *ctx ) { ctx->queue_input = NULL; ctx->queue_output = NULL; ctx->socket = NULL; } /* * Setup a given mesasge socket context including initialization of * input/output queues to a chosen capacity of messages. Also set the * corresponding mock socket. * * \retval 0, if everything succeeds. * \retval MBEDTLS_ERR_SSL_ALLOC_FAILED, if allocation of a message * queue failed. */ int mbedtls_message_socket_setup( mbedtls_test_message_queue* queue_input, mbedtls_test_message_queue* queue_output, size_t queue_capacity, mbedtls_mock_socket* socket, mbedtls_test_message_socket_context* ctx ) { int ret = mbedtls_test_message_queue_setup( queue_input, queue_capacity ); if( ret != 0 ) return ret; ctx->queue_input = queue_input; ctx->queue_output = queue_output; ctx->socket = socket; mbedtls_mock_socket_init( socket ); return 0; } /* * Close a given message socket context, along with the socket itself. Free the * memory allocated by the input queue. */ void mbedtls_message_socket_close( mbedtls_test_message_socket_context* ctx ) { if( ctx == NULL ) return; mbedtls_test_message_queue_free( ctx->queue_input ); mbedtls_mock_socket_close( ctx->socket ); memset( ctx, 0, sizeof( *ctx ) ); } /* * Send one message through a given message socket context. * * \retval \p len, if everything succeeds. * \retval MBEDTLS_TEST_ERROR_CONTEXT_ERROR, if any of the needed context * elements or the context itself is null. * \retval MBEDTLS_TEST_ERROR_SEND_FAILED if mbedtls_mock_tcp_send_b failed. * \retval MBEDTLS_ERR_SSL_WANT_WRITE, if the output queue is full. * * This function will also return any error from * mbedtls_test_message_queue_push_info. */ int mbedtls_mock_tcp_send_msg( void *ctx, const unsigned char *buf, size_t len ) { mbedtls_test_message_queue* queue; mbedtls_mock_socket* socket; mbedtls_test_message_socket_context *context = (mbedtls_test_message_socket_context*) ctx; if( context == NULL || context->socket == NULL || context->queue_output == NULL ) { return MBEDTLS_TEST_ERROR_CONTEXT_ERROR; } queue = context->queue_output; socket = context->socket; if( queue->num >= queue->capacity ) return MBEDTLS_ERR_SSL_WANT_WRITE; if( mbedtls_mock_tcp_send_b( socket, buf, len ) != (int) len ) return MBEDTLS_TEST_ERROR_SEND_FAILED; return mbedtls_test_message_queue_push_info( queue, len ); } /* * Receive one message from a given message socket context and return message * length or an error. * * \retval message length, if everything succeeds. * \retval MBEDTLS_TEST_ERROR_CONTEXT_ERROR, if any of the needed context * elements or the context itself is null. * \retval MBEDTLS_TEST_ERROR_RECV_FAILED if mbedtls_mock_tcp_recv_b failed. * * This function will also return any error other than * MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED from mbedtls_test_message_queue_peek_info. */ int mbedtls_mock_tcp_recv_msg( void *ctx, unsigned char *buf, size_t buf_len ) { mbedtls_test_message_queue* queue; mbedtls_mock_socket* socket; mbedtls_test_message_socket_context *context = (mbedtls_test_message_socket_context*) ctx; size_t drop_len = 0; size_t msg_len; int ret; if( context == NULL || context->socket == NULL || context->queue_input == NULL ) { return MBEDTLS_TEST_ERROR_CONTEXT_ERROR; } queue = context->queue_input; socket = context->socket; /* Peek first, so that in case of a socket error the data remains in * the queue. */ ret = mbedtls_test_message_queue_peek_info( queue, buf_len, &msg_len ); if( ret == MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED ) { /* Calculate how much to drop */ drop_len = msg_len - buf_len; /* Set the requested message len to be buffer length */ msg_len = buf_len; } else if( ret != 0 ) { return ret; } if( mbedtls_mock_tcp_recv_b( socket, buf, msg_len ) != (int) msg_len ) return MBEDTLS_TEST_ERROR_RECV_FAILED; if( ret == MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED ) { /* Drop the remaining part of the message */ if( mbedtls_mock_tcp_recv_b( socket, NULL, drop_len ) != (int) drop_len ) { /* Inconsistent state - part of the message was read, * and a part couldn't. Not much we can do here, but it should not * happen in test environment, unless forced manually. */ } } mbedtls_test_message_queue_pop_info( queue, buf_len ); return msg_len; } #if defined(MBEDTLS_X509_CRT_PARSE_C) /* * Structure with endpoint's certificates for SSL communication tests. */ typedef struct mbedtls_endpoint_certificate { mbedtls_x509_crt ca_cert; mbedtls_x509_crt cert; mbedtls_pk_context pkey; } mbedtls_endpoint_certificate; /* * Endpoint structure for SSL communication tests. */ typedef struct mbedtls_endpoint { const char *name; mbedtls_ssl_context ssl; mbedtls_ssl_config conf; mbedtls_mock_socket socket; mbedtls_endpoint_certificate cert; } mbedtls_endpoint; /* * Initializes \p ep_cert structure and assigns it to endpoint * represented by \p ep. * * \retval 0 on success, otherwise error code. */ int mbedtls_endpoint_certificate_init( mbedtls_endpoint *ep, int pk_alg, int opaque_alg, int opaque_alg2, int opaque_usage ) { int i = 0; int ret = -1; mbedtls_endpoint_certificate *cert; #if defined(MBEDTLS_USE_PSA_CRYPTO) mbedtls_svc_key_id_t key_slot = MBEDTLS_SVC_KEY_ID_INIT; #endif if( ep == NULL ) { return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; } cert = &( ep->cert ); mbedtls_x509_crt_init( &( cert->ca_cert ) ); mbedtls_x509_crt_init( &( cert->cert ) ); mbedtls_pk_init( &( cert->pkey ) ); /* Load the trusted CA */ for( i = 0; mbedtls_test_cas_der[i] != NULL; i++ ) { ret = mbedtls_x509_crt_parse_der( &( cert->ca_cert ), (const unsigned char *) mbedtls_test_cas_der[i], mbedtls_test_cas_der_len[i] ); TEST_ASSERT( ret == 0 ); } /* Load own certificate and private key */ if( ep->conf.endpoint == MBEDTLS_SSL_IS_SERVER ) { if( pk_alg == MBEDTLS_PK_RSA ) { ret = mbedtls_x509_crt_parse( &( cert->cert ), (const unsigned char*) mbedtls_test_srv_crt_rsa_sha256_der, mbedtls_test_srv_crt_rsa_sha256_der_len ); TEST_ASSERT( ret == 0 ); ret = mbedtls_pk_parse_key( &( cert->pkey ), (const unsigned char*) mbedtls_test_srv_key_rsa_der, mbedtls_test_srv_key_rsa_der_len, NULL, 0, mbedtls_test_rnd_std_rand, NULL ); TEST_ASSERT( ret == 0 ); } else { ret = mbedtls_x509_crt_parse( &( cert->cert ), (const unsigned char*) mbedtls_test_srv_crt_ec_der, mbedtls_test_srv_crt_ec_der_len ); TEST_ASSERT( ret == 0 ); ret = mbedtls_pk_parse_key( &( cert->pkey ), (const unsigned char*) mbedtls_test_srv_key_ec_der, mbedtls_test_srv_key_ec_der_len, NULL, 0, mbedtls_test_rnd_std_rand, NULL ); TEST_ASSERT( ret == 0 ); } } else { if( pk_alg == MBEDTLS_PK_RSA ) { ret = mbedtls_x509_crt_parse( &( cert->cert ), (const unsigned char *) mbedtls_test_cli_crt_rsa_der, mbedtls_test_cli_crt_rsa_der_len ); TEST_ASSERT( ret == 0 ); ret = mbedtls_pk_parse_key( &( cert->pkey ), (const unsigned char *) mbedtls_test_cli_key_rsa_der, mbedtls_test_cli_key_rsa_der_len, NULL, 0, mbedtls_test_rnd_std_rand, NULL ); TEST_ASSERT( ret == 0 ); } else { ret = mbedtls_x509_crt_parse( &( cert->cert ), (const unsigned char *) mbedtls_test_cli_crt_ec_der, mbedtls_test_cli_crt_ec_len ); TEST_ASSERT( ret == 0 ); ret = mbedtls_pk_parse_key( &( cert->pkey ), (const unsigned char *) mbedtls_test_cli_key_ec_der, mbedtls_test_cli_key_ec_der_len, NULL, 0, mbedtls_test_rnd_std_rand, NULL ); TEST_ASSERT( ret == 0 ); } } #if defined(MBEDTLS_USE_PSA_CRYPTO) if( opaque_alg != 0 ) { TEST_EQUAL( mbedtls_pk_wrap_as_opaque( &( cert->pkey ), &key_slot, opaque_alg, opaque_usage, opaque_alg2 ), 0 ); } #else (void) opaque_alg; (void) opaque_alg2; (void) opaque_usage; #endif mbedtls_ssl_conf_ca_chain( &( ep->conf ), &( cert->ca_cert ), NULL ); ret = mbedtls_ssl_conf_own_cert( &( ep->conf ), &( cert->cert ), &( cert->pkey ) ); TEST_ASSERT( ret == 0 ); TEST_ASSERT( ep->conf.key_cert != NULL ); ret = mbedtls_ssl_conf_own_cert( &( ep->conf ), NULL, NULL ); TEST_ASSERT( ret == 0 ); TEST_ASSERT( ep->conf.key_cert == NULL ); ret = mbedtls_ssl_conf_own_cert( &( ep->conf ), &( cert->cert ), &( cert->pkey ) ); TEST_ASSERT( ret == 0 ); exit: if( ret != 0 ) { mbedtls_x509_crt_free( &( cert->ca_cert ) ); mbedtls_x509_crt_free( &( cert->cert ) ); #if defined(MBEDTLS_USE_PSA_CRYPTO) if( opaque_alg != 0 ) psa_destroy_key( key_slot ); #endif mbedtls_pk_free( &( cert->pkey ) ); } return ret; } /* * Initializes \p ep structure. It is important to call `mbedtls_endpoint_free()` * after calling this function even if it fails. * * \p endpoint_type must be set as MBEDTLS_SSL_IS_SERVER or * MBEDTLS_SSL_IS_CLIENT. * \p pk_alg the algorithm to use, currently only MBEDTLS_PK_RSA and * MBEDTLS_PK_ECDSA are supported. * \p dtls_context - in case of DTLS - this is the context handling metadata. * \p input_queue - used only in case of DTLS. * \p output_queue - used only in case of DTLS. * * \retval 0 on success, otherwise error code. */ int mbedtls_endpoint_init( mbedtls_endpoint *ep, int endpoint_type, handshake_test_options *options, mbedtls_test_message_socket_context *dtls_context, mbedtls_test_message_queue *input_queue, mbedtls_test_message_queue *output_queue, uint16_t* group_list ) { int ret = -1; uintptr_t user_data_n; if( dtls_context != NULL && ( input_queue == NULL || output_queue == NULL ) ) return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; if( ep == NULL ) return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; memset( ep, 0, sizeof( *ep ) ); ep->name = ( endpoint_type == MBEDTLS_SSL_IS_SERVER ) ? "Server" : "Client"; mbedtls_ssl_init( &( ep->ssl ) ); mbedtls_ssl_config_init( &( ep->conf ) ); mbedtls_ssl_conf_rng( &( ep->conf ), rng_get, NULL ); TEST_ASSERT( mbedtls_ssl_conf_get_user_data_p( &ep->conf ) == NULL ); TEST_EQUAL( mbedtls_ssl_conf_get_user_data_n( &ep->conf ), 0 ); TEST_ASSERT( mbedtls_ssl_get_user_data_p( &ep->ssl ) == NULL ); TEST_EQUAL( mbedtls_ssl_get_user_data_n( &ep->ssl ), 0 ); (void) mbedtls_test_rnd_std_rand( NULL, (void*) &user_data_n, sizeof( user_data_n ) ); mbedtls_ssl_conf_set_user_data_n( &ep->conf, user_data_n ); mbedtls_ssl_set_user_data_n( &ep->ssl, user_data_n ); if( dtls_context != NULL ) { TEST_ASSERT( mbedtls_message_socket_setup( input_queue, output_queue, 100, &( ep->socket ), dtls_context ) == 0 ); } else { mbedtls_mock_socket_init( &( ep->socket ) ); } /* Non-blocking callbacks without timeout */ if( dtls_context != NULL ) { mbedtls_ssl_set_bio( &( ep->ssl ), dtls_context, mbedtls_mock_tcp_send_msg, mbedtls_mock_tcp_recv_msg, NULL ); } else { mbedtls_ssl_set_bio( &( ep->ssl ), &( ep->socket ), mbedtls_mock_tcp_send_nb, mbedtls_mock_tcp_recv_nb, NULL ); } ret = mbedtls_ssl_config_defaults( &( ep->conf ), endpoint_type, ( dtls_context != NULL ) ? MBEDTLS_SSL_TRANSPORT_DATAGRAM : MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT ); TEST_ASSERT( ret == 0 ); if( group_list != NULL ) mbedtls_ssl_conf_groups( &(ep->conf), group_list ); mbedtls_ssl_conf_authmode( &( ep->conf ), MBEDTLS_SSL_VERIFY_REQUIRED ); #if defined(MBEDTLS_SSL_CACHE_C) && defined(MBEDTLS_SSL_SRV_C) if( endpoint_type == MBEDTLS_SSL_IS_SERVER && options->cache != NULL ) { mbedtls_ssl_conf_session_cache( &( ep->conf ), options->cache, mbedtls_ssl_cache_get, mbedtls_ssl_cache_set ); } #endif ret = mbedtls_ssl_setup( &( ep->ssl ), &( ep->conf ) ); TEST_ASSERT( ret == 0 ); #if defined(MBEDTLS_SSL_PROTO_DTLS) && defined(MBEDTLS_SSL_SRV_C) if( endpoint_type == MBEDTLS_SSL_IS_SERVER && dtls_context != NULL ) mbedtls_ssl_conf_dtls_cookies( &( ep->conf ), NULL, NULL, NULL ); #endif ret = mbedtls_endpoint_certificate_init( ep, options->pk_alg, options->opaque_alg, options->opaque_alg2, options->opaque_usage ); TEST_ASSERT( ret == 0 ); TEST_EQUAL( mbedtls_ssl_conf_get_user_data_n( &ep->conf ), user_data_n ); mbedtls_ssl_conf_set_user_data_p( &ep->conf, ep ); TEST_EQUAL( mbedtls_ssl_get_user_data_n( &ep->ssl ), user_data_n ); mbedtls_ssl_set_user_data_p( &ep->ssl, ep ); exit: return ret; } /* * Deinitializes certificates from endpoint represented by \p ep. */ void mbedtls_endpoint_certificate_free( mbedtls_endpoint *ep ) { mbedtls_endpoint_certificate *cert = &( ep->cert ); mbedtls_x509_crt_free( &( cert->ca_cert ) ); mbedtls_x509_crt_free( &( cert->cert ) ); #if defined(MBEDTLS_USE_PSA_CRYPTO) if( mbedtls_pk_get_type( &( cert->pkey ) ) == MBEDTLS_PK_OPAQUE ) { mbedtls_svc_key_id_t *key_slot = cert->pkey.pk_ctx; psa_destroy_key( *key_slot ); } #endif mbedtls_pk_free( &( cert->pkey ) ); } /* * Deinitializes endpoint represented by \p ep. */ void mbedtls_endpoint_free( mbedtls_endpoint *ep, mbedtls_test_message_socket_context *context ) { mbedtls_endpoint_certificate_free( ep ); mbedtls_ssl_free( &( ep->ssl ) ); mbedtls_ssl_config_free( &( ep->conf ) ); if( context != NULL ) { mbedtls_message_socket_close( context ); } else { mbedtls_mock_socket_close( &( ep->socket ) ); } } /* * This function moves ssl handshake from \p ssl to prescribed \p state. * /p second_ssl is used as second endpoint and their sockets have to be * connected before calling this function. * * \retval 0 on success, otherwise error code. */ int mbedtls_move_handshake_to_state( mbedtls_ssl_context *ssl, mbedtls_ssl_context *second_ssl, int state ) { enum { BUFFSIZE = 1024 }; int max_steps = 1000; int ret = 0; if( ssl == NULL || second_ssl == NULL ) { return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; } /* Perform communication via connected sockets */ while( ( ssl->state != state ) && ( --max_steps >= 0 ) ) { /* If /p second_ssl ends the handshake procedure before /p ssl then * there is no need to call the next step */ if( !mbedtls_ssl_is_handshake_over( second_ssl ) ) { ret = mbedtls_ssl_handshake_step( second_ssl ); if( ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE ) { return ret; } } /* We only care about the \p ssl state and returns, so we call it last, * to leave the iteration as soon as the state is as expected. */ ret = mbedtls_ssl_handshake_step( ssl ); if( ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE ) { return ret; } } return ( max_steps >= 0 ) ? ret : -1; } #endif /* MBEDTLS_X509_CRT_PARSE_C */ /* * Write application data. Increase write counter if necessary. */ int mbedtls_ssl_write_fragment( mbedtls_ssl_context *ssl, unsigned char *buf, int buf_len, int *written, const int expected_fragments ) { int ret = mbedtls_ssl_write( ssl, buf + *written, buf_len - *written ); if( ret > 0 ) { *written += ret; } if( expected_fragments == 0 ) { /* Used for DTLS and the message size larger than MFL. In that case * the message can not be fragmented and the library should return * MBEDTLS_ERR_SSL_BAD_INPUT_DATA error. This error must be returned * to prevent a dead loop inside mbedtls_exchange_data(). */ return ret; } else if( expected_fragments == 1 ) { /* Used for TLS/DTLS and the message size lower than MFL */ TEST_ASSERT( ret == buf_len || ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE ); } else { /* Used for TLS and the message size larger than MFL */ TEST_ASSERT( expected_fragments > 1 ); TEST_ASSERT( ( ret >= 0 && ret <= buf_len ) || ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE ); } return 0; exit: /* Some of the tests failed */ return -1; } /* * Read application data and increase read counter and fragments counter if necessary. */ int mbedtls_ssl_read_fragment( mbedtls_ssl_context *ssl, unsigned char *buf, int buf_len, int *read, int *fragments, const int expected_fragments ) { int ret = mbedtls_ssl_read( ssl, buf + *read, buf_len - *read ); if( ret > 0 ) { ( *fragments )++; *read += ret; } if( expected_fragments == 0 ) { TEST_ASSERT( ret == 0 ); } else if( expected_fragments == 1 ) { TEST_ASSERT( ret == buf_len || ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE ); } else { TEST_ASSERT( expected_fragments > 1 ); TEST_ASSERT( ( ret >= 0 && ret <= buf_len ) || ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE ); } return 0; exit: /* Some of the tests failed */ return -1; } /* * Helper function setting up inverse record transformations * using given cipher, hash, EtM mode, authentication tag length, * and version. */ #define CHK( x ) \ do \ { \ if( !( x ) ) \ { \ ret = -1; \ goto cleanup; \ } \ } while( 0 ) void set_ciphersuite( mbedtls_ssl_config *conf, const char *cipher, int* forced_ciphersuite ) { const mbedtls_ssl_ciphersuite_t *ciphersuite_info; forced_ciphersuite[0] = mbedtls_ssl_get_ciphersuite_id( cipher ); forced_ciphersuite[1] = 0; ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( forced_ciphersuite[0] ); TEST_ASSERT( ciphersuite_info != NULL ); TEST_ASSERT( ciphersuite_info->min_tls_version <= conf->max_tls_version ); TEST_ASSERT( ciphersuite_info->max_tls_version >= conf->min_tls_version ); if( conf->max_tls_version > ciphersuite_info->max_tls_version ) { conf->max_tls_version = ciphersuite_info->max_tls_version; } if( conf->min_tls_version < ciphersuite_info->min_tls_version ) { conf->min_tls_version = ciphersuite_info->min_tls_version; } mbedtls_ssl_conf_ciphersuites( conf, forced_ciphersuite ); exit: return; } int psk_dummy_callback( void *p_info, mbedtls_ssl_context *ssl, const unsigned char *name, size_t name_len ) { (void) p_info; (void) ssl; (void) name; (void) name_len; return ( 0 ); } #if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX #define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_IN_LEN_MAX #else #define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_OUT_LEN_MAX #endif #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ defined(MBEDTLS_CIPHER_MODE_CBC) && defined(MBEDTLS_AES_C) static int psa_cipher_encrypt_helper( mbedtls_ssl_transform *transform, const unsigned char *iv, size_t iv_len, const unsigned char *input, size_t ilen, unsigned char *output, size_t *olen ) { #if defined(MBEDTLS_USE_PSA_CRYPTO) psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT; size_t part_len; status = psa_cipher_encrypt_setup( &cipher_op, transform->psa_key_enc, transform->psa_alg ); if( status != PSA_SUCCESS ) return( psa_ssl_status_to_mbedtls( status ) ); status = psa_cipher_set_iv( &cipher_op, iv, iv_len ); if( status != PSA_SUCCESS ) return( psa_ssl_status_to_mbedtls( status ) ); status = psa_cipher_update( &cipher_op, input, ilen, output, ilen, olen ); if( status != PSA_SUCCESS ) return( psa_ssl_status_to_mbedtls( status ) ); status = psa_cipher_finish( &cipher_op, output + *olen, ilen - *olen, &part_len ); if( status != PSA_SUCCESS ) return( psa_ssl_status_to_mbedtls( status ) ); *olen += part_len; return( 0 ); #else return mbedtls_cipher_crypt( &transform->cipher_ctx_enc, iv, iv_len, input, ilen, output, olen ); #endif /* MBEDTLS_USE_PSA_CRYPTO */ } #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_CIPHER_MODE_CBC && MBEDTLS_AES_C */ static int build_transforms( mbedtls_ssl_transform *t_in, mbedtls_ssl_transform *t_out, int cipher_type, int hash_id, int etm, int tag_mode, mbedtls_ssl_protocol_version tls_version, size_t cid0_len, size_t cid1_len ) { mbedtls_cipher_info_t const *cipher_info; int ret = 0; #if defined(MBEDTLS_USE_PSA_CRYPTO) psa_key_type_t key_type; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_algorithm_t alg; size_t key_bits; psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; #endif size_t keylen, maclen, ivlen; unsigned char *key0 = NULL, *key1 = NULL; unsigned char *md0 = NULL, *md1 = NULL; unsigned char iv_enc[16], iv_dec[16]; #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) unsigned char cid0[ SSL_CID_LEN_MIN ]; unsigned char cid1[ SSL_CID_LEN_MIN ]; mbedtls_test_rnd_std_rand( NULL, cid0, sizeof( cid0 ) ); mbedtls_test_rnd_std_rand( NULL, cid1, sizeof( cid1 ) ); #else ((void) cid0_len); ((void) cid1_len); #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ maclen = 0; /* Pick cipher */ cipher_info = mbedtls_cipher_info_from_type( cipher_type ); CHK( cipher_info != NULL ); CHK( cipher_info->iv_size <= 16 ); CHK( cipher_info->key_bitlen % 8 == 0 ); /* Pick keys */ keylen = cipher_info->key_bitlen / 8; /* Allocate `keylen + 1` bytes to ensure that we get * a non-NULL pointers from `mbedtls_calloc` even if * `keylen == 0` in the case of the NULL cipher. */ CHK( ( key0 = mbedtls_calloc( 1, keylen + 1 ) ) != NULL ); CHK( ( key1 = mbedtls_calloc( 1, keylen + 1 ) ) != NULL ); memset( key0, 0x1, keylen ); memset( key1, 0x2, keylen ); #if !defined(MBEDTLS_USE_PSA_CRYPTO) /* Setup cipher contexts */ CHK( mbedtls_cipher_setup( &t_in->cipher_ctx_enc, cipher_info ) == 0 ); CHK( mbedtls_cipher_setup( &t_in->cipher_ctx_dec, cipher_info ) == 0 ); CHK( mbedtls_cipher_setup( &t_out->cipher_ctx_enc, cipher_info ) == 0 ); CHK( mbedtls_cipher_setup( &t_out->cipher_ctx_dec, cipher_info ) == 0 ); #if defined(MBEDTLS_CIPHER_MODE_CBC) if( cipher_info->mode == MBEDTLS_MODE_CBC ) { CHK( mbedtls_cipher_set_padding_mode( &t_in->cipher_ctx_enc, MBEDTLS_PADDING_NONE ) == 0 ); CHK( mbedtls_cipher_set_padding_mode( &t_in->cipher_ctx_dec, MBEDTLS_PADDING_NONE ) == 0 ); CHK( mbedtls_cipher_set_padding_mode( &t_out->cipher_ctx_enc, MBEDTLS_PADDING_NONE ) == 0 ); CHK( mbedtls_cipher_set_padding_mode( &t_out->cipher_ctx_dec, MBEDTLS_PADDING_NONE ) == 0 ); } #endif /* MBEDTLS_CIPHER_MODE_CBC */ CHK( mbedtls_cipher_setkey( &t_in->cipher_ctx_enc, key0, keylen << 3, MBEDTLS_ENCRYPT ) == 0 ); CHK( mbedtls_cipher_setkey( &t_in->cipher_ctx_dec, key1, keylen << 3, MBEDTLS_DECRYPT ) == 0 ); CHK( mbedtls_cipher_setkey( &t_out->cipher_ctx_enc, key1, keylen << 3, MBEDTLS_ENCRYPT ) == 0 ); CHK( mbedtls_cipher_setkey( &t_out->cipher_ctx_dec, key0, keylen << 3, MBEDTLS_DECRYPT ) == 0 ); #endif /* Setup MAC contexts */ #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) if( cipher_info->mode == MBEDTLS_MODE_CBC || cipher_info->mode == MBEDTLS_MODE_STREAM ) { #if !defined(MBEDTLS_USE_PSA_CRYPTO) mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type( hash_id ); CHK( md_info != NULL ); #endif maclen = mbedtls_hash_info_get_size( hash_id ); CHK( maclen != 0 ); /* Pick hash keys */ CHK( ( md0 = mbedtls_calloc( 1, maclen ) ) != NULL ); CHK( ( md1 = mbedtls_calloc( 1, maclen ) ) != NULL ); memset( md0, 0x5, maclen ); memset( md1, 0x6, maclen ); #if defined(MBEDTLS_USE_PSA_CRYPTO) alg = mbedtls_hash_info_psa_from_md( hash_id ); CHK( alg != 0 ); t_out->psa_mac_alg = PSA_ALG_HMAC( alg ); t_in->psa_mac_alg = PSA_ALG_HMAC( alg ); t_in->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT; t_out->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT; t_in->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT; t_out->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT; psa_reset_key_attributes( &attributes ); psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE ); psa_set_key_algorithm( &attributes, PSA_ALG_HMAC( alg ) ); psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC ); CHK( psa_import_key( &attributes, md0, maclen, &t_in->psa_mac_enc ) == PSA_SUCCESS ); CHK( psa_import_key( &attributes, md1, maclen, &t_out->psa_mac_enc ) == PSA_SUCCESS ); if( cipher_info->mode == MBEDTLS_MODE_STREAM || etm == MBEDTLS_SSL_ETM_DISABLED ) /* mbedtls_ct_hmac() requires the key to be exportable */ psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_VERIFY_HASH ); else psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH ); CHK( psa_import_key( &attributes, md1, maclen, &t_in->psa_mac_dec ) == PSA_SUCCESS ); CHK( psa_import_key( &attributes, md0, maclen, &t_out->psa_mac_dec ) == PSA_SUCCESS ); #else CHK( mbedtls_md_setup( &t_out->md_ctx_enc, md_info, 1 ) == 0 ); CHK( mbedtls_md_setup( &t_out->md_ctx_dec, md_info, 1 ) == 0 ); CHK( mbedtls_md_setup( &t_in->md_ctx_enc, md_info, 1 ) == 0 ); CHK( mbedtls_md_setup( &t_in->md_ctx_dec, md_info, 1 ) == 0 ); CHK( mbedtls_md_hmac_starts( &t_in->md_ctx_enc, md0, maclen ) == 0 ); CHK( mbedtls_md_hmac_starts( &t_in->md_ctx_dec, md1, maclen ) == 0 ); CHK( mbedtls_md_hmac_starts( &t_out->md_ctx_enc, md1, maclen ) == 0 ); CHK( mbedtls_md_hmac_starts( &t_out->md_ctx_dec, md0, maclen ) == 0 ); #endif } #else ((void) hash_id); #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */ /* Pick IV's (regardless of whether they * are being used by the transform). */ ivlen = cipher_info->iv_size; memset( iv_enc, 0x3, sizeof( iv_enc ) ); memset( iv_dec, 0x4, sizeof( iv_dec ) ); /* * Setup transforms */ #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \ defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) t_out->encrypt_then_mac = etm; t_in->encrypt_then_mac = etm; #else ((void) etm); #endif t_out->tls_version = tls_version; t_in->tls_version = tls_version; t_out->ivlen = ivlen; t_in->ivlen = ivlen; switch( cipher_info->mode ) { case MBEDTLS_MODE_GCM: case MBEDTLS_MODE_CCM: #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 ) { t_out->fixed_ivlen = 12; t_in->fixed_ivlen = 12; } else #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ { t_out->fixed_ivlen = 4; t_in->fixed_ivlen = 4; } t_out->maclen = 0; t_in->maclen = 0; switch( tag_mode ) { case 0: /* Full tag */ t_out->taglen = 16; t_in->taglen = 16; break; case 1: /* Partial tag */ t_out->taglen = 8; t_in->taglen = 8; break; default: ret = 1; goto cleanup; } break; case MBEDTLS_MODE_CHACHAPOLY: t_out->fixed_ivlen = 12; t_in->fixed_ivlen = 12; t_out->maclen = 0; t_in->maclen = 0; switch( tag_mode ) { case 0: /* Full tag */ t_out->taglen = 16; t_in->taglen = 16; break; case 1: /* Partial tag */ t_out->taglen = 8; t_in->taglen = 8; break; default: ret = 1; goto cleanup; } break; case MBEDTLS_MODE_STREAM: case MBEDTLS_MODE_CBC: t_out->fixed_ivlen = 0; /* redundant, must be 0 */ t_in->fixed_ivlen = 0; /* redundant, must be 0 */ t_out->taglen = 0; t_in->taglen = 0; switch( tag_mode ) { case 0: /* Full tag */ t_out->maclen = maclen; t_in->maclen = maclen; break; default: ret = 1; goto cleanup; } break; default: ret = 1; goto cleanup; break; } /* Setup IV's */ memcpy( &t_in->iv_dec, iv_dec, sizeof( iv_dec ) ); memcpy( &t_in->iv_enc, iv_enc, sizeof( iv_enc ) ); memcpy( &t_out->iv_dec, iv_enc, sizeof( iv_enc ) ); memcpy( &t_out->iv_enc, iv_dec, sizeof( iv_dec ) ); #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) /* Add CID */ memcpy( &t_in->in_cid, cid0, cid0_len ); memcpy( &t_in->out_cid, cid1, cid1_len ); t_in->in_cid_len = cid0_len; t_in->out_cid_len = cid1_len; memcpy( &t_out->in_cid, cid1, cid1_len ); memcpy( &t_out->out_cid, cid0, cid0_len ); t_out->in_cid_len = cid1_len; t_out->out_cid_len = cid0_len; #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ #if defined(MBEDTLS_USE_PSA_CRYPTO) status = mbedtls_ssl_cipher_to_psa( cipher_type, t_in->taglen, &alg, &key_type, &key_bits ); if ( status != PSA_SUCCESS ) { ret = psa_ssl_status_to_mbedtls( status ); goto cleanup; } t_in->psa_alg = alg; t_out->psa_alg = alg; if ( alg != MBEDTLS_SSL_NULL_CIPHER ) { psa_reset_key_attributes( &attributes ); psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT ); psa_set_key_algorithm( &attributes, alg ); psa_set_key_type( &attributes, key_type ); status = psa_import_key( &attributes, key0, PSA_BITS_TO_BYTES( key_bits ), &t_in->psa_key_enc ); if ( status != PSA_SUCCESS ) { ret = psa_ssl_status_to_mbedtls( status ); goto cleanup; } status = psa_import_key( &attributes, key1, PSA_BITS_TO_BYTES( key_bits ), &t_out->psa_key_enc ); if ( status != PSA_SUCCESS ) { ret = psa_ssl_status_to_mbedtls( status ); goto cleanup; } psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT ); status = psa_import_key( &attributes, key1, PSA_BITS_TO_BYTES( key_bits ), &t_in->psa_key_dec ); if ( status != PSA_SUCCESS ) { ret = psa_ssl_status_to_mbedtls( status ); goto cleanup; } status = psa_import_key( &attributes, key0, PSA_BITS_TO_BYTES( key_bits ), &t_out->psa_key_dec ); if ( status != PSA_SUCCESS ) { ret = psa_ssl_status_to_mbedtls( status ); goto cleanup; } } #endif /* MBEDTLS_USE_PSA_CRYPTO */ cleanup: mbedtls_free( key0 ); mbedtls_free( key1 ); mbedtls_free( md0 ); mbedtls_free( md1 ); return( ret ); } /* * Populate a session structure for serialization tests. * Choose dummy values, mostly non-0 to distinguish from the init default. */ static int ssl_tls12_populate_session( mbedtls_ssl_session *session, int ticket_len, const char *crt_file ) { #if defined(MBEDTLS_HAVE_TIME) session->start = mbedtls_time( NULL ) - 42; #endif session->tls_version = MBEDTLS_SSL_VERSION_TLS1_2; session->ciphersuite = 0xabcd; session->id_len = sizeof( session->id ); memset( session->id, 66, session->id_len ); memset( session->master, 17, sizeof( session->master ) ); #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_FS_IO) if( crt_file != NULL && strlen( crt_file ) != 0 ) { mbedtls_x509_crt tmp_crt; int ret; mbedtls_x509_crt_init( &tmp_crt ); ret = mbedtls_x509_crt_parse_file( &tmp_crt, crt_file ); if( ret != 0 ) return( ret ); #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) /* Move temporary CRT. */ session->peer_cert = mbedtls_calloc( 1, sizeof( *session->peer_cert ) ); if( session->peer_cert == NULL ) return( -1 ); *session->peer_cert = tmp_crt; memset( &tmp_crt, 0, sizeof( tmp_crt ) ); #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ /* Calculate digest of temporary CRT. */ session->peer_cert_digest = mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ); if( session->peer_cert_digest == NULL ) return( -1 ); #if defined(MBEDTLS_USE_PSA_CRYPTO) psa_algorithm_t psa_alg = mbedtls_hash_info_psa_from_md( MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ); size_t hash_size = 0; psa_status_t status = psa_hash_compute( psa_alg, tmp_crt.raw.p, tmp_crt.raw.len, session->peer_cert_digest, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN, &hash_size); ret = psa_ssl_status_to_mbedtls( status ); #else ret = mbedtls_md( mbedtls_md_info_from_type( MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ), tmp_crt.raw.p, tmp_crt.raw.len, session->peer_cert_digest ); #endif /* MBEDTLS_USE_PSA_CRYPTO */ if( ret != 0 ) return( ret ); session->peer_cert_digest_type = MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE; session->peer_cert_digest_len = MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN; #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ mbedtls_x509_crt_free( &tmp_crt ); } #else /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_FS_IO */ (void) crt_file; #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_FS_IO */ session->verify_result = 0xdeadbeef; #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) if( ticket_len != 0 ) { session->ticket = mbedtls_calloc( 1, ticket_len ); if( session->ticket == NULL ) return( -1 ); memset( session->ticket, 33, ticket_len ); } session->ticket_len = ticket_len; session->ticket_lifetime = 86401; #else (void) ticket_len; #endif #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) session->mfl_code = 1; #endif #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) session->encrypt_then_mac = 1; #endif return( 0 ); } #if defined(MBEDTLS_SSL_PROTO_TLS1_3) static int ssl_tls13_populate_session( mbedtls_ssl_session *session, int ticket_len, int endpoint_type ) { ((void) ticket_len); session->tls_version = MBEDTLS_SSL_VERSION_TLS1_3; session->endpoint = endpoint_type == MBEDTLS_SSL_IS_CLIENT ? MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER; session->ciphersuite = 0xabcd; session->ticket_age_add = 0x87654321; session->ticket_flags = 0x7; session->resumption_key_len = 32; memset( session->resumption_key, 0x99, sizeof( session->resumption_key ) ); #if defined(MBEDTLS_HAVE_TIME) if( session->endpoint == MBEDTLS_SSL_IS_SERVER ) { session->start = mbedtls_time( NULL ) - 42; } #endif #if defined(MBEDTLS_SSL_CLI_C) if( session->endpoint == MBEDTLS_SSL_IS_CLIENT ) { #if defined(MBEDTLS_HAVE_TIME) session->ticket_received = mbedtls_time( NULL ) - 40; #endif session->ticket_lifetime = 0xfedcba98; session->ticket_len = ticket_len; if( ticket_len != 0 ) { session->ticket = mbedtls_calloc( 1, ticket_len ); if( session->ticket == NULL ) return( -1 ); memset( session->ticket, 33, ticket_len ); } } #endif /* MBEDTLS_SSL_CLI_C */ return( 0 ); } #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ /* * Perform data exchanging between \p ssl_1 and \p ssl_2 and check if the * message was sent in the correct number of fragments. * * /p ssl_1 and /p ssl_2 Endpoints represented by mbedtls_ssl_context. Both * of them must be initialized and connected beforehand. * /p msg_len_1 and /p msg_len_2 specify the size of the message to send. * /p expected_fragments_1 and /p expected_fragments_2 determine in how many * fragments the message should be sent. * expected_fragments is 0: can be used for DTLS testing while the message * size is larger than MFL. In that case the message * cannot be fragmented and sent to the second endpoint. * This value can be used for negative tests. * expected_fragments is 1: can be used for TLS/DTLS testing while the * message size is below MFL * expected_fragments > 1: can be used for TLS testing while the message * size is larger than MFL * * \retval 0 on success, otherwise error code. */ int mbedtls_exchange_data( mbedtls_ssl_context *ssl_1, int msg_len_1, const int expected_fragments_1, mbedtls_ssl_context *ssl_2, int msg_len_2, const int expected_fragments_2 ) { unsigned char *msg_buf_1 = malloc( msg_len_1 ); unsigned char *msg_buf_2 = malloc( msg_len_2 ); unsigned char *in_buf_1 = malloc( msg_len_2 ); unsigned char *in_buf_2 = malloc( msg_len_1 ); int msg_type, ret = -1; /* Perform this test with two message types. At first use a message * consisting of only 0x00 for the client and only 0xFF for the server. * At the second time use message with generated data */ for( msg_type = 0; msg_type < 2; msg_type++ ) { int written_1 = 0; int written_2 = 0; int read_1 = 0; int read_2 = 0; int fragments_1 = 0; int fragments_2 = 0; if( msg_type == 0 ) { memset( msg_buf_1, 0x00, msg_len_1 ); memset( msg_buf_2, 0xff, msg_len_2 ); } else { int i, j = 0; for( i = 0; i < msg_len_1; i++ ) { msg_buf_1[i] = j++ & 0xFF; } for( i = 0; i < msg_len_2; i++ ) { msg_buf_2[i] = ( j -= 5 ) & 0xFF; } } while( read_1 < msg_len_2 || read_2 < msg_len_1 ) { /* ssl_1 sending */ if( msg_len_1 > written_1 ) { ret = mbedtls_ssl_write_fragment( ssl_1, msg_buf_1, msg_len_1, &written_1, expected_fragments_1 ); if( expected_fragments_1 == 0 ) { /* This error is expected when the message is too large and * cannot be fragmented */ TEST_ASSERT( ret == MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); msg_len_1 = 0; } else { TEST_ASSERT( ret == 0 ); } } /* ssl_2 sending */ if( msg_len_2 > written_2 ) { ret = mbedtls_ssl_write_fragment( ssl_2, msg_buf_2, msg_len_2, &written_2, expected_fragments_2 ); if( expected_fragments_2 == 0 ) { /* This error is expected when the message is too large and * cannot be fragmented */ TEST_ASSERT( ret == MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); msg_len_2 = 0; } else { TEST_ASSERT( ret == 0 ); } } /* ssl_1 reading */ if( read_1 < msg_len_2 ) { ret = mbedtls_ssl_read_fragment( ssl_1, in_buf_1, msg_len_2, &read_1, &fragments_2, expected_fragments_2 ); TEST_ASSERT( ret == 0 ); } /* ssl_2 reading */ if( read_2 < msg_len_1 ) { ret = mbedtls_ssl_read_fragment( ssl_2, in_buf_2, msg_len_1, &read_2, &fragments_1, expected_fragments_1 ); TEST_ASSERT( ret == 0 ); } } ret = -1; TEST_ASSERT( 0 == memcmp( msg_buf_1, in_buf_2, msg_len_1 ) ); TEST_ASSERT( 0 == memcmp( msg_buf_2, in_buf_1, msg_len_2 ) ); TEST_ASSERT( fragments_1 == expected_fragments_1 ); TEST_ASSERT( fragments_2 == expected_fragments_2 ); } ret = 0; exit: free( msg_buf_1 ); free( in_buf_1 ); free( msg_buf_2 ); free( in_buf_2 ); return ret; } /* * Perform data exchanging between \p ssl_1 and \p ssl_2. Both of endpoints * must be initialized and connected beforehand. * * \retval 0 on success, otherwise error code. */ int exchange_data( mbedtls_ssl_context *ssl_1, mbedtls_ssl_context *ssl_2 ) { return mbedtls_exchange_data( ssl_1, 256, 1, ssl_2, 256, 1 ); } #if defined(MBEDTLS_X509_CRT_PARSE_C) static int check_ssl_version( mbedtls_ssl_protocol_version expected_negotiated_version, const mbedtls_ssl_context *ssl ) { const char *version_string = mbedtls_ssl_get_version( ssl ); mbedtls_ssl_protocol_version version_number = mbedtls_ssl_get_version_number( ssl ); TEST_EQUAL( ssl->tls_version, expected_negotiated_version ); if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) { TEST_EQUAL( version_string[0], 'D' ); ++version_string; } switch( expected_negotiated_version ) { case MBEDTLS_SSL_VERSION_TLS1_2: TEST_EQUAL( version_number, MBEDTLS_SSL_VERSION_TLS1_2 ); TEST_ASSERT( strcmp( version_string, "TLSv1.2" ) == 0 ); break; case MBEDTLS_SSL_VERSION_TLS1_3: TEST_EQUAL( version_number, MBEDTLS_SSL_VERSION_TLS1_3 ); TEST_ASSERT( strcmp( version_string, "TLSv1.3" ) == 0 ); break; default: TEST_ASSERT( ! "Version check not implemented for this protocol version" ); } return( 1 ); exit: return( 0 ); } #endif /* MBEDTLS_X509_CRT_PARSE_C */ #if defined(MBEDTLS_X509_CRT_PARSE_C) void perform_handshake( handshake_test_options *options ) { /* forced_ciphersuite needs to last until the end of the handshake */ int forced_ciphersuite[2]; enum { BUFFSIZE = 17000 }; mbedtls_endpoint client, server; #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) const char *psk_identity = "foo"; #endif #if defined(MBEDTLS_TIMING_C) mbedtls_timing_delay_context timer_client, timer_server; #endif #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) unsigned char *context_buf = NULL; size_t context_buf_len; #endif #if defined(MBEDTLS_SSL_RENEGOTIATION) int ret = -1; #endif int expected_handshake_result = options->expected_handshake_result; USE_PSA_INIT( ); mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); /* Client side */ if( options->dtls != 0 ) { TEST_ASSERT( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, options, &client_context, &client_queue, &server_queue, NULL ) == 0 ); #if defined(MBEDTLS_TIMING_C) mbedtls_ssl_set_timer_cb( &client.ssl, &timer_client, mbedtls_timing_set_delay, mbedtls_timing_get_delay ); #endif } else { TEST_ASSERT( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, options, NULL, NULL, NULL, NULL ) == 0 ); } if( options->client_min_version != MBEDTLS_SSL_VERSION_UNKNOWN ) { mbedtls_ssl_conf_min_tls_version( &client.conf, options->client_min_version ); } if( options->client_max_version != MBEDTLS_SSL_VERSION_UNKNOWN ) { mbedtls_ssl_conf_max_tls_version( &client.conf, options->client_max_version ); } if( strlen( options->cipher ) > 0 ) { set_ciphersuite( &client.conf, options->cipher, forced_ciphersuite ); } #if defined (MBEDTLS_DEBUG_C) if( options->cli_log_fun ) { mbedtls_debug_set_threshold( 4 ); mbedtls_ssl_conf_dbg( &client.conf, options->cli_log_fun, options->cli_log_obj ); } #endif /* Server side */ if( options->dtls != 0 ) { TEST_ASSERT( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, options, &server_context, &server_queue, &client_queue, NULL ) == 0 ); #if defined(MBEDTLS_TIMING_C) mbedtls_ssl_set_timer_cb( &server.ssl, &timer_server, mbedtls_timing_set_delay, mbedtls_timing_get_delay ); #endif } else { TEST_ASSERT( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, options, NULL, NULL, NULL, NULL ) == 0 ); } mbedtls_ssl_conf_authmode( &server.conf, options->srv_auth_mode ); if( options->server_min_version != MBEDTLS_SSL_VERSION_UNKNOWN ) { mbedtls_ssl_conf_min_tls_version( &server.conf, options->server_min_version ); } if( options->server_max_version != MBEDTLS_SSL_VERSION_UNKNOWN ) { mbedtls_ssl_conf_max_tls_version( &server.conf, options->server_max_version ); } #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) TEST_ASSERT( mbedtls_ssl_conf_max_frag_len( &(server.conf), (unsigned char) options->mfl ) == 0 ); TEST_ASSERT( mbedtls_ssl_conf_max_frag_len( &(client.conf), (unsigned char) options->mfl ) == 0 ); #else TEST_ASSERT( MBEDTLS_SSL_MAX_FRAG_LEN_NONE == options->mfl ); #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) if( options->psk_str != NULL && options->psk_str->len > 0 ) { TEST_ASSERT( mbedtls_ssl_conf_psk( &client.conf, options->psk_str->x, options->psk_str->len, (const unsigned char *) psk_identity, strlen( psk_identity ) ) == 0 ); TEST_ASSERT( mbedtls_ssl_conf_psk( &server.conf, options->psk_str->x, options->psk_str->len, (const unsigned char *) psk_identity, strlen( psk_identity ) ) == 0 ); #if defined(MBEDTLS_SSL_SRV_C) mbedtls_ssl_conf_psk_cb( &server.conf, psk_dummy_callback, NULL ); #endif } #endif #if defined(MBEDTLS_SSL_RENEGOTIATION) if( options->renegotiate ) { mbedtls_ssl_conf_renegotiation( &(server.conf), MBEDTLS_SSL_RENEGOTIATION_ENABLED ); mbedtls_ssl_conf_renegotiation( &(client.conf), MBEDTLS_SSL_RENEGOTIATION_ENABLED ); mbedtls_ssl_conf_legacy_renegotiation( &(server.conf), options->legacy_renegotiation ); mbedtls_ssl_conf_legacy_renegotiation( &(client.conf), options->legacy_renegotiation ); } #endif /* MBEDTLS_SSL_RENEGOTIATION */ #if defined (MBEDTLS_DEBUG_C) if( options->srv_log_fun ) { mbedtls_debug_set_threshold( 4 ); mbedtls_ssl_conf_dbg( &server.conf, options->srv_log_fun, options->srv_log_obj ); } #endif TEST_ASSERT( mbedtls_mock_socket_connect( &(client.socket), &(server.socket), BUFFSIZE ) == 0 ); #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) if( options->resize_buffers != 0 ) { /* Ensure that the buffer sizes are appropriate before resizes */ TEST_ASSERT( client.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN ); TEST_ASSERT( client.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN ); TEST_ASSERT( server.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN ); TEST_ASSERT( server.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN ); } #endif if( options->expected_negotiated_version == MBEDTLS_SSL_VERSION_UNKNOWN ) { expected_handshake_result = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION; } TEST_ASSERT( mbedtls_move_handshake_to_state( &(client.ssl), &(server.ssl), MBEDTLS_SSL_HANDSHAKE_OVER ) == expected_handshake_result ); if( expected_handshake_result != 0 ) { /* Connection will have failed by this point, skip to cleanup */ goto exit; } TEST_ASSERT( mbedtls_ssl_is_handshake_over( &client.ssl ) == 1 ); /* Make sure server state is moved to HANDSHAKE_OVER also. */ TEST_EQUAL( mbedtls_move_handshake_to_state( &(server.ssl), &(client.ssl), MBEDTLS_SSL_HANDSHAKE_OVER ), 0 ); TEST_ASSERT( mbedtls_ssl_is_handshake_over( &server.ssl ) == 1 ); /* Check that both sides have negotiated the expected version. */ mbedtls_test_set_step( 0 ); if( ! check_ssl_version( options->expected_negotiated_version, &client.ssl ) ) goto exit; mbedtls_test_set_step( 1 ); if( ! check_ssl_version( options->expected_negotiated_version, &server.ssl ) ) goto exit; if( options->expected_ciphersuite != 0 ) { TEST_EQUAL( server.ssl.session->ciphersuite, options->expected_ciphersuite ); } #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) if( options->resize_buffers != 0 ) { /* A server, when using DTLS, might delay a buffer resize to happen * after it receives a message, so we force it. */ TEST_ASSERT( exchange_data( &(client.ssl), &(server.ssl) ) == 0 ); TEST_ASSERT( client.ssl.out_buf_len == mbedtls_ssl_get_output_buflen( &client.ssl ) ); TEST_ASSERT( client.ssl.in_buf_len == mbedtls_ssl_get_input_buflen( &client.ssl ) ); TEST_ASSERT( server.ssl.out_buf_len == mbedtls_ssl_get_output_buflen( &server.ssl ) ); TEST_ASSERT( server.ssl.in_buf_len == mbedtls_ssl_get_input_buflen( &server.ssl ) ); } #endif if( options->cli_msg_len != 0 || options->srv_msg_len != 0 ) { /* Start data exchanging test */ TEST_ASSERT( mbedtls_exchange_data( &(client.ssl), options->cli_msg_len, options->expected_cli_fragments, &(server.ssl), options->srv_msg_len, options->expected_srv_fragments ) == 0 ); } #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) if( options->serialize == 1 ) { TEST_ASSERT( options->dtls == 1 ); TEST_ASSERT( mbedtls_ssl_context_save( &(server.ssl), NULL, 0, &context_buf_len ) == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); context_buf = mbedtls_calloc( 1, context_buf_len ); TEST_ASSERT( context_buf != NULL ); TEST_ASSERT( mbedtls_ssl_context_save( &(server.ssl), context_buf, context_buf_len, &context_buf_len ) == 0 ); mbedtls_ssl_free( &(server.ssl) ); mbedtls_ssl_init( &(server.ssl) ); TEST_ASSERT( mbedtls_ssl_setup( &(server.ssl), &(server.conf) ) == 0 ); mbedtls_ssl_set_bio( &( server.ssl ), &server_context, mbedtls_mock_tcp_send_msg, mbedtls_mock_tcp_recv_msg, NULL ); mbedtls_ssl_set_user_data_p( &server.ssl, &server ); #if defined(MBEDTLS_TIMING_C) mbedtls_ssl_set_timer_cb( &server.ssl, &timer_server, mbedtls_timing_set_delay, mbedtls_timing_get_delay ); #endif #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) if( options->resize_buffers != 0 ) { /* Ensure that the buffer sizes are appropriate before resizes */ TEST_ASSERT( server.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN ); TEST_ASSERT( server.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN ); } #endif TEST_ASSERT( mbedtls_ssl_context_load( &( server.ssl ), context_buf, context_buf_len ) == 0 ); #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) /* Validate buffer sizes after context deserialization */ if( options->resize_buffers != 0 ) { TEST_ASSERT( server.ssl.out_buf_len == mbedtls_ssl_get_output_buflen( &server.ssl ) ); TEST_ASSERT( server.ssl.in_buf_len == mbedtls_ssl_get_input_buflen( &server.ssl ) ); } #endif /* Retest writing/reading */ if( options->cli_msg_len != 0 || options->srv_msg_len != 0 ) { TEST_ASSERT( mbedtls_exchange_data( &(client.ssl), options->cli_msg_len, options->expected_cli_fragments, &(server.ssl), options->srv_msg_len, options->expected_srv_fragments ) == 0 ); } } #endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ #if defined(MBEDTLS_SSL_RENEGOTIATION) if( options->renegotiate ) { /* Start test with renegotiation */ TEST_ASSERT( server.ssl.renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE ); TEST_ASSERT( client.ssl.renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE ); /* After calling this function for the server, it only sends a handshake * request. All renegotiation should happen during data exchanging */ TEST_ASSERT( mbedtls_ssl_renegotiate( &(server.ssl) ) == 0 ); TEST_ASSERT( server.ssl.renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ); TEST_ASSERT( client.ssl.renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE ); TEST_ASSERT( exchange_data( &(client.ssl), &(server.ssl) ) == 0 ); TEST_ASSERT( server.ssl.renego_status == MBEDTLS_SSL_RENEGOTIATION_DONE ); TEST_ASSERT( client.ssl.renego_status == MBEDTLS_SSL_RENEGOTIATION_DONE ); /* After calling mbedtls_ssl_renegotiate for the client all renegotiation * should happen inside this function. However in this test, we cannot * perform simultaneous communication between client and server so this * function will return waiting error on the socket. All rest of * renegotiation should happen during data exchanging */ ret = mbedtls_ssl_renegotiate( &(client.ssl) ); #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) if( options->resize_buffers != 0 ) { /* Ensure that the buffer sizes are appropriate before resizes */ TEST_ASSERT( client.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN ); TEST_ASSERT( client.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN ); } #endif TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE ); TEST_ASSERT( server.ssl.renego_status == MBEDTLS_SSL_RENEGOTIATION_DONE ); TEST_ASSERT( client.ssl.renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ); TEST_ASSERT( exchange_data( &(client.ssl), &(server.ssl) ) == 0 ); TEST_ASSERT( server.ssl.renego_status == MBEDTLS_SSL_RENEGOTIATION_DONE ); TEST_ASSERT( client.ssl.renego_status == MBEDTLS_SSL_RENEGOTIATION_DONE ); #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) /* Validate buffer sizes after renegotiation */ if( options->resize_buffers != 0 ) { TEST_ASSERT( client.ssl.out_buf_len == mbedtls_ssl_get_output_buflen( &client.ssl ) ); TEST_ASSERT( client.ssl.in_buf_len == mbedtls_ssl_get_input_buflen( &client.ssl ) ); TEST_ASSERT( server.ssl.out_buf_len == mbedtls_ssl_get_output_buflen( &server.ssl ) ); TEST_ASSERT( server.ssl.in_buf_len == mbedtls_ssl_get_input_buflen( &server.ssl ) ); } #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */ } #endif /* MBEDTLS_SSL_RENEGOTIATION */ TEST_ASSERT( mbedtls_ssl_conf_get_user_data_p( &client.conf ) == &client ); TEST_ASSERT( mbedtls_ssl_get_user_data_p( &client.ssl ) == &client ); TEST_ASSERT( mbedtls_ssl_conf_get_user_data_p( &server.conf ) == &server ); TEST_ASSERT( mbedtls_ssl_get_user_data_p( &server.ssl ) == &server ); exit: mbedtls_endpoint_free( &client, options->dtls != 0 ? &client_context : NULL ); mbedtls_endpoint_free( &server, options->dtls != 0 ? &server_context : NULL ); #if defined (MBEDTLS_DEBUG_C) if( options->cli_log_fun || options->srv_log_fun ) { mbedtls_debug_set_threshold( 0 ); } #endif #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) if( context_buf != NULL ) mbedtls_free( context_buf ); #endif USE_PSA_DONE( ); } #endif /* MBEDTLS_X509_CRT_PARSE_C */ #if defined(MBEDTLS_TEST_HOOKS) /* * Tweak vector lengths in a TLS 1.3 Certificate message * * \param[in] buf Buffer containing the Certificate message to tweak * \param[in]]out] end End of the buffer to parse * \param tweak Tweak identifier (from 1 to the number of tweaks). * \param[out] expected_result Error code expected from the parsing function * \param[out] args Arguments of the MBEDTLS_SSL_CHK_BUF_READ_PTR call that * is expected to fail. All zeroes if no * MBEDTLS_SSL_CHK_BUF_READ_PTR failure is expected. */ int tweak_tls13_certificate_msg_vector_len( unsigned char *buf, unsigned char **end, int tweak, int *expected_result, mbedtls_ssl_chk_buf_ptr_args *args ) { /* * The definition of the tweaks assume that the certificate list contains only * one certificate. */ /* * struct { * opaque cert_data<1..2^24-1>; * Extension extensions<0..2^16-1>; * } CertificateEntry; * * struct { * opaque certificate_request_context<0..2^8-1>; * CertificateEntry certificate_list<0..2^24-1>; * } Certificate; */ unsigned char *p_certificate_request_context_len = buf; size_t certificate_request_context_len = buf[0]; unsigned char *p_certificate_list_len = buf + 1 + certificate_request_context_len; unsigned char *certificate_list = p_certificate_list_len + 3; size_t certificate_list_len = MBEDTLS_GET_UINT24_BE( p_certificate_list_len, 0 ); unsigned char *p_cert_data_len = certificate_list; unsigned char *cert_data = p_cert_data_len + 3; size_t cert_data_len = MBEDTLS_GET_UINT24_BE( p_cert_data_len, 0 ); unsigned char *p_extensions_len = cert_data + cert_data_len; unsigned char *extensions = p_extensions_len + 2; size_t extensions_len = MBEDTLS_GET_UINT16_BE( p_extensions_len, 0 ); *expected_result = MBEDTLS_ERR_SSL_DECODE_ERROR; switch( tweak ) { case 1: /* Failure when checking if the certificate request context length and * certificate list length can be read */ *end = buf + 3; set_chk_buf_ptr_args( args, buf, *end, 4 ); break; case 2: /* Invalid certificate request context length. */ *p_certificate_request_context_len = certificate_request_context_len + 1; reset_chk_buf_ptr_args( args ); break; case 3: /* Failure when checking if certificate_list data can be read. */ MBEDTLS_PUT_UINT24_BE( certificate_list_len + 1, p_certificate_list_len, 0 ); set_chk_buf_ptr_args( args, certificate_list, *end, certificate_list_len + 1 ); break; case 4: /* Failure when checking if the cert_data length can be read. */ MBEDTLS_PUT_UINT24_BE( 2, p_certificate_list_len, 0 ); set_chk_buf_ptr_args( args, p_cert_data_len, certificate_list + 2, 3 ); break; case 5: /* Failure when checking if cert_data data can be read. */ MBEDTLS_PUT_UINT24_BE( certificate_list_len - 3 + 1, p_cert_data_len, 0 ); set_chk_buf_ptr_args( args, cert_data, certificate_list + certificate_list_len, certificate_list_len - 3 + 1 ); break; case 6: /* Failure when checking if the extensions length can be read. */ MBEDTLS_PUT_UINT24_BE( certificate_list_len - extensions_len - 1, p_certificate_list_len, 0 ); set_chk_buf_ptr_args( args, p_extensions_len, certificate_list + certificate_list_len - extensions_len - 1, 2 ); break; case 7: /* Failure when checking if extensions data can be read. */ MBEDTLS_PUT_UINT16_BE( extensions_len + 1, p_extensions_len, 0 ); set_chk_buf_ptr_args( args, extensions, certificate_list + certificate_list_len, extensions_len + 1 ); break; default: return( -1 ); } return( 0 ); } #endif /* MBEDTLS_TEST_HOOKS */ /* END_HEADER */ /* BEGIN_DEPENDENCIES * depends_on:MBEDTLS_SSL_TLS_C * END_DEPENDENCIES */ /* BEGIN_CASE */ void test_callback_buffer_sanity() { enum { MSGLEN = 10 }; mbedtls_test_buffer buf; unsigned char input[MSGLEN]; unsigned char output[MSGLEN]; memset( input, 0, sizeof(input) ); /* Make sure calling put and get on NULL buffer results in error. */ TEST_ASSERT( mbedtls_test_buffer_put( NULL, input, sizeof( input ) ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_get( NULL, output, sizeof( output ) ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_put( NULL, NULL, sizeof( input ) ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_put( NULL, NULL, 0 ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_get( NULL, NULL, 0 ) == -1 ); /* Make sure calling put and get on a buffer that hasn't been set up results * in error. */ mbedtls_test_buffer_init( &buf ); TEST_ASSERT( mbedtls_test_buffer_put( &buf, input, sizeof( input ) ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_get( &buf, output, sizeof( output ) ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_put( &buf, NULL, sizeof( input ) ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_put( &buf, NULL, 0 ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_get( &buf, NULL, 0 ) == -1 ); /* Make sure calling put and get on NULL input only results in * error if the length is not zero, and that a NULL output is valid for data * dropping. */ TEST_ASSERT( mbedtls_test_buffer_setup( &buf, sizeof( input ) ) == 0 ); TEST_ASSERT( mbedtls_test_buffer_put( &buf, NULL, sizeof( input ) ) == -1 ); TEST_ASSERT( mbedtls_test_buffer_get( &buf, NULL, sizeof( output ) ) == 0 ); TEST_ASSERT( mbedtls_test_buffer_put( &buf, NULL, 0 ) == 0 ); TEST_ASSERT( mbedtls_test_buffer_get( &buf, NULL, 0 ) == 0 ); /* Make sure calling put several times in the row is safe */ TEST_ASSERT( mbedtls_test_buffer_put( &buf, input, sizeof( input ) ) == sizeof( input ) ); TEST_ASSERT( mbedtls_test_buffer_get( &buf, output, 2 ) == 2 ); TEST_ASSERT( mbedtls_test_buffer_put( &buf, input, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_buffer_put( &buf, input, 2 ) == 1 ); TEST_ASSERT( mbedtls_test_buffer_put( &buf, input, 2 ) == 0 ); exit: mbedtls_test_buffer_free( &buf ); } /* END_CASE */ /* * Test if the implementation of `mbedtls_test_buffer` related functions is * correct and works as expected. * * That is * - If we try to put in \p put1 bytes then we can put in \p put1_ret bytes. * - Afterwards if we try to get \p get1 bytes then we can get \get1_ret bytes. * - Next, if we try to put in \p put1 bytes then we can put in \p put1_ret * bytes. * - Afterwards if we try to get \p get1 bytes then we can get \get1_ret bytes. * - All of the bytes we got match the bytes we put in in a FIFO manner. */ /* BEGIN_CASE */ void test_callback_buffer( int size, int put1, int put1_ret, int get1, int get1_ret, int put2, int put2_ret, int get2, int get2_ret ) { enum { ROUNDS = 2 }; size_t put[ROUNDS]; int put_ret[ROUNDS]; size_t get[ROUNDS]; int get_ret[ROUNDS]; mbedtls_test_buffer buf; unsigned char* input = NULL; size_t input_len; unsigned char* output = NULL; size_t output_len; size_t i, j, written, read; mbedtls_test_buffer_init( &buf ); TEST_ASSERT( mbedtls_test_buffer_setup( &buf, size ) == 0 ); /* Check the sanity of input parameters and initialise local variables. That * is, ensure that the amount of data is not negative and that we are not * expecting more to put or get than we actually asked for. */ TEST_ASSERT( put1 >= 0 ); put[0] = put1; put_ret[0] = put1_ret; TEST_ASSERT( put1_ret <= put1 ); TEST_ASSERT( put2 >= 0 ); put[1] = put2; put_ret[1] = put2_ret; TEST_ASSERT( put2_ret <= put2 ); TEST_ASSERT( get1 >= 0 ); get[0] = get1; get_ret[0] = get1_ret; TEST_ASSERT( get1_ret <= get1 ); TEST_ASSERT( get2 >= 0 ); get[1] = get2; get_ret[1] = get2_ret; TEST_ASSERT( get2_ret <= get2 ); input_len = 0; /* Calculate actual input and output lengths */ for( j = 0; j < ROUNDS; j++ ) { if( put_ret[j] > 0 ) { input_len += put_ret[j]; } } /* In order to always have a valid pointer we always allocate at least 1 * byte. */ if( input_len == 0 ) input_len = 1; ASSERT_ALLOC( input, input_len ); output_len = 0; for( j = 0; j < ROUNDS; j++ ) { if( get_ret[j] > 0 ) { output_len += get_ret[j]; } } TEST_ASSERT( output_len <= input_len ); /* In order to always have a valid pointer we always allocate at least 1 * byte. */ if( output_len == 0 ) output_len = 1; ASSERT_ALLOC( output, output_len ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < input_len; i++ ) { input[i] = i & 0xFF; } written = read = 0; for( j = 0; j < ROUNDS; j++ ) { TEST_ASSERT( put_ret[j] == mbedtls_test_buffer_put( &buf, input + written, put[j] ) ); written += put_ret[j]; TEST_ASSERT( get_ret[j] == mbedtls_test_buffer_get( &buf, output + read, get[j] ) ); read += get_ret[j]; TEST_ASSERT( read <= written ); if( get_ret[j] > 0 ) { TEST_ASSERT( memcmp( output + read - get_ret[j], input + read - get_ret[j], get_ret[j] ) == 0 ); } } exit: mbedtls_free( input ); mbedtls_free( output ); mbedtls_test_buffer_free( &buf ); } /* END_CASE */ /* * Test if the implementation of `mbedtls_mock_socket` related I/O functions is * correct and works as expected on unconnected sockets. */ /* BEGIN_CASE */ void ssl_mock_sanity( ) { enum { MSGLEN = 105 }; unsigned char message[MSGLEN] = { 0 }; unsigned char received[MSGLEN] = { 0 }; mbedtls_mock_socket socket; mbedtls_mock_socket_init( &socket ); TEST_ASSERT( mbedtls_mock_tcp_send_b( &socket, message, MSGLEN ) < 0 ); mbedtls_mock_socket_close( &socket ); mbedtls_mock_socket_init( &socket ); TEST_ASSERT( mbedtls_mock_tcp_recv_b( &socket, received, MSGLEN ) < 0 ); mbedtls_mock_socket_close( &socket ); mbedtls_mock_socket_init( &socket ); TEST_ASSERT( mbedtls_mock_tcp_send_nb( &socket, message, MSGLEN ) < 0 ); mbedtls_mock_socket_close( &socket ); mbedtls_mock_socket_init( &socket ); TEST_ASSERT( mbedtls_mock_tcp_recv_nb( &socket, received, MSGLEN ) < 0 ); mbedtls_mock_socket_close( &socket ); exit: mbedtls_mock_socket_close( &socket ); } /* END_CASE */ /* * Test if the implementation of `mbedtls_mock_socket` related functions can * send a single message from the client to the server. */ /* BEGIN_CASE */ void ssl_mock_tcp( int blocking ) { enum { MSGLEN = 105 }; enum { BUFLEN = MSGLEN / 5 }; unsigned char message[MSGLEN]; unsigned char received[MSGLEN]; mbedtls_mock_socket client; mbedtls_mock_socket server; size_t written, read; int send_ret, recv_ret; mbedtls_ssl_send_t *send; mbedtls_ssl_recv_t *recv; unsigned i; if( blocking == 0 ) { send = mbedtls_mock_tcp_send_nb; recv = mbedtls_mock_tcp_recv_nb; } else { send = mbedtls_mock_tcp_send_b; recv = mbedtls_mock_tcp_recv_b; } mbedtls_mock_socket_init( &client ); mbedtls_mock_socket_init( &server ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < MSGLEN; i++ ) { message[i] = i & 0xFF; } /* Make sure that sending a message takes a few iterations. */ TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, BUFLEN ) ); /* Send the message to the server */ send_ret = recv_ret = 1; written = read = 0; while( send_ret != 0 || recv_ret != 0 ) { send_ret = send( &client, message + written, MSGLEN - written ); TEST_ASSERT( send_ret >= 0 ); TEST_ASSERT( send_ret <= BUFLEN ); written += send_ret; /* If the buffer is full we can test blocking and non-blocking send */ if ( send_ret == BUFLEN ) { int blocking_ret = send( &client, message , 1 ); if ( blocking ) { TEST_ASSERT( blocking_ret == 0 ); } else { TEST_ASSERT( blocking_ret == MBEDTLS_ERR_SSL_WANT_WRITE ); } } recv_ret = recv( &server, received + read, MSGLEN - read ); /* The result depends on whether any data was sent */ if ( send_ret > 0 ) { TEST_ASSERT( recv_ret > 0 ); TEST_ASSERT( recv_ret <= BUFLEN ); read += recv_ret; } else if( blocking ) { TEST_ASSERT( recv_ret == 0 ); } else { TEST_ASSERT( recv_ret == MBEDTLS_ERR_SSL_WANT_READ ); recv_ret = 0; } /* If the buffer is empty we can test blocking and non-blocking read */ if ( recv_ret == BUFLEN ) { int blocking_ret = recv( &server, received, 1 ); if ( blocking ) { TEST_ASSERT( blocking_ret == 0 ); } else { TEST_ASSERT( blocking_ret == MBEDTLS_ERR_SSL_WANT_READ ); } } } TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); exit: mbedtls_mock_socket_close( &client ); mbedtls_mock_socket_close( &server ); } /* END_CASE */ /* * Test if the implementation of `mbedtls_mock_socket` related functions can * send messages in both direction at the same time (with the I/O calls * interleaving). */ /* BEGIN_CASE */ void ssl_mock_tcp_interleaving( int blocking ) { enum { ROUNDS = 2 }; enum { MSGLEN = 105 }; enum { BUFLEN = MSGLEN / 5 }; unsigned char message[ROUNDS][MSGLEN]; unsigned char received[ROUNDS][MSGLEN]; mbedtls_mock_socket client; mbedtls_mock_socket server; size_t written[ROUNDS]; size_t read[ROUNDS]; int send_ret[ROUNDS]; int recv_ret[ROUNDS]; unsigned i, j, progress; mbedtls_ssl_send_t *send; mbedtls_ssl_recv_t *recv; if( blocking == 0 ) { send = mbedtls_mock_tcp_send_nb; recv = mbedtls_mock_tcp_recv_nb; } else { send = mbedtls_mock_tcp_send_b; recv = mbedtls_mock_tcp_recv_b; } mbedtls_mock_socket_init( &client ); mbedtls_mock_socket_init( &server ); /* Fill up the buffers with structured data so that unwanted changes * can be detected */ for( i = 0; i < ROUNDS; i++ ) { for( j = 0; j < MSGLEN; j++ ) { message[i][j] = ( i * MSGLEN + j ) & 0xFF; } } /* Make sure that sending a message takes a few iterations. */ TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, BUFLEN ) ); /* Send the message from both sides, interleaving. */ progress = 1; for( i = 0; i < ROUNDS; i++ ) { written[i] = 0; read[i] = 0; } /* This loop does not stop as long as there was a successful write or read * of at least one byte on either side. */ while( progress != 0 ) { mbedtls_mock_socket *socket; for( i = 0; i < ROUNDS; i++ ) { /* First sending is from the client */ socket = ( i % 2 == 0 ) ? ( &client ) : ( &server ); send_ret[i] = send( socket, message[i] + written[i], MSGLEN - written[i] ); TEST_ASSERT( send_ret[i] >= 0 ); TEST_ASSERT( send_ret[i] <= BUFLEN ); written[i] += send_ret[i]; /* If the buffer is full we can test blocking and non-blocking * send */ if ( send_ret[i] == BUFLEN ) { int blocking_ret = send( socket, message[i] , 1 ); if ( blocking ) { TEST_ASSERT( blocking_ret == 0 ); } else { TEST_ASSERT( blocking_ret == MBEDTLS_ERR_SSL_WANT_WRITE ); } } } for( i = 0; i < ROUNDS; i++ ) { /* First receiving is from the server */ socket = ( i % 2 == 0 ) ? ( &server ) : ( &client ); recv_ret[i] = recv( socket, received[i] + read[i], MSGLEN - read[i] ); /* The result depends on whether any data was sent */ if ( send_ret[i] > 0 ) { TEST_ASSERT( recv_ret[i] > 0 ); TEST_ASSERT( recv_ret[i] <= BUFLEN ); read[i] += recv_ret[i]; } else if( blocking ) { TEST_ASSERT( recv_ret[i] == 0 ); } else { TEST_ASSERT( recv_ret[i] == MBEDTLS_ERR_SSL_WANT_READ ); recv_ret[i] = 0; } /* If the buffer is empty we can test blocking and non-blocking * read */ if ( recv_ret[i] == BUFLEN ) { int blocking_ret = recv( socket, received[i], 1 ); if ( blocking ) { TEST_ASSERT( blocking_ret == 0 ); } else { TEST_ASSERT( blocking_ret == MBEDTLS_ERR_SSL_WANT_READ ); } } } progress = 0; for( i = 0; i < ROUNDS; i++ ) { progress += send_ret[i] + recv_ret[i]; } } for( i = 0; i < ROUNDS; i++ ) TEST_ASSERT( memcmp( message[i], received[i], MSGLEN ) == 0 ); exit: mbedtls_mock_socket_close( &client ); mbedtls_mock_socket_close( &server ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_queue_sanity( ) { mbedtls_test_message_queue queue; /* Trying to push/pull to an empty queue */ TEST_ASSERT( mbedtls_test_message_queue_push_info( NULL, 1 ) == MBEDTLS_TEST_ERROR_ARG_NULL ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( NULL, 1 ) == MBEDTLS_TEST_ERROR_ARG_NULL ); TEST_ASSERT( mbedtls_test_message_queue_setup( &queue, 3 ) == 0 ); TEST_ASSERT( queue.capacity == 3 ); TEST_ASSERT( queue.num == 0 ); exit: mbedtls_test_message_queue_free( &queue ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_queue_basic( ) { mbedtls_test_message_queue queue; TEST_ASSERT( mbedtls_test_message_queue_setup( &queue, 3 ) == 0 ); /* Sanity test - 3 pushes and 3 pops with sufficient space */ TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 1 ) == 1 ); TEST_ASSERT( queue.capacity == 3 ); TEST_ASSERT( queue.num == 1 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 1 ) == 1 ); TEST_ASSERT( queue.capacity == 3 ); TEST_ASSERT( queue.num == 2 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 2 ) == 2 ); TEST_ASSERT( queue.capacity == 3 ); TEST_ASSERT( queue.num == 3 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 2 ) == 2 ); exit: mbedtls_test_message_queue_free( &queue ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_queue_overflow_underflow( ) { mbedtls_test_message_queue queue; TEST_ASSERT( mbedtls_test_message_queue_setup( &queue, 3 ) == 0 ); /* 4 pushes (last one with an error), 4 pops (last one with an error) */ TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 2 ) == 2 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 3 ) == MBEDTLS_ERR_SSL_WANT_WRITE ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 2 ) == 2 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 1 ) == MBEDTLS_ERR_SSL_WANT_READ ); exit: mbedtls_test_message_queue_free( &queue ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_queue_interleaved( ) { mbedtls_test_message_queue queue; TEST_ASSERT( mbedtls_test_message_queue_setup( &queue, 3 ) == 0 ); /* Interleaved test - [2 pushes, 1 pop] twice, and then two pops * (to wrap around the buffer) */ TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 2 ) == 2 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 3 ) == 3 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 1 ) == 1 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 2 ) == 2 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 5 ) == 5 ); TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, 8 ) == 8 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 3 ) == 3 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 5 ) == 5 ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, 8 ) == 8 ); exit: mbedtls_test_message_queue_free( &queue ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_queue_insufficient_buffer( ) { mbedtls_test_message_queue queue; size_t message_len = 10; size_t buffer_len = 5; TEST_ASSERT( mbedtls_test_message_queue_setup( &queue, 1 ) == 0 ); /* Popping without a sufficient buffer */ TEST_ASSERT( mbedtls_test_message_queue_push_info( &queue, message_len ) == (int) message_len ); TEST_ASSERT( mbedtls_test_message_queue_pop_info( &queue, buffer_len ) == (int) buffer_len ); exit: mbedtls_test_message_queue_free( &queue ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_mock_uninitialized( ) { enum { MSGLEN = 10 }; unsigned char message[MSGLEN] = {0}, received[MSGLEN]; mbedtls_mock_socket client, server; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); /* Send with a NULL context */ TEST_ASSERT( mbedtls_mock_tcp_send_msg( NULL, message, MSGLEN ) == MBEDTLS_TEST_ERROR_CONTEXT_ERROR ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( NULL, message, MSGLEN ) == MBEDTLS_TEST_ERROR_CONTEXT_ERROR ); TEST_ASSERT( mbedtls_message_socket_setup( &server_queue, &client_queue, 1, &server, &server_context ) == 0 ); TEST_ASSERT( mbedtls_message_socket_setup( &client_queue, &server_queue, 1, &client, &client_context ) == 0 ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MBEDTLS_TEST_ERROR_SEND_FAILED ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MBEDTLS_ERR_SSL_WANT_READ ); /* Push directly to a queue to later simulate a disconnected behavior */ TEST_ASSERT( mbedtls_test_message_queue_push_info( &server_queue, MSGLEN ) == MSGLEN ); /* Test if there's an error when trying to read from a disconnected * socket */ TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MBEDTLS_TEST_ERROR_RECV_FAILED ); exit: mbedtls_message_socket_close( &server_context ); mbedtls_message_socket_close( &client_context ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_mock_basic( ) { enum { MSGLEN = 10 }; unsigned char message[MSGLEN], received[MSGLEN]; mbedtls_mock_socket client, server; unsigned i; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); TEST_ASSERT( mbedtls_message_socket_setup( &server_queue, &client_queue, 1, &server, &server_context ) == 0 ); TEST_ASSERT( mbedtls_message_socket_setup( &client_queue, &server_queue, 1, &client, &client_context ) == 0 ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < MSGLEN; i++ ) { message[i] = i & 0xFF; } TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, MSGLEN ) ); /* Send the message to the server */ TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); /* Read from the server */ TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); memset( received, 0, MSGLEN ); /* Send the message to the client */ TEST_ASSERT( mbedtls_mock_tcp_send_msg( &server_context, message, MSGLEN ) == MSGLEN ); /* Read from the client */ TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &client_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); exit: mbedtls_message_socket_close( &server_context ); mbedtls_message_socket_close( &client_context ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_mock_queue_overflow_underflow( ) { enum { MSGLEN = 10 }; unsigned char message[MSGLEN], received[MSGLEN]; mbedtls_mock_socket client, server; unsigned i; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); TEST_ASSERT( mbedtls_message_socket_setup( &server_queue, &client_queue, 2, &server, &server_context ) == 0 ); TEST_ASSERT( mbedtls_message_socket_setup( &client_queue, &server_queue, 2, &client, &client_context ) == 0 ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < MSGLEN; i++ ) { message[i] = i & 0xFF; } TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, MSGLEN*2 ) ); /* Send three message to the server, last one with an error */ TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN - 1 ) == MSGLEN - 1 ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MBEDTLS_ERR_SSL_WANT_WRITE ); /* Read three messages from the server, last one with an error */ TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN - 1 ) == MSGLEN - 1 ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MBEDTLS_ERR_SSL_WANT_READ ); exit: mbedtls_message_socket_close( &server_context ); mbedtls_message_socket_close( &client_context ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_mock_socket_overflow( ) { enum { MSGLEN = 10 }; unsigned char message[MSGLEN], received[MSGLEN]; mbedtls_mock_socket client, server; unsigned i; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); TEST_ASSERT( mbedtls_message_socket_setup( &server_queue, &client_queue, 2, &server, &server_context ) == 0 ); TEST_ASSERT( mbedtls_message_socket_setup( &client_queue, &server_queue, 2, &client, &client_context ) == 0 ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < MSGLEN; i++ ) { message[i] = i & 0xFF; } TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, MSGLEN ) ); /* Send two message to the server, second one with an error */ TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MBEDTLS_TEST_ERROR_SEND_FAILED ); /* Read the only message from the server */ TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); exit: mbedtls_message_socket_close( &server_context ); mbedtls_message_socket_close( &client_context ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_mock_truncated( ) { enum { MSGLEN = 10 }; unsigned char message[MSGLEN], received[MSGLEN]; mbedtls_mock_socket client, server; unsigned i; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); TEST_ASSERT( mbedtls_message_socket_setup( &server_queue, &client_queue, 2, &server, &server_context ) == 0 ); TEST_ASSERT( mbedtls_message_socket_setup( &client_queue, &server_queue, 2, &client, &client_context ) == 0 ); memset( received, 0, MSGLEN ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < MSGLEN; i++ ) { message[i] = i & 0xFF; } TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, 2 * MSGLEN ) ); /* Send two messages to the server, the second one small enough to fit in the * receiver's buffer. */ TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN / 2 ) == MSGLEN / 2 ); /* Read a truncated message from the server */ TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN/2 ) == MSGLEN/2 ); /* Test that the first half of the message is valid, and second one isn't */ TEST_ASSERT( memcmp( message, received, MSGLEN/2 ) == 0 ); TEST_ASSERT( memcmp( message + MSGLEN/2, received + MSGLEN/2, MSGLEN/2 ) != 0 ); memset( received, 0, MSGLEN ); /* Read a full message from the server */ TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN/2 ) == MSGLEN / 2 ); /* Test that the first half of the message is valid */ TEST_ASSERT( memcmp( message, received, MSGLEN/2 ) == 0 ); exit: mbedtls_message_socket_close( &server_context ); mbedtls_message_socket_close( &client_context ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_mock_socket_read_error( ) { enum { MSGLEN = 10 }; unsigned char message[MSGLEN], received[MSGLEN]; mbedtls_mock_socket client, server; unsigned i; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); TEST_ASSERT( mbedtls_message_socket_setup( &server_queue, &client_queue, 1, &server, &server_context ) == 0 ); TEST_ASSERT( mbedtls_message_socket_setup( &client_queue, &server_queue, 1, &client, &client_context ) == 0 ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < MSGLEN; i++ ) { message[i] = i & 0xFF; } TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, MSGLEN ) ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); /* Force a read error by disconnecting the socket by hand */ server.status = 0; TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MBEDTLS_TEST_ERROR_RECV_FAILED ); /* Return to a valid state */ server.status = MBEDTLS_MOCK_SOCKET_CONNECTED; memset( received, 0, sizeof( received ) ); /* Test that even though the server tried to read once disconnected, the * continuity is preserved */ TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); exit: mbedtls_message_socket_close( &server_context ); mbedtls_message_socket_close( &client_context ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_mock_interleaved_one_way( ) { enum { MSGLEN = 10 }; unsigned char message[MSGLEN], received[MSGLEN]; mbedtls_mock_socket client, server; unsigned i; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); TEST_ASSERT( mbedtls_message_socket_setup( &server_queue, &client_queue, 3, &server, &server_context ) == 0 ); TEST_ASSERT( mbedtls_message_socket_setup( &client_queue, &server_queue, 3, &client, &client_context ) == 0 ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < MSGLEN; i++ ) { message[i] = i & 0xFF; } TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, MSGLEN*3 ) ); /* Interleaved test - [2 sends, 1 read] twice, and then two reads * (to wrap around the buffer) */ for( i = 0; i < 2; i++ ) { TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); memset( received, 0, sizeof( received ) ); } for( i = 0; i < 2; i++ ) { TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); } TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MBEDTLS_ERR_SSL_WANT_READ ); exit: mbedtls_message_socket_close( &server_context ); mbedtls_message_socket_close( &client_context ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_message_mock_interleaved_two_ways( ) { enum { MSGLEN = 10 }; unsigned char message[MSGLEN], received[MSGLEN]; mbedtls_mock_socket client, server; unsigned i; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); TEST_ASSERT( mbedtls_message_socket_setup( &server_queue, &client_queue, 3, &server, &server_context ) == 0 ); TEST_ASSERT( mbedtls_message_socket_setup( &client_queue, &server_queue, 3, &client, &client_context ) == 0 ); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ for( i = 0; i < MSGLEN; i++ ) { message[i] = i & 0xFF; } TEST_ASSERT( 0 == mbedtls_mock_socket_connect( &client, &server, MSGLEN*3 ) ); /* Interleaved test - [2 sends, 1 read] twice, both ways, and then two reads * (to wrap around the buffer) both ways. */ for( i = 0; i < 2; i++ ) { TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &client_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &server_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_send_msg( &server_context, message, MSGLEN ) == MSGLEN ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); memset( received, 0, sizeof( received ) ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &client_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); memset( received, 0, sizeof( received ) ); } for( i = 0; i < 2; i++ ) { TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); memset( received, 0, sizeof( received ) ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &client_context, received, MSGLEN ) == MSGLEN ); TEST_ASSERT( memcmp( message, received, MSGLEN ) == 0 ); memset( received, 0, sizeof( received ) ); } TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &server_context, received, MSGLEN ) == MBEDTLS_ERR_SSL_WANT_READ ); TEST_ASSERT( mbedtls_mock_tcp_recv_msg( &client_context, received, MSGLEN ) == MBEDTLS_ERR_SSL_WANT_READ ); exit: mbedtls_message_socket_close( &server_context ); mbedtls_message_socket_close( &client_context ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_DTLS_ANTI_REPLAY */ void ssl_dtls_replay( data_t * prevs, data_t * new, int ret ) { uint32_t len = 0; mbedtls_ssl_context ssl; mbedtls_ssl_config conf; mbedtls_ssl_init( &ssl ); mbedtls_ssl_config_init( &conf ); TEST_ASSERT( mbedtls_ssl_config_defaults( &conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_DATAGRAM, MBEDTLS_SSL_PRESET_DEFAULT ) == 0 ); TEST_ASSERT( mbedtls_ssl_setup( &ssl, &conf ) == 0 ); /* Read previous record numbers */ for( len = 0; len < prevs->len; len += 6 ) { memcpy( ssl.in_ctr + 2, prevs->x + len, 6 ); mbedtls_ssl_dtls_replay_update( &ssl ); } /* Check new number */ memcpy( ssl.in_ctr + 2, new->x, 6 ); TEST_ASSERT( mbedtls_ssl_dtls_replay_check( &ssl ) == ret ); mbedtls_ssl_free( &ssl ); mbedtls_ssl_config_free( &conf ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */ void ssl_set_hostname_twice( char *hostname0, char *hostname1 ) { mbedtls_ssl_context ssl; mbedtls_ssl_init( &ssl ); TEST_ASSERT( mbedtls_ssl_set_hostname( &ssl, hostname0 ) == 0 ); TEST_ASSERT( mbedtls_ssl_set_hostname( &ssl, hostname1 ) == 0 ); mbedtls_ssl_free( &ssl ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_crypt_record( int cipher_type, int hash_id, int etm, int tag_mode, int ver, int cid0_len, int cid1_len ) { /* * Test several record encryptions and decryptions * with plenty of space before and after the data * within the record buffer. */ int ret; int num_records = 16; mbedtls_ssl_context ssl; /* ONLY for debugging */ mbedtls_ssl_transform t0, t1; unsigned char *buf = NULL; size_t const buflen = 512; mbedtls_record rec, rec_backup; USE_PSA_INIT( ); mbedtls_ssl_init( &ssl ); mbedtls_ssl_transform_init( &t0 ); mbedtls_ssl_transform_init( &t1 ); ret = build_transforms( &t0, &t1, cipher_type, hash_id, etm, tag_mode, ver, (size_t) cid0_len, (size_t) cid1_len ); TEST_ASSERT( ret == 0 ); TEST_ASSERT( ( buf = mbedtls_calloc( 1, buflen ) ) != NULL ); while( num_records-- > 0 ) { mbedtls_ssl_transform *t_dec, *t_enc; /* Take turns in who's sending and who's receiving. */ if( num_records % 3 == 0 ) { t_dec = &t0; t_enc = &t1; } else { t_dec = &t1; t_enc = &t0; } /* * The record header affects the transformation in two ways: * 1) It determines the AEAD additional data * 2) The record counter sometimes determines the IV. * * Apart from that, the fields don't have influence. * In particular, it is currently not the responsibility * of ssl_encrypt/decrypt_buf to check if the transform * version matches the record version, or that the * type is sensible. */ memset( rec.ctr, num_records, sizeof( rec.ctr ) ); rec.type = 42; rec.ver[0] = num_records; rec.ver[1] = num_records; #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) rec.cid_len = 0; #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ rec.buf = buf; rec.buf_len = buflen; rec.data_offset = 16; /* Make sure to vary the length to exercise different * paddings. */ rec.data_len = 1 + num_records; memset( rec.buf + rec.data_offset, 42, rec.data_len ); /* Make a copy for later comparison */ rec_backup = rec; /* Encrypt record */ ret = mbedtls_ssl_encrypt_buf( &ssl, t_enc, &rec, mbedtls_test_rnd_std_rand, NULL ); TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); if( ret != 0 ) { continue; } #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) if( rec.cid_len != 0 ) { /* DTLS 1.2 + CID hides the real content type and * uses a special CID content type in the protected * record. Double-check this. */ TEST_ASSERT( rec.type == MBEDTLS_SSL_MSG_CID ); } #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if( t_enc->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 ) { /* TLS 1.3 hides the real content type and * always uses Application Data as the content type * for protected records. Double-check this. */ TEST_ASSERT( rec.type == MBEDTLS_SSL_MSG_APPLICATION_DATA ); } #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ /* Decrypt record with t_dec */ ret = mbedtls_ssl_decrypt_buf( &ssl, t_dec, &rec ); TEST_ASSERT( ret == 0 ); /* Compare results */ TEST_ASSERT( rec.type == rec_backup.type ); TEST_ASSERT( memcmp( rec.ctr, rec_backup.ctr, 8 ) == 0 ); TEST_ASSERT( rec.ver[0] == rec_backup.ver[0] ); TEST_ASSERT( rec.ver[1] == rec_backup.ver[1] ); TEST_ASSERT( rec.data_len == rec_backup.data_len ); TEST_ASSERT( rec.data_offset == rec_backup.data_offset ); TEST_ASSERT( memcmp( rec.buf + rec.data_offset, rec_backup.buf + rec_backup.data_offset, rec.data_len ) == 0 ); } exit: /* Cleanup */ mbedtls_ssl_free( &ssl ); mbedtls_ssl_transform_free( &t0 ); mbedtls_ssl_transform_free( &t1 ); mbedtls_free( buf ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_crypt_record_small( int cipher_type, int hash_id, int etm, int tag_mode, int ver, int cid0_len, int cid1_len ) { /* * Test pairs of encryption and decryption with an increasing * amount of space in the record buffer - in more detail: * 1) Try to encrypt with 0, 1, 2, ... bytes available * in front of the plaintext, and expect the encryption * to succeed starting from some offset. Always keep * enough space in the end of the buffer. * 2) Try to encrypt with 0, 1, 2, ... bytes available * at the end of the plaintext, and expect the encryption * to succeed starting from some offset. Always keep * enough space at the beginning of the buffer. * 3) Try to encrypt with 0, 1, 2, ... bytes available * both at the front and end of the plaintext, * and expect the encryption to succeed starting from * some offset. * * If encryption succeeds, check that decryption succeeds * and yields the original record. */ mbedtls_ssl_context ssl; /* ONLY for debugging */ mbedtls_ssl_transform t0, t1; unsigned char *buf = NULL; size_t const buflen = 256; mbedtls_record rec, rec_backup; int ret; int mode; /* Mode 1, 2 or 3 as explained above */ size_t offset; /* Available space at beginning/end/both */ size_t threshold = 96; /* Maximum offset to test against */ size_t default_pre_padding = 64; /* Pre-padding to use in mode 2 */ size_t default_post_padding = 128; /* Post-padding to use in mode 1 */ int seen_success; /* Indicates if in the current mode we've * already seen a successful test. */ USE_PSA_INIT( ); mbedtls_ssl_init( &ssl ); mbedtls_ssl_transform_init( &t0 ); mbedtls_ssl_transform_init( &t1 ); ret = build_transforms( &t0, &t1, cipher_type, hash_id, etm, tag_mode, ver, (size_t) cid0_len, (size_t) cid1_len ); TEST_ASSERT( ret == 0 ); TEST_ASSERT( ( buf = mbedtls_calloc( 1, buflen ) ) != NULL ); for( mode=1; mode <= 3; mode++ ) { seen_success = 0; for( offset=0; offset <= threshold; offset++ ) { mbedtls_ssl_transform *t_dec, *t_enc; t_dec = &t0; t_enc = &t1; memset( rec.ctr, offset, sizeof( rec.ctr ) ); rec.type = 42; rec.ver[0] = offset; rec.ver[1] = offset; rec.buf = buf; rec.buf_len = buflen; #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) rec.cid_len = 0; #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ switch( mode ) { case 1: /* Space in the beginning */ rec.data_offset = offset; rec.data_len = buflen - offset - default_post_padding; break; case 2: /* Space in the end */ rec.data_offset = default_pre_padding; rec.data_len = buflen - default_pre_padding - offset; break; case 3: /* Space in the beginning and end */ rec.data_offset = offset; rec.data_len = buflen - 2 * offset; break; default: TEST_ASSERT( 0 ); break; } memset( rec.buf + rec.data_offset, 42, rec.data_len ); /* Make a copy for later comparison */ rec_backup = rec; /* Encrypt record */ ret = mbedtls_ssl_encrypt_buf( &ssl, t_enc, &rec, mbedtls_test_rnd_std_rand, NULL ); if( ( mode == 1 || mode == 2 ) && seen_success ) { TEST_ASSERT( ret == 0 ); } else { TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); if( ret == 0 ) seen_success = 1; } if( ret != 0 ) continue; #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) if( rec.cid_len != 0 ) { /* DTLS 1.2 + CID hides the real content type and * uses a special CID content type in the protected * record. Double-check this. */ TEST_ASSERT( rec.type == MBEDTLS_SSL_MSG_CID ); } #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if( t_enc->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 ) { /* TLS 1.3 hides the real content type and * always uses Application Data as the content type * for protected records. Double-check this. */ TEST_ASSERT( rec.type == MBEDTLS_SSL_MSG_APPLICATION_DATA ); } #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ /* Decrypt record with t_dec */ TEST_ASSERT( mbedtls_ssl_decrypt_buf( &ssl, t_dec, &rec ) == 0 ); /* Compare results */ TEST_ASSERT( rec.type == rec_backup.type ); TEST_ASSERT( memcmp( rec.ctr, rec_backup.ctr, 8 ) == 0 ); TEST_ASSERT( rec.ver[0] == rec_backup.ver[0] ); TEST_ASSERT( rec.ver[1] == rec_backup.ver[1] ); TEST_ASSERT( rec.data_len == rec_backup.data_len ); TEST_ASSERT( rec.data_offset == rec_backup.data_offset ); TEST_ASSERT( memcmp( rec.buf + rec.data_offset, rec_backup.buf + rec_backup.data_offset, rec.data_len ) == 0 ); } TEST_ASSERT( seen_success == 1 ); } exit: /* Cleanup */ mbedtls_ssl_free( &ssl ); mbedtls_ssl_transform_free( &t0 ); mbedtls_ssl_transform_free( &t1 ); mbedtls_free( buf ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_CIPHER_MODE_CBC:MBEDTLS_AES_C:MBEDTLS_SSL_PROTO_TLS1_2 */ void ssl_decrypt_non_etm_cbc( int cipher_type, int hash_id, int trunc_hmac, int length_selector ) { /* * Test record decryption for CBC without EtM, focused on the verification * of padding and MAC. * * Actually depends on TLS 1.2 and either AES, ARIA or Camellia, but since * the test framework doesn't support alternation in dependency statements, * just depend on AES. * * The length_selector argument is interpreted as follows: * - if it's -1, the plaintext length is 0 and minimal padding is applied * - if it's -2, the plaintext length is 0 and maximal padding is applied * - otherwise it must be in [0, 255] and is padding_length from RFC 5246: * it's the length of the rest of the padding, that is, excluding the * byte that encodes the length. The minimal non-zero plaintext length * that gives this padding_length is automatically selected. */ mbedtls_ssl_context ssl; /* ONLY for debugging */ mbedtls_ssl_transform t0, t1; mbedtls_record rec, rec_save; unsigned char *buf = NULL, *buf_save = NULL; size_t buflen, olen = 0; size_t plaintext_len, block_size, i; unsigned char padlen; /* excluding the padding_length byte */ unsigned char add_data[13]; #if defined(MBEDTLS_USE_PSA_CRYPTO) psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; size_t sign_mac_length = 0; unsigned char mac[PSA_HASH_MAX_SIZE]; #else unsigned char mac[MBEDTLS_MD_MAX_SIZE]; #endif int exp_ret; int ret; const unsigned char pad_max_len = 255; /* Per the standard */ USE_PSA_INIT( ); mbedtls_ssl_init( &ssl ); mbedtls_ssl_transform_init( &t0 ); mbedtls_ssl_transform_init( &t1 ); /* Set up transforms with dummy keys */ ret = build_transforms( &t0, &t1, cipher_type, hash_id, 0, trunc_hmac, MBEDTLS_SSL_VERSION_TLS1_2, 0 , 0 ); TEST_ASSERT( ret == 0 ); /* Determine padding/plaintext length */ TEST_ASSERT( length_selector >= -2 && length_selector <= 255 ); block_size = t0.ivlen; if( length_selector < 0 ) { plaintext_len = 0; /* Minimal padding * The +1 is for the padding_length byte, not counted in padlen. */ padlen = block_size - ( t0.maclen + 1 ) % block_size; /* Maximal padding? */ if( length_selector == -2 ) padlen += block_size * ( ( pad_max_len - padlen ) / block_size ); } else { padlen = length_selector; /* Minimal non-zero plaintext_length giving desired padding. * The +1 is for the padding_length byte, not counted in padlen. */ plaintext_len = block_size - ( padlen + t0.maclen + 1 ) % block_size; } /* Prepare a buffer for record data */ buflen = block_size + plaintext_len + t0.maclen + padlen + 1; ASSERT_ALLOC( buf, buflen ); ASSERT_ALLOC( buf_save, buflen ); /* Prepare a dummy record header */ memset( rec.ctr, 0, sizeof( rec.ctr ) ); rec.type = MBEDTLS_SSL_MSG_APPLICATION_DATA; mbedtls_ssl_write_version( rec.ver, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_VERSION_TLS1_2 ); #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) rec.cid_len = 0; #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ /* Prepare dummy record content */ rec.buf = buf; rec.buf_len = buflen; rec.data_offset = block_size; rec.data_len = plaintext_len; memset( rec.buf + rec.data_offset, 42, rec.data_len ); /* Serialized version of record header for MAC purposes */ memcpy( add_data, rec.ctr, 8 ); add_data[8] = rec.type; add_data[9] = rec.ver[0]; add_data[10] = rec.ver[1]; add_data[11] = ( rec.data_len >> 8 ) & 0xff; add_data[12] = ( rec.data_len >> 0 ) & 0xff; /* Set dummy IV */ memset( t0.iv_enc, 0x55, t0.ivlen ); memcpy( rec.buf, t0.iv_enc, t0.ivlen ); /* * Prepare a pre-encryption record (with MAC and padding), and save it. */ /* MAC with additional data */ #if defined(MBEDTLS_USE_PSA_CRYPTO) TEST_EQUAL( PSA_SUCCESS, psa_mac_sign_setup( &operation, t0.psa_mac_enc, t0.psa_mac_alg ) ); TEST_EQUAL( PSA_SUCCESS, psa_mac_update( &operation, add_data, 13 ) ); TEST_EQUAL( PSA_SUCCESS, psa_mac_update( &operation, rec.buf + rec.data_offset, rec.data_len ) ); TEST_EQUAL( PSA_SUCCESS, psa_mac_sign_finish( &operation, mac, sizeof(mac), &sign_mac_length ) ); #else TEST_EQUAL( 0, mbedtls_md_hmac_update( &t0.md_ctx_enc, add_data, 13 ) ); TEST_EQUAL( 0, mbedtls_md_hmac_update( &t0.md_ctx_enc, rec.buf + rec.data_offset, rec.data_len ) ); TEST_EQUAL( 0, mbedtls_md_hmac_finish( &t0.md_ctx_enc, mac ) ); #endif memcpy( rec.buf + rec.data_offset + rec.data_len, mac, t0.maclen ); rec.data_len += t0.maclen; /* Pad */ memset( rec.buf + rec.data_offset + rec.data_len, padlen, padlen + 1 ); rec.data_len += padlen + 1; /* Save correct pre-encryption record */ rec_save = rec; rec_save.buf = buf_save; memcpy( buf_save, buf, buflen ); /* * Encrypt and decrypt the correct record, expecting success */ TEST_EQUAL( 0, psa_cipher_encrypt_helper(&t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset, rec.data_len, rec.buf + rec.data_offset, &olen ) ); rec.data_offset -= t0.ivlen; rec.data_len += t0.ivlen; TEST_EQUAL( 0, mbedtls_ssl_decrypt_buf( &ssl, &t1, &rec ) ); /* * Modify each byte of the pre-encryption record before encrypting and * decrypting it, expecting failure every time. */ for( i = block_size; i < buflen; i++ ) { mbedtls_test_set_step( i ); /* Restore correct pre-encryption record */ rec = rec_save; rec.buf = buf; memcpy( buf, buf_save, buflen ); /* Corrupt one byte of the data (could be plaintext, MAC or padding) */ rec.buf[i] ^= 0x01; /* Encrypt */ TEST_EQUAL( 0, psa_cipher_encrypt_helper(&t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset, rec.data_len, rec.buf + rec.data_offset, &olen ) ); rec.data_offset -= t0.ivlen; rec.data_len += t0.ivlen; /* Decrypt and expect failure */ TEST_EQUAL( MBEDTLS_ERR_SSL_INVALID_MAC, mbedtls_ssl_decrypt_buf( &ssl, &t1, &rec ) ); } /* * Use larger values of the padding bytes - with small buffers, this tests * the case where the announced padlen would be larger than the buffer * (and before that, than the buffer minus the size of the MAC), to make * sure our padding checking code does not perform any out-of-bounds reads * in this case. (With larger buffers, ie when the plaintext is long or * maximal length padding is used, this is less relevant but still doesn't * hurt to test.) * * (Start the loop with correct padding, just to double-check that record * saving did work, and that we're overwriting the correct bytes.) */ for( i = padlen; i <= pad_max_len; i++ ) { mbedtls_test_set_step( i ); /* Restore correct pre-encryption record */ rec = rec_save; rec.buf = buf; memcpy( buf, buf_save, buflen ); /* Set padding bytes to new value */ memset( buf + buflen - padlen - 1, i, padlen + 1 ); /* Encrypt */ TEST_EQUAL( 0, psa_cipher_encrypt_helper(&t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset, rec.data_len, rec.buf + rec.data_offset, &olen ) ); rec.data_offset -= t0.ivlen; rec.data_len += t0.ivlen; /* Decrypt and expect failure except the first time */ exp_ret = ( i == padlen ) ? 0 : MBEDTLS_ERR_SSL_INVALID_MAC; TEST_EQUAL( exp_ret, mbedtls_ssl_decrypt_buf( &ssl, &t1, &rec ) ); } exit: mbedtls_ssl_free( &ssl ); mbedtls_ssl_transform_free( &t0 ); mbedtls_ssl_transform_free( &t1 ); mbedtls_free( buf ); mbedtls_free( buf_save ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_hkdf_expand_label( int hash_alg, data_t *secret, int label_idx, data_t *ctx, int desired_length, data_t *expected ) { unsigned char dst[ 100 ]; unsigned char const *lbl = NULL; size_t lbl_len; #define MBEDTLS_SSL_TLS1_3_LABEL( name, string ) \ if( label_idx == (int) tls13_label_ ## name ) \ { \ lbl = mbedtls_ssl_tls13_labels.name; \ lbl_len = sizeof( mbedtls_ssl_tls13_labels.name ); \ } MBEDTLS_SSL_TLS1_3_LABEL_LIST #undef MBEDTLS_SSL_TLS1_3_LABEL TEST_ASSERT( lbl != NULL ); /* Check sanity of test parameters. */ TEST_ASSERT( (size_t) desired_length <= sizeof(dst) ); TEST_ASSERT( (size_t) desired_length == expected->len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_hkdf_expand_label( (psa_algorithm_t) hash_alg, secret->x, secret->len, lbl, lbl_len, ctx->x, ctx->len, dst, desired_length ) == 0 ); ASSERT_COMPARE( dst, (size_t) desired_length, expected->x, (size_t) expected->len ); PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_traffic_key_generation( int hash_alg, data_t *server_secret, data_t *client_secret, int desired_iv_len, int desired_key_len, data_t *expected_server_write_key, data_t *expected_server_write_iv, data_t *expected_client_write_key, data_t *expected_client_write_iv ) { mbedtls_ssl_key_set keys; /* Check sanity of test parameters. */ TEST_ASSERT( client_secret->len == server_secret->len ); TEST_ASSERT( expected_client_write_iv->len == expected_server_write_iv->len && expected_client_write_iv->len == (size_t) desired_iv_len ); TEST_ASSERT( expected_client_write_key->len == expected_server_write_key->len && expected_client_write_key->len == (size_t) desired_key_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_make_traffic_keys( (psa_algorithm_t) hash_alg, client_secret->x, server_secret->x, client_secret->len /* == server_secret->len */, desired_key_len, desired_iv_len, &keys ) == 0 ); ASSERT_COMPARE( keys.client_write_key, keys.key_len, expected_client_write_key->x, (size_t) desired_key_len ); ASSERT_COMPARE( keys.server_write_key, keys.key_len, expected_server_write_key->x, (size_t) desired_key_len ); ASSERT_COMPARE( keys.client_write_iv, keys.iv_len, expected_client_write_iv->x, (size_t) desired_iv_len ); ASSERT_COMPARE( keys.server_write_iv, keys.iv_len, expected_server_write_iv->x, (size_t) desired_iv_len ); PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_derive_secret( int hash_alg, data_t *secret, int label_idx, data_t *ctx, int desired_length, int already_hashed, data_t *expected ) { unsigned char dst[ 100 ]; unsigned char const *lbl = NULL; size_t lbl_len; #define MBEDTLS_SSL_TLS1_3_LABEL( name, string ) \ if( label_idx == (int) tls13_label_ ## name ) \ { \ lbl = mbedtls_ssl_tls13_labels.name; \ lbl_len = sizeof( mbedtls_ssl_tls13_labels.name ); \ } MBEDTLS_SSL_TLS1_3_LABEL_LIST #undef MBEDTLS_SSL_TLS1_3_LABEL TEST_ASSERT( lbl != NULL ); /* Check sanity of test parameters. */ TEST_ASSERT( (size_t) desired_length <= sizeof(dst) ); TEST_ASSERT( (size_t) desired_length == expected->len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_secret( (psa_algorithm_t) hash_alg, secret->x, secret->len, lbl, lbl_len, ctx->x, ctx->len, already_hashed, dst, desired_length ) == 0 ); ASSERT_COMPARE( dst, desired_length, expected->x, desired_length ); PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_derive_early_secrets( int hash_alg, data_t *secret, data_t *transcript, data_t *traffic_expected, data_t *exporter_expected ) { mbedtls_ssl_tls13_early_secrets secrets; /* Double-check that we've passed sane parameters. */ psa_algorithm_t alg = (psa_algorithm_t) hash_alg; size_t const hash_len = PSA_HASH_LENGTH( alg ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && secret->len == hash_len && transcript->len == hash_len && traffic_expected->len == hash_len && exporter_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_early_secrets( alg, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); ASSERT_COMPARE( secrets.client_early_traffic_secret, hash_len, traffic_expected->x, traffic_expected->len ); ASSERT_COMPARE( secrets.early_exporter_master_secret, hash_len, exporter_expected->x, exporter_expected->len ); PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_derive_handshake_secrets( int hash_alg, data_t *secret, data_t *transcript, data_t *client_expected, data_t *server_expected ) { mbedtls_ssl_tls13_handshake_secrets secrets; /* Double-check that we've passed sane parameters. */ psa_algorithm_t alg = (psa_algorithm_t) hash_alg; size_t const hash_len = PSA_HASH_LENGTH( alg ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && secret->len == hash_len && transcript->len == hash_len && client_expected->len == hash_len && server_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_handshake_secrets( alg, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); ASSERT_COMPARE( secrets.client_handshake_traffic_secret, hash_len, client_expected->x, client_expected->len ); ASSERT_COMPARE( secrets.server_handshake_traffic_secret, hash_len, server_expected->x, server_expected->len ); PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_derive_application_secrets( int hash_alg, data_t *secret, data_t *transcript, data_t *client_expected, data_t *server_expected, data_t *exporter_expected ) { mbedtls_ssl_tls13_application_secrets secrets; /* Double-check that we've passed sane parameters. */ psa_algorithm_t alg = (psa_algorithm_t) hash_alg; size_t const hash_len = PSA_HASH_LENGTH( alg ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && secret->len == hash_len && transcript->len == hash_len && client_expected->len == hash_len && server_expected->len == hash_len && exporter_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_application_secrets( alg, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); ASSERT_COMPARE( secrets.client_application_traffic_secret_N, hash_len, client_expected->x, client_expected->len ); ASSERT_COMPARE( secrets.server_application_traffic_secret_N, hash_len, server_expected->x, server_expected->len ); ASSERT_COMPARE( secrets.exporter_master_secret, hash_len, exporter_expected->x, exporter_expected->len ); PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_derive_resumption_secrets( int hash_alg, data_t *secret, data_t *transcript, data_t *resumption_expected ) { mbedtls_ssl_tls13_application_secrets secrets; /* Double-check that we've passed sane parameters. */ psa_algorithm_t alg = (psa_algorithm_t) hash_alg; size_t const hash_len = PSA_HASH_LENGTH( alg ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && secret->len == hash_len && transcript->len == hash_len && resumption_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_derive_resumption_master_secret( alg, secret->x, transcript->x, transcript->len, &secrets ) == 0 ); ASSERT_COMPARE( secrets.resumption_master_secret, hash_len, resumption_expected->x, resumption_expected->len ); PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_create_psk_binder( int hash_alg, data_t *psk, int psk_type, data_t *transcript, data_t *binder_expected ) { unsigned char binder[ MBEDTLS_MD_MAX_SIZE ]; /* Double-check that we've passed sane parameters. */ psa_algorithm_t alg = (psa_algorithm_t) hash_alg; size_t const hash_len = PSA_HASH_LENGTH( alg ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) && transcript->len == hash_len && binder_expected->len == hash_len ); PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls13_create_psk_binder( NULL, /* SSL context for debugging only */ alg, psk->x, psk->len, psk_type, transcript->x, binder ) == 0 ); ASSERT_COMPARE( binder, hash_len, binder_expected->x, binder_expected->len ); PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_record_protection( int ciphersuite, int endpoint, int ctr, int padding_used, data_t *server_write_key, data_t *server_write_iv, data_t *client_write_key, data_t *client_write_iv, data_t *plaintext, data_t *ciphertext ) { mbedtls_ssl_key_set keys; mbedtls_ssl_transform transform_send; mbedtls_ssl_transform transform_recv; mbedtls_record rec; unsigned char *buf = NULL; size_t buf_len; int other_endpoint; USE_PSA_INIT( ); TEST_ASSERT( endpoint == MBEDTLS_SSL_IS_CLIENT || endpoint == MBEDTLS_SSL_IS_SERVER ); if( endpoint == MBEDTLS_SSL_IS_SERVER ) other_endpoint = MBEDTLS_SSL_IS_CLIENT; if( endpoint == MBEDTLS_SSL_IS_CLIENT ) other_endpoint = MBEDTLS_SSL_IS_SERVER; TEST_ASSERT( server_write_key->len == client_write_key->len ); TEST_ASSERT( server_write_iv->len == client_write_iv->len ); memcpy( keys.client_write_key, client_write_key->x, client_write_key->len ); memcpy( keys.client_write_iv, client_write_iv->x, client_write_iv->len ); memcpy( keys.server_write_key, server_write_key->x, server_write_key->len ); memcpy( keys.server_write_iv, server_write_iv->x, server_write_iv->len ); keys.key_len = server_write_key->len; keys.iv_len = server_write_iv->len; mbedtls_ssl_transform_init( &transform_recv ); mbedtls_ssl_transform_init( &transform_send ); TEST_ASSERT( mbedtls_ssl_tls13_populate_transform( &transform_send, endpoint, ciphersuite, &keys, NULL ) == 0 ); TEST_ASSERT( mbedtls_ssl_tls13_populate_transform( &transform_recv, other_endpoint, ciphersuite, &keys, NULL ) == 0 ); /* Make sure we have enough space in the buffer even if * we use more padding than the KAT. */ buf_len = ciphertext->len + MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY; ASSERT_ALLOC( buf, buf_len ); rec.type = MBEDTLS_SSL_MSG_APPLICATION_DATA; /* TLS 1.3 uses the version identifier from TLS 1.2 on the wire. */ mbedtls_ssl_write_version( rec.ver, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_VERSION_TLS1_2 ); /* Copy plaintext into record structure */ rec.buf = buf; rec.buf_len = buf_len; rec.data_offset = 0; TEST_ASSERT( plaintext->len <= ciphertext->len ); memcpy( rec.buf + rec.data_offset, plaintext->x, plaintext->len ); rec.data_len = plaintext->len; #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) rec.cid_len = 0; #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ memset( &rec.ctr[0], 0, 8 ); rec.ctr[7] = ctr; TEST_ASSERT( mbedtls_ssl_encrypt_buf( NULL, &transform_send, &rec, NULL, NULL ) == 0 ); if( padding_used == MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY ) { ASSERT_COMPARE( rec.buf + rec.data_offset, rec.data_len, ciphertext->x, ciphertext->len ); } TEST_ASSERT( mbedtls_ssl_decrypt_buf( NULL, &transform_recv, &rec ) == 0 ); ASSERT_COMPARE( rec.buf + rec.data_offset, rec.data_len, plaintext->x, plaintext->len ); mbedtls_free( buf ); mbedtls_ssl_transform_free( &transform_send ); mbedtls_ssl_transform_free( &transform_recv ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ void ssl_tls13_key_evolution( int hash_alg, data_t *secret, data_t *input, data_t *expected ) { unsigned char secret_new[ MBEDTLS_MD_MAX_SIZE ]; PSA_INIT(); TEST_ASSERT( mbedtls_ssl_tls13_evolve_secret( (psa_algorithm_t) hash_alg, secret->len ? secret->x : NULL, input->len ? input->x : NULL, input->len, secret_new ) == 0 ); ASSERT_COMPARE( secret_new, (size_t) expected->len, expected->x, (size_t) expected->len ); PSA_DONE(); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2 */ void ssl_tls_prf( int type, data_t * secret, data_t * random, char *label, data_t *result_str, int exp_ret ) { unsigned char *output; output = mbedtls_calloc( 1, result_str->len ); if( output == NULL ) goto exit; USE_PSA_INIT( ); TEST_ASSERT( mbedtls_ssl_tls_prf( type, secret->x, secret->len, label, random->x, random->len, output, result_str->len ) == exp_ret ); if( exp_ret == 0 ) { TEST_ASSERT( mbedtls_test_hexcmp( output, result_str->x, result_str->len, result_str->len ) == 0 ); } exit: mbedtls_free( output ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_serialize_session_save_load( int ticket_len, char *crt_file, int endpoint_type, int tls_version ) { mbedtls_ssl_session original, restored; unsigned char *buf = NULL; size_t len; /* * Test that a save-load pair is the identity */ mbedtls_ssl_session_init( &original ); mbedtls_ssl_session_init( &restored ); /* Prepare a dummy session to work on */ ((void) endpoint_type); ((void) tls_version); #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 ) { TEST_ASSERT( ssl_tls13_populate_session( &original, 0, endpoint_type ) == 0 ); } else #endif { TEST_ASSERT( ssl_tls12_populate_session( &original, ticket_len, crt_file ) == 0 ); } /* Serialize it */ TEST_ASSERT( mbedtls_ssl_session_save( &original, NULL, 0, &len ) == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); TEST_ASSERT( ( buf = mbedtls_calloc( 1, len ) ) != NULL ); TEST_ASSERT( mbedtls_ssl_session_save( &original, buf, len, &len ) == 0 ); /* Restore session from serialized data */ TEST_ASSERT( mbedtls_ssl_session_load( &restored, buf, len) == 0 ); /* * Make sure both session structures are identical */ #if defined(MBEDTLS_HAVE_TIME) TEST_ASSERT( original.start == restored.start ); #endif TEST_ASSERT( original.tls_version == restored.tls_version ); TEST_ASSERT( original.ciphersuite == restored.ciphersuite ); #if defined(MBEDTLS_SSL_PROTO_TLS1_2) if( tls_version == MBEDTLS_SSL_VERSION_TLS1_2 ) { TEST_ASSERT( original.id_len == restored.id_len ); TEST_ASSERT( memcmp( original.id, restored.id, sizeof( original.id ) ) == 0 ); TEST_ASSERT( memcmp( original.master, restored.master, sizeof( original.master ) ) == 0 ); #if defined(MBEDTLS_X509_CRT_PARSE_C) #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) TEST_ASSERT( ( original.peer_cert == NULL ) == ( restored.peer_cert == NULL ) ); if( original.peer_cert != NULL ) { TEST_ASSERT( original.peer_cert->raw.len == restored.peer_cert->raw.len ); TEST_ASSERT( memcmp( original.peer_cert->raw.p, restored.peer_cert->raw.p, original.peer_cert->raw.len ) == 0 ); } #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ TEST_ASSERT( original.peer_cert_digest_type == restored.peer_cert_digest_type ); TEST_ASSERT( original.peer_cert_digest_len == restored.peer_cert_digest_len ); TEST_ASSERT( ( original.peer_cert_digest == NULL ) == ( restored.peer_cert_digest == NULL ) ); if( original.peer_cert_digest != NULL ) { TEST_ASSERT( memcmp( original.peer_cert_digest, restored.peer_cert_digest, original.peer_cert_digest_len ) == 0 ); } #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ #endif /* MBEDTLS_X509_CRT_PARSE_C */ TEST_ASSERT( original.verify_result == restored.verify_result ); #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) TEST_ASSERT( original.mfl_code == restored.mfl_code ); #endif #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) TEST_ASSERT( original.encrypt_then_mac == restored.encrypt_then_mac ); #endif #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) TEST_ASSERT( original.ticket_len == restored.ticket_len ); if( original.ticket_len != 0 ) { TEST_ASSERT( original.ticket != NULL ); TEST_ASSERT( restored.ticket != NULL ); TEST_ASSERT( memcmp( original.ticket, restored.ticket, original.ticket_len ) == 0 ); } TEST_ASSERT( original.ticket_lifetime == restored.ticket_lifetime ); #endif } #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 ) { TEST_ASSERT( original.endpoint == restored.endpoint ); TEST_ASSERT( original.ciphersuite == restored.ciphersuite ); TEST_ASSERT( original.ticket_age_add == restored.ticket_age_add ); TEST_ASSERT( original.ticket_flags == restored.ticket_flags ); TEST_ASSERT( original.resumption_key_len == restored.resumption_key_len ); if( original.resumption_key_len != 0 ) { TEST_ASSERT( original.resumption_key != NULL ); TEST_ASSERT( restored.resumption_key != NULL ); TEST_ASSERT( memcmp( original.resumption_key, restored.resumption_key, original.resumption_key_len ) == 0 ); } #if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C) if( endpoint_type == MBEDTLS_SSL_IS_SERVER ) { TEST_ASSERT( original.start == restored.start ); } #endif #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) if( endpoint_type == MBEDTLS_SSL_IS_CLIENT) { #if defined(MBEDTLS_HAVE_TIME) TEST_ASSERT( original.ticket_received == restored.ticket_received ); #endif TEST_ASSERT( original.ticket_lifetime == restored.ticket_lifetime ); TEST_ASSERT( original.ticket_len == restored.ticket_len ); if( original.ticket_len != 0 ) { TEST_ASSERT( original.ticket != NULL ); TEST_ASSERT( restored.ticket != NULL ); TEST_ASSERT( memcmp( original.ticket, restored.ticket, original.ticket_len ) == 0 ); } } #endif } #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ exit: mbedtls_ssl_session_free( &original ); mbedtls_ssl_session_free( &restored ); mbedtls_free( buf ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_serialize_session_load_save( int ticket_len, char *crt_file, int endpoint_type, int tls_version ) { mbedtls_ssl_session session; unsigned char *buf1 = NULL, *buf2 = NULL; size_t len0, len1, len2; /* * Test that a load-save pair is the identity */ mbedtls_ssl_session_init( &session ); /* Prepare a dummy session to work on */ ((void) endpoint_type); ((void) tls_version); #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if(tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { TEST_ASSERT( ssl_tls13_populate_session( &session, 0, endpoint_type ) == 0 ); } else #endif { TEST_ASSERT( ssl_tls12_populate_session( &session, ticket_len, crt_file ) == 0 ); } /* Get desired buffer size for serializing */ TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &len0 ) == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); /* Allocate first buffer */ buf1 = mbedtls_calloc( 1, len0 ); TEST_ASSERT( buf1 != NULL ); /* Serialize to buffer and free live session */ TEST_ASSERT( mbedtls_ssl_session_save( &session, buf1, len0, &len1 ) == 0 ); TEST_ASSERT( len0 == len1 ); mbedtls_ssl_session_free( &session ); /* Restore session from serialized data */ TEST_ASSERT( mbedtls_ssl_session_load( &session, buf1, len1 ) == 0 ); /* Allocate second buffer and serialize to it */ buf2 = mbedtls_calloc( 1, len0 ); TEST_ASSERT( buf2 != NULL ); TEST_ASSERT( mbedtls_ssl_session_save( &session, buf2, len0, &len2 ) == 0 ); /* Make sure both serialized versions are identical */ TEST_ASSERT( len1 == len2 ); TEST_ASSERT( memcmp( buf1, buf2, len1 ) == 0 ); exit: mbedtls_ssl_session_free( &session ); mbedtls_free( buf1 ); mbedtls_free( buf2 ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_serialize_session_save_buf_size( int ticket_len, char *crt_file, int endpoint_type, int tls_version ) { mbedtls_ssl_session session; unsigned char *buf = NULL; size_t good_len, bad_len, test_len; /* * Test that session_save() fails cleanly on small buffers */ mbedtls_ssl_session_init( &session ); /* Prepare dummy session and get serialized size */ ((void) endpoint_type); ((void) tls_version); #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if(tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { TEST_ASSERT( ssl_tls13_populate_session( &session, 0, endpoint_type ) == 0 ); } else #endif { TEST_ASSERT( ssl_tls12_populate_session( &session, ticket_len, crt_file ) == 0 ); } TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &good_len ) == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); /* Try all possible bad lengths */ for( bad_len = 1; bad_len < good_len; bad_len++ ) { /* Allocate exact size so that asan/valgrind can detect any overwrite */ mbedtls_free( buf ); TEST_ASSERT( ( buf = mbedtls_calloc( 1, bad_len ) ) != NULL ); TEST_ASSERT( mbedtls_ssl_session_save( &session, buf, bad_len, &test_len ) == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); TEST_ASSERT( test_len == good_len ); } exit: mbedtls_ssl_session_free( &session ); mbedtls_free( buf ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_serialize_session_load_buf_size( int ticket_len, char *crt_file, int endpoint_type, int tls_version ) { mbedtls_ssl_session session; unsigned char *good_buf = NULL, *bad_buf = NULL; size_t good_len, bad_len; /* * Test that session_load() fails cleanly on small buffers */ mbedtls_ssl_session_init( &session ); /* Prepare serialized session data */ ((void) endpoint_type); ((void) tls_version); #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if(tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { TEST_ASSERT( ssl_tls13_populate_session( &session, 0, endpoint_type ) == 0 ); } else #endif { TEST_ASSERT( ssl_tls12_populate_session( &session, ticket_len, crt_file ) == 0 ); } TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &good_len ) == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); TEST_ASSERT( ( good_buf = mbedtls_calloc( 1, good_len ) ) != NULL ); TEST_ASSERT( mbedtls_ssl_session_save( &session, good_buf, good_len, &good_len ) == 0 ); mbedtls_ssl_session_free( &session ); /* Try all possible bad lengths */ for( bad_len = 0; bad_len < good_len; bad_len++ ) { /* Allocate exact size so that asan/valgrind can detect any overread */ mbedtls_free( bad_buf ); bad_buf = mbedtls_calloc( 1, bad_len ? bad_len : 1 ); TEST_ASSERT( bad_buf != NULL ); memcpy( bad_buf, good_buf, bad_len ); TEST_ASSERT( mbedtls_ssl_session_load( &session, bad_buf, bad_len ) == MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); } exit: mbedtls_ssl_session_free( &session ); mbedtls_free( good_buf ); mbedtls_free( bad_buf ); } /* END_CASE */ /* BEGIN_CASE */ void ssl_session_serialize_version_check( int corrupt_major, int corrupt_minor, int corrupt_patch, int corrupt_config, int endpoint_type, int tls_version ) { unsigned char serialized_session[ 2048 ]; size_t serialized_session_len; unsigned cur_byte; mbedtls_ssl_session session; uint8_t should_corrupt_byte[] = { corrupt_major == 1, corrupt_minor == 1, corrupt_patch == 1, corrupt_config == 1, corrupt_config == 1 }; mbedtls_ssl_session_init( &session ); ((void) endpoint_type); ((void) tls_version); #if defined(MBEDTLS_SSL_PROTO_TLS1_3) if(tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { TEST_ASSERT( ssl_tls13_populate_session( &session, 0, endpoint_type ) == 0 ); } else #endif TEST_ASSERT( ssl_tls12_populate_session( &session, 0, NULL ) == 0 ); /* Infer length of serialized session. */ TEST_ASSERT( mbedtls_ssl_session_save( &session, serialized_session, sizeof( serialized_session ), &serialized_session_len ) == 0 ); mbedtls_ssl_session_free( &session ); /* Without any modification, we should be able to successfully * de-serialize the session - double-check that. */ TEST_ASSERT( mbedtls_ssl_session_load( &session, serialized_session, serialized_session_len ) == 0 ); mbedtls_ssl_session_free( &session ); /* Go through the bytes in the serialized session header and * corrupt them bit-by-bit. */ for( cur_byte = 0; cur_byte < sizeof( should_corrupt_byte ); cur_byte++ ) { int cur_bit; unsigned char * const byte = &serialized_session[ cur_byte ]; if( should_corrupt_byte[ cur_byte ] == 0 ) continue; for( cur_bit = 0; cur_bit < CHAR_BIT; cur_bit++ ) { unsigned char const corrupted_bit = 0x1u << cur_bit; /* Modify a single bit in the serialized session. */ *byte ^= corrupted_bit; /* Attempt to deserialize */ TEST_ASSERT( mbedtls_ssl_session_load( &session, serialized_session, serialized_session_len ) == MBEDTLS_ERR_SSL_VERSION_MISMATCH ); /* Undo the change */ *byte ^= corrupted_bit; } } } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15*/ void mbedtls_endpoint_sanity( int endpoint_type ) { enum { BUFFSIZE = 1024 }; mbedtls_endpoint ep; int ret = -1; handshake_test_options options; init_handshake_options( &options ); options.pk_alg = MBEDTLS_PK_RSA; ret = mbedtls_endpoint_init( NULL, endpoint_type, &options, NULL, NULL, NULL, NULL ); TEST_ASSERT( MBEDTLS_ERR_SSL_BAD_INPUT_DATA == ret ); ret = mbedtls_endpoint_certificate_init( NULL, options.pk_alg, 0, 0, 0 ); TEST_ASSERT( MBEDTLS_ERR_SSL_BAD_INPUT_DATA == ret ); ret = mbedtls_endpoint_init( &ep, endpoint_type, &options, NULL, NULL, NULL, NULL ); TEST_ASSERT( ret == 0 ); exit: mbedtls_endpoint_free( &ep, NULL ); free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_PKCS1_V15 */ void move_handshake_to_state(int endpoint_type, int state, int need_pass) { enum { BUFFSIZE = 1024 }; mbedtls_endpoint base_ep, second_ep; int ret = -1; handshake_test_options options; init_handshake_options( &options ); options.pk_alg = MBEDTLS_PK_RSA; USE_PSA_INIT( ); ret = mbedtls_endpoint_init( &base_ep, endpoint_type, &options, NULL, NULL, NULL, NULL ); TEST_ASSERT( ret == 0 ); ret = mbedtls_endpoint_init( &second_ep, ( endpoint_type == MBEDTLS_SSL_IS_SERVER ) ? MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER, &options, NULL, NULL, NULL, NULL ); TEST_ASSERT( ret == 0 ); ret = mbedtls_mock_socket_connect( &(base_ep.socket), &(second_ep.socket), BUFFSIZE ); TEST_ASSERT( ret == 0 ); ret = mbedtls_move_handshake_to_state( &(base_ep.ssl), &(second_ep.ssl), state ); if( need_pass ) { TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE ); TEST_ASSERT( base_ep.ssl.state == state ); } else { TEST_ASSERT( ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE ); TEST_ASSERT( base_ep.ssl.state != state ); } exit: free_handshake_options( &options ); mbedtls_endpoint_free( &base_ep, NULL ); mbedtls_endpoint_free( &second_ep, NULL ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */ void handshake_version( int dtls, int client_min_version, int client_max_version, int server_min_version, int server_max_version, int expected_negotiated_version ) { handshake_test_options options; init_handshake_options( &options ); options.client_min_version = client_min_version; options.client_max_version = client_max_version; options.server_min_version = server_min_version; options.server_max_version = server_max_version; options.expected_negotiated_version = expected_negotiated_version; options.dtls = dtls; perform_handshake( &options ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; exit: free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2 */ void handshake_psk_cipher( char* cipher, int pk_alg, data_t *psk_str, int dtls ) { handshake_test_options options; init_handshake_options( &options ); options.cipher = cipher; options.dtls = dtls; options.psk_str = psk_str; options.pk_alg = pk_alg; perform_handshake( &options ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; exit: free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2 */ void handshake_cipher( char* cipher, int pk_alg, int dtls ) { test_handshake_psk_cipher( cipher, pk_alg, NULL, dtls ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2 */ void handshake_ciphersuite_select( char* cipher, int pk_alg, data_t *psk_str, int psa_alg, int psa_alg2, int psa_usage, int expected_handshake_result, int expected_ciphersuite ) { handshake_test_options options; init_handshake_options( &options ); options.cipher = cipher; options.psk_str = psk_str; options.pk_alg = pk_alg; options.opaque_alg = psa_alg; options.opaque_alg2 = psa_alg2; options.opaque_usage = psa_usage; options.expected_handshake_result = expected_handshake_result; options.expected_ciphersuite = expected_ciphersuite; perform_handshake( &options ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; exit: free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */ void app_data( int mfl, int cli_msg_len, int srv_msg_len, int expected_cli_fragments, int expected_srv_fragments, int dtls ) { handshake_test_options options; init_handshake_options( &options ); options.mfl = mfl; options.cli_msg_len = cli_msg_len; options.srv_msg_len = srv_msg_len; options.expected_cli_fragments = expected_cli_fragments; options.expected_srv_fragments = expected_srv_fragments; options.dtls = dtls; #if ! defined(MBEDTLS_SSL_PROTO_TLS1_2) options.expected_negotiated_version = MBEDTLS_SSL_VERSION_TLS1_3; #endif perform_handshake( &options ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; exit: free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */ void app_data_tls( int mfl, int cli_msg_len, int srv_msg_len, int expected_cli_fragments, int expected_srv_fragments ) { test_app_data( mfl, cli_msg_len, srv_msg_len, expected_cli_fragments, expected_srv_fragments, 0 ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS */ void app_data_dtls( int mfl, int cli_msg_len, int srv_msg_len, int expected_cli_fragments, int expected_srv_fragments ) { test_app_data( mfl, cli_msg_len, srv_msg_len, expected_cli_fragments, expected_srv_fragments, 1 ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_CONTEXT_SERIALIZATION */ void handshake_serialization( ) { handshake_test_options options; init_handshake_options( &options ); options.serialize = 1; options.dtls = 1; perform_handshake( &options ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; exit: free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:MBEDTLS_CIPHER_MODE_CBC */ void handshake_fragmentation( int mfl, int expected_srv_hs_fragmentation, int expected_cli_hs_fragmentation) { handshake_test_options options; log_pattern srv_pattern, cli_pattern; srv_pattern.pattern = cli_pattern.pattern = "found fragmented DTLS handshake"; srv_pattern.counter = 0; cli_pattern.counter = 0; init_handshake_options( &options ); options.dtls = 1; options.mfl = mfl; /* Set cipher to one using CBC so that record splitting can be tested */ options.cipher = "TLS-DHE-RSA-WITH-AES-256-CBC-SHA256"; options.srv_auth_mode = MBEDTLS_SSL_VERIFY_REQUIRED; options.srv_log_obj = &srv_pattern; options.cli_log_obj = &cli_pattern; options.srv_log_fun = log_analyzer; options.cli_log_fun = log_analyzer; perform_handshake( &options ); /* Test if the server received a fragmented handshake */ if( expected_srv_hs_fragmentation ) { TEST_ASSERT( srv_pattern.counter >= 1 ); } /* Test if the client received a fragmented handshake */ if( expected_cli_hs_fragmentation ) { TEST_ASSERT( cli_pattern.counter >= 1 ); } exit: free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION */ void renegotiation( int legacy_renegotiation ) { handshake_test_options options; init_handshake_options( &options ); options.renegotiate = 1; options.legacy_renegotiation = legacy_renegotiation; options.dtls = 1; perform_handshake( &options ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; exit: free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */ void resize_buffers( int mfl, int renegotiation, int legacy_renegotiation, int serialize, int dtls, char *cipher ) { handshake_test_options options; init_handshake_options( &options ); options.mfl = mfl; options.cipher = cipher; options.renegotiate = renegotiation; options.legacy_renegotiation = legacy_renegotiation; options.serialize = serialize; options.dtls = dtls; options.resize_buffers = 1; perform_handshake( &options ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; exit: free_handshake_options( &options ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_CONTEXT_SERIALIZATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS */ void resize_buffers_serialize_mfl( int mfl ) { test_resize_buffers( mfl, 0, MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION, 1, 1, (char *) "" ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */ void resize_buffers_renegotiate_mfl( int mfl, int legacy_renegotiation, char *cipher ) { test_resize_buffers( mfl, 1, legacy_renegotiation, 0, 1, cipher ); /* The goto below is used to avoid an "unused label" warning.*/ goto exit; } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC:MBEDTLS_TEST_HOOKS */ void ssl_cf_hmac( int hash ) { /* * Test the function mbedtls_ct_hmac() against a reference * implementation. */ #if defined(MBEDTLS_USE_PSA_CRYPTO) mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_algorithm_t alg; psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; #else mbedtls_md_context_t ctx, ref_ctx; const mbedtls_md_info_t *md_info; #endif /* MBEDTLS_USE_PSA_CRYPTO */ size_t out_len, block_size; size_t min_in_len, in_len, max_in_len, i; /* TLS additional data is 13 bytes (hence the "lucky 13" name) */ unsigned char add_data[13]; unsigned char ref_out[MBEDTLS_HASH_MAX_SIZE]; unsigned char *data = NULL; unsigned char *out = NULL; unsigned char rec_num = 0; USE_PSA_INIT( ); #if defined(MBEDTLS_USE_PSA_CRYPTO) alg = PSA_ALG_HMAC( mbedtls_hash_info_psa_from_md( hash ) ); out_len = PSA_HASH_LENGTH( alg ); block_size = PSA_HASH_BLOCK_LENGTH( alg ); /* mbedtls_ct_hmac() requires the key to be exportable */ psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_VERIFY_HASH ); psa_set_key_algorithm( &attributes, PSA_ALG_HMAC( alg ) ); psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC ); #else mbedtls_md_init( &ctx ); mbedtls_md_init( &ref_ctx ); md_info = mbedtls_md_info_from_type( hash ); TEST_ASSERT( md_info != NULL ); out_len = mbedtls_md_get_size( md_info ); TEST_ASSERT( out_len != 0 ); block_size = hash == MBEDTLS_MD_SHA384 ? 128 : 64; #endif /* MBEDTLS_USE_PSA_CRYPTO */ /* Use allocated out buffer to catch overwrites */ ASSERT_ALLOC( out, out_len ); #if defined(MBEDTLS_USE_PSA_CRYPTO) /* Set up dummy key */ memset( ref_out, 42, sizeof( ref_out ) ); TEST_EQUAL( PSA_SUCCESS, psa_import_key( &attributes, ref_out, out_len, &key ) ); #else /* Set up contexts with the given hash and a dummy key */ TEST_EQUAL( 0, mbedtls_md_setup( &ctx, md_info, 1 ) ); TEST_EQUAL( 0, mbedtls_md_setup( &ref_ctx, md_info, 1 ) ); memset( ref_out, 42, sizeof( ref_out ) ); TEST_EQUAL( 0, mbedtls_md_hmac_starts( &ctx, ref_out, out_len ) ); TEST_EQUAL( 0, mbedtls_md_hmac_starts( &ref_ctx, ref_out, out_len ) ); memset( ref_out, 0, sizeof( ref_out ) ); #endif /* * Test all possible lengths up to a point. The difference between * max_in_len and min_in_len is at most 255, and make sure they both vary * by at least one block size. */ for( max_in_len = 0; max_in_len <= 255 + block_size; max_in_len++ ) { mbedtls_test_set_step( max_in_len * 10000 ); /* Use allocated in buffer to catch overreads */ ASSERT_ALLOC( data, max_in_len ); min_in_len = max_in_len > 255 ? max_in_len - 255 : 0; for( in_len = min_in_len; in_len <= max_in_len; in_len++ ) { mbedtls_test_set_step( max_in_len * 10000 + in_len ); /* Set up dummy data and add_data */ rec_num++; memset( add_data, rec_num, sizeof( add_data ) ); for( i = 0; i < in_len; i++ ) data[i] = ( i & 0xff ) ^ rec_num; /* Get the function's result */ TEST_CF_SECRET( &in_len, sizeof( in_len ) ); #if defined(MBEDTLS_USE_PSA_CRYPTO) TEST_EQUAL( 0, mbedtls_ct_hmac( key, PSA_ALG_HMAC( alg ), add_data, sizeof( add_data ), data, in_len, min_in_len, max_in_len, out ) ); #else TEST_EQUAL( 0, mbedtls_ct_hmac( &ctx, add_data, sizeof( add_data ), data, in_len, min_in_len, max_in_len, out ) ); #endif /* MBEDTLS_USE_PSA_CRYPTO */ TEST_CF_PUBLIC( &in_len, sizeof( in_len ) ); TEST_CF_PUBLIC( out, out_len ); #if defined(MBEDTLS_USE_PSA_CRYPTO) TEST_EQUAL( PSA_SUCCESS, psa_mac_verify_setup( &operation, key, alg ) ); TEST_EQUAL( PSA_SUCCESS, psa_mac_update( &operation, add_data, sizeof( add_data ) ) ); TEST_EQUAL( PSA_SUCCESS, psa_mac_update( &operation, data, in_len ) ); TEST_EQUAL( PSA_SUCCESS, psa_mac_verify_finish( &operation, out, out_len ) ); #else /* Compute the reference result */ TEST_EQUAL( 0, mbedtls_md_hmac_update( &ref_ctx, add_data, sizeof( add_data ) ) ); TEST_EQUAL( 0, mbedtls_md_hmac_update( &ref_ctx, data, in_len ) ); TEST_EQUAL( 0, mbedtls_md_hmac_finish( &ref_ctx, ref_out ) ); TEST_EQUAL( 0, mbedtls_md_hmac_reset( &ref_ctx ) ); /* Compare */ ASSERT_COMPARE( out, out_len, ref_out, out_len ); #endif /* MBEDTLS_USE_PSA_CRYPTO */ } mbedtls_free( data ); data = NULL; } exit: #if defined(MBEDTLS_USE_PSA_CRYPTO) psa_mac_abort( &operation ); psa_destroy_key( key ); #else mbedtls_md_free( &ref_ctx ); mbedtls_md_free( &ctx ); #endif /* MBEDTLS_USE_PSA_CRYPTO */ mbedtls_free( data ); mbedtls_free( out ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC:MBEDTLS_TEST_HOOKS */ void ssl_cf_memcpy_offset( int offset_min, int offset_max, int len ) { unsigned char *dst = NULL; unsigned char *src = NULL; size_t src_len = offset_max + len; size_t secret; ASSERT_ALLOC( dst, len ); ASSERT_ALLOC( src, src_len ); /* Fill src in a way that we can detect if we copied the right bytes */ mbedtls_test_rnd_std_rand( NULL, src, src_len ); for( secret = offset_min; secret <= (size_t) offset_max; secret++ ) { mbedtls_test_set_step( (int) secret ); TEST_CF_SECRET( &secret, sizeof( secret ) ); mbedtls_ct_memcpy_offset( dst, src, secret, offset_min, offset_max, len ); TEST_CF_PUBLIC( &secret, sizeof( secret ) ); TEST_CF_PUBLIC( dst, len ); ASSERT_COMPARE( dst, len, src + secret, len ); } exit: mbedtls_free( dst ); mbedtls_free( src ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ void test_multiple_psks() { unsigned char psk0[10] = { 0 }; unsigned char psk0_identity[] = { 'f', 'o', 'o' }; unsigned char psk1[10] = { 0 }; unsigned char psk1_identity[] = { 'b', 'a', 'r' }; mbedtls_ssl_config conf; USE_PSA_INIT( ); mbedtls_ssl_config_init( &conf ); TEST_ASSERT( mbedtls_ssl_conf_psk( &conf, psk0, sizeof( psk0 ), psk0_identity, sizeof( psk0_identity ) ) == 0 ); TEST_ASSERT( mbedtls_ssl_conf_psk( &conf, psk1, sizeof( psk1 ), psk1_identity, sizeof( psk1_identity ) ) == MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); exit: mbedtls_ssl_config_free( &conf ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED:MBEDTLS_USE_PSA_CRYPTO */ void test_multiple_psks_opaque( int mode ) { /* * Mode 0: Raw PSK, then opaque PSK * Mode 1: Opaque PSK, then raw PSK * Mode 2: 2x opaque PSK */ unsigned char psk0_raw[10] = { 0 }; unsigned char psk0_raw_identity[] = { 'f', 'o', 'o' }; mbedtls_svc_key_id_t psk0_opaque = mbedtls_svc_key_id_make( 0x1, (psa_key_id_t) 1 ); unsigned char psk0_opaque_identity[] = { 'f', 'o', 'o' }; unsigned char psk1_raw[10] = { 0 }; unsigned char psk1_raw_identity[] = { 'b', 'a', 'r' }; mbedtls_svc_key_id_t psk1_opaque = mbedtls_svc_key_id_make( 0x1, (psa_key_id_t) 2 ); unsigned char psk1_opaque_identity[] = { 'b', 'a', 'r' }; mbedtls_ssl_config conf; USE_PSA_INIT( ); mbedtls_ssl_config_init( &conf ); switch( mode ) { case 0: TEST_ASSERT( mbedtls_ssl_conf_psk( &conf, psk0_raw, sizeof( psk0_raw ), psk0_raw_identity, sizeof( psk0_raw_identity ) ) == 0 ); TEST_ASSERT( mbedtls_ssl_conf_psk_opaque( &conf, psk1_opaque, psk1_opaque_identity, sizeof( psk1_opaque_identity ) ) == MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); break; case 1: TEST_ASSERT( mbedtls_ssl_conf_psk_opaque( &conf, psk0_opaque, psk0_opaque_identity, sizeof( psk0_opaque_identity ) ) == 0 ); TEST_ASSERT( mbedtls_ssl_conf_psk( &conf, psk1_raw, sizeof( psk1_raw ), psk1_raw_identity, sizeof( psk1_raw_identity ) ) == MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); break; case 2: TEST_ASSERT( mbedtls_ssl_conf_psk_opaque( &conf, psk0_opaque, psk0_opaque_identity, sizeof( psk0_opaque_identity ) ) == 0 ); TEST_ASSERT( mbedtls_ssl_conf_psk_opaque( &conf, psk1_opaque, psk1_opaque_identity, sizeof( psk1_opaque_identity ) ) == MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); break; default: TEST_ASSERT( 0 ); break; } exit: mbedtls_ssl_config_free( &conf ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE */ void conf_version( int endpoint, int transport, int min_tls_version, int max_tls_version, int expected_ssl_setup_result ) { mbedtls_ssl_config conf; mbedtls_ssl_context ssl; mbedtls_ssl_config_init( &conf ); mbedtls_ssl_init( &ssl ); mbedtls_ssl_conf_endpoint( &conf, endpoint ); mbedtls_ssl_conf_transport( &conf, transport ); mbedtls_ssl_conf_min_tls_version( &conf, min_tls_version ); mbedtls_ssl_conf_max_tls_version( &conf, max_tls_version ); TEST_ASSERT( mbedtls_ssl_setup( &ssl, &conf ) == expected_ssl_setup_result ); mbedtls_ssl_free( &ssl ); mbedtls_ssl_config_free( &conf ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_ECP_C:!MBEDTLS_DEPRECATED_REMOVED:!MBEDTLS_DEPRECATED_WARNING:MBEDTLS_ECP_DP_SECP192R1_ENABLED:MBEDTLS_ECP_DP_SECP224R1_ENABLED:MBEDTLS_ECP_DP_SECP256R1_ENABLED */ void conf_curve() { mbedtls_ecp_group_id curve_list[] = { MBEDTLS_ECP_DP_SECP192R1, MBEDTLS_ECP_DP_SECP224R1, MBEDTLS_ECP_DP_SECP256R1, MBEDTLS_ECP_DP_NONE }; uint16_t iana_tls_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1, MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1, MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, MBEDTLS_SSL_IANA_TLS_GROUP_NONE }; mbedtls_ssl_config conf; mbedtls_ssl_config_init( &conf ); #if defined(MBEDTLS_SSL_PROTO_TLS1_2) mbedtls_ssl_conf_max_tls_version( &conf, MBEDTLS_SSL_VERSION_TLS1_2 ); mbedtls_ssl_conf_min_tls_version( &conf, MBEDTLS_SSL_VERSION_TLS1_2 ); #else mbedtls_ssl_conf_max_tls_version( &conf, MBEDTLS_SSL_VERSION_TLS1_3 ); mbedtls_ssl_conf_min_tls_version( &conf, MBEDTLS_SSL_VERSION_TLS1_3 ); #endif mbedtls_ssl_conf_curves( &conf, curve_list ); mbedtls_ssl_context ssl; mbedtls_ssl_init( &ssl ); TEST_ASSERT( mbedtls_ssl_setup( &ssl, &conf ) == 0 ); TEST_ASSERT( ssl.handshake != NULL && ssl.handshake->group_list != NULL ); TEST_ASSERT( ssl.conf != NULL && ssl.conf->group_list == NULL ); TEST_EQUAL( ssl.handshake->group_list[ARRAY_LENGTH( iana_tls_group_list ) - 1], MBEDTLS_SSL_IANA_TLS_GROUP_NONE ); for( size_t i = 0; i < ARRAY_LENGTH( iana_tls_group_list ); i++ ) TEST_EQUAL( iana_tls_group_list[i], ssl.handshake->group_list[i] ); mbedtls_ssl_free( &ssl ); mbedtls_ssl_config_free( &conf ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_DEPRECATED_REMOVED */ void conf_group() { uint16_t iana_tls_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1, MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1, MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, MBEDTLS_SSL_IANA_TLS_GROUP_NONE }; mbedtls_ssl_config conf; mbedtls_ssl_config_init( &conf ); mbedtls_ssl_conf_max_tls_version( &conf, MBEDTLS_SSL_VERSION_TLS1_2 ); mbedtls_ssl_conf_min_tls_version( &conf, MBEDTLS_SSL_VERSION_TLS1_2 ); mbedtls_ssl_conf_groups( &conf, iana_tls_group_list ); mbedtls_ssl_context ssl; mbedtls_ssl_init( &ssl ); TEST_ASSERT( mbedtls_ssl_setup( &ssl, &conf ) == 0 ); TEST_ASSERT( ssl.conf != NULL && ssl.conf->group_list != NULL ); TEST_EQUAL( ssl.conf->group_list[ARRAY_LENGTH( iana_tls_group_list ) - 1], MBEDTLS_SSL_IANA_TLS_GROUP_NONE ); for( size_t i = 0; i < ARRAY_LENGTH( iana_tls_group_list ); i++ ) TEST_EQUAL( iana_tls_group_list[i], ssl.conf->group_list[i] ); mbedtls_ssl_free( &ssl ); mbedtls_ssl_config_free( &conf ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_CACHE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_DEBUG_C:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_PKCS1_V15 */ void force_bad_session_id_len( ) { enum { BUFFSIZE = 1024 }; handshake_test_options options; mbedtls_endpoint client, server; log_pattern srv_pattern, cli_pattern; mbedtls_test_message_socket_context server_context, client_context; srv_pattern.pattern = cli_pattern.pattern = "cache did not store session"; srv_pattern.counter = 0; init_handshake_options( &options ); options.srv_log_obj = &srv_pattern; options.srv_log_fun = log_analyzer; USE_PSA_INIT( ); mbedtls_message_socket_init( &server_context ); mbedtls_message_socket_init( &client_context ); TEST_ASSERT( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, &options, NULL, NULL, NULL, NULL ) == 0 ); TEST_ASSERT( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, &options, NULL, NULL, NULL, NULL ) == 0 ); mbedtls_debug_set_threshold( 1 ); mbedtls_ssl_conf_dbg( &server.conf, options.srv_log_fun, options.srv_log_obj ); TEST_ASSERT( mbedtls_mock_socket_connect( &(client.socket), &(server.socket), BUFFSIZE ) == 0 ); TEST_ASSERT( mbedtls_move_handshake_to_state( &(client.ssl), &(server.ssl), MBEDTLS_SSL_HANDSHAKE_WRAPUP ) == 0 ); /* Force a bad session_id_len that will be read by the server in * mbedtls_ssl_cache_set. */ server.ssl.session_negotiate->id_len = 33; if( options.cli_msg_len != 0 || options.srv_msg_len != 0 ) { /* Start data exchanging test */ TEST_ASSERT( mbedtls_exchange_data( &(client.ssl), options.cli_msg_len, options.expected_cli_fragments, &(server.ssl), options.srv_msg_len, options.expected_srv_fragments ) == 0 ); } /* Make sure that the cache did not store the session */ TEST_EQUAL( srv_pattern.counter, 1 ); exit: mbedtls_endpoint_free( &client, NULL ); mbedtls_endpoint_free( &server, NULL ); free_handshake_options( &options ); mbedtls_debug_set_threshold( 0 ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE:MBEDTLS_TEST_HOOKS */ void cookie_parsing( data_t *cookie, int exp_ret ) { mbedtls_ssl_context ssl; mbedtls_ssl_config conf; size_t len; mbedtls_ssl_init( &ssl ); mbedtls_ssl_config_init( &conf ); TEST_EQUAL( mbedtls_ssl_config_defaults( &conf, MBEDTLS_SSL_IS_SERVER, MBEDTLS_SSL_TRANSPORT_DATAGRAM, MBEDTLS_SSL_PRESET_DEFAULT ), 0 ); TEST_EQUAL( mbedtls_ssl_setup( &ssl, &conf ), 0 ); TEST_EQUAL( mbedtls_ssl_check_dtls_clihlo_cookie( &ssl, ssl.cli_id, ssl.cli_id_len, cookie->x, cookie->len, ssl.out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len ), exp_ret ); mbedtls_ssl_free( &ssl ); mbedtls_ssl_config_free( &conf ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_TIMING_C:MBEDTLS_HAVE_TIME */ void timing_final_delay_accessor( ) { mbedtls_timing_delay_context delay_context; mbedtls_timing_set_delay( &delay_context, 50, 100 ); TEST_ASSERT( mbedtls_timing_get_final_delay( &delay_context ) == 100 ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_DTLS_CONNECTION_ID */ void cid_sanity( ) { mbedtls_ssl_context ssl; mbedtls_ssl_config conf; unsigned char own_cid[MBEDTLS_SSL_CID_IN_LEN_MAX]; unsigned char test_cid[MBEDTLS_SSL_CID_IN_LEN_MAX]; int cid_enabled; size_t own_cid_len; mbedtls_test_rnd_std_rand( NULL, own_cid, sizeof( own_cid ) ); mbedtls_ssl_init( &ssl ); mbedtls_ssl_config_init( &conf ); TEST_ASSERT( mbedtls_ssl_config_defaults( &conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT ) == 0 ); TEST_ASSERT( mbedtls_ssl_setup( &ssl, &conf ) == 0 ); /* Can't use CID functions with stream transport. */ TEST_ASSERT( mbedtls_ssl_set_cid( &ssl, MBEDTLS_SSL_CID_ENABLED, own_cid, sizeof( own_cid ) ) == MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); TEST_ASSERT( mbedtls_ssl_get_own_cid( &ssl, &cid_enabled, test_cid, &own_cid_len ) == MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); TEST_ASSERT( mbedtls_ssl_config_defaults( &conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_DATAGRAM, MBEDTLS_SSL_PRESET_DEFAULT ) == 0 ); /* Attempt to set config cid size too big. */ TEST_ASSERT( mbedtls_ssl_conf_cid( &conf, MBEDTLS_SSL_CID_IN_LEN_MAX + 1, MBEDTLS_SSL_UNEXPECTED_CID_IGNORE ) == MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); TEST_ASSERT( mbedtls_ssl_conf_cid( &conf, sizeof( own_cid ), MBEDTLS_SSL_UNEXPECTED_CID_IGNORE ) == 0 ); /* Attempt to set CID length not matching config. */ TEST_ASSERT( mbedtls_ssl_set_cid( &ssl, MBEDTLS_SSL_CID_ENABLED, own_cid, MBEDTLS_SSL_CID_IN_LEN_MAX - 1 ) == MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); TEST_ASSERT( mbedtls_ssl_set_cid( &ssl, MBEDTLS_SSL_CID_ENABLED, own_cid, sizeof( own_cid ) ) == 0 ); /* Test we get back what we put in. */ TEST_ASSERT( mbedtls_ssl_get_own_cid( &ssl, &cid_enabled, test_cid, &own_cid_len ) == 0 ); TEST_EQUAL( cid_enabled, MBEDTLS_SSL_CID_ENABLED ); ASSERT_COMPARE( own_cid, own_cid_len, test_cid, own_cid_len ); /* Test disabling works. */ TEST_ASSERT( mbedtls_ssl_set_cid( &ssl, MBEDTLS_SSL_CID_DISABLED, NULL, 0 ) == 0 ); TEST_ASSERT( mbedtls_ssl_get_own_cid( &ssl, &cid_enabled, test_cid, &own_cid_len ) == 0 ); TEST_EQUAL( cid_enabled, MBEDTLS_SSL_CID_DISABLED ); mbedtls_ssl_free( &ssl ); mbedtls_ssl_config_free( &conf ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ECP_C:MBEDTLS_ECDSA_C */ void raw_key_agreement_fail( int bad_server_ecdhe_key ) { enum { BUFFSIZE = 17000 }; mbedtls_endpoint client, server; mbedtls_psa_stats_t stats; size_t free_slots_before = -1; handshake_test_options options; uint16_t iana_tls_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, MBEDTLS_SSL_IANA_TLS_GROUP_NONE }; USE_PSA_INIT( ); init_handshake_options( &options ); options.pk_alg = MBEDTLS_PK_ECDSA; /* Client side, force SECP256R1 to make one key bitflip fail * the raw key agreement. Flipping the first byte makes the * required 0x04 identifier invalid. */ TEST_EQUAL( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, &options, NULL, NULL, NULL, iana_tls_group_list ), 0 ); /* Server side */ TEST_EQUAL( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, &options, NULL, NULL, NULL, NULL ), 0 ); TEST_EQUAL( mbedtls_mock_socket_connect( &(client.socket), &(server.socket), BUFFSIZE ), 0 ); TEST_EQUAL( mbedtls_move_handshake_to_state( &(client.ssl), &(server.ssl), MBEDTLS_SSL_CLIENT_KEY_EXCHANGE ) , 0 ); mbedtls_psa_get_stats( &stats ); /* Save the number of slots in use up to this point. * With PSA, one can be used for the ECDH private key. */ free_slots_before = stats.empty_slots; if( bad_server_ecdhe_key ) { /* Force a simulated bitflip in the server key. to make the * raw key agreement in ssl_write_client_key_exchange fail. */ (client.ssl).handshake->ecdh_psa_peerkey[0] ^= 0x02; } TEST_EQUAL( mbedtls_move_handshake_to_state( &(client.ssl), &(server.ssl), MBEDTLS_SSL_HANDSHAKE_OVER ), bad_server_ecdhe_key ? MBEDTLS_ERR_SSL_HW_ACCEL_FAILED : 0 ); mbedtls_psa_get_stats( &stats ); /* Make sure that the key slot is already destroyed in case of failure, * without waiting to close the connection. */ if( bad_server_ecdhe_key ) TEST_EQUAL( free_slots_before, stats.empty_slots ); exit: mbedtls_endpoint_free( &client, NULL ); mbedtls_endpoint_free( &server, NULL ); free_handshake_options( &options ); USE_PSA_DONE( ); } /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3:!MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */ void tls13_server_certificate_msg_invalid_vector_len( ) { int ret = -1; mbedtls_endpoint client_ep, server_ep; unsigned char *buf, *end; size_t buf_len; int step = 0; int expected_result; mbedtls_ssl_chk_buf_ptr_args expected_chk_buf_ptr_args; handshake_test_options client_options; handshake_test_options server_options; /* * Test set-up */ USE_PSA_INIT( ); init_handshake_options( &client_options ); client_options.pk_alg = MBEDTLS_PK_ECDSA; ret = mbedtls_endpoint_init( &client_ep, MBEDTLS_SSL_IS_CLIENT, &client_options, NULL, NULL, NULL, NULL ); TEST_EQUAL( ret, 0 ); init_handshake_options( &server_options ); server_options.pk_alg = MBEDTLS_PK_ECDSA; ret = mbedtls_endpoint_init( &server_ep, MBEDTLS_SSL_IS_SERVER, &server_options, NULL, NULL, NULL, NULL ); TEST_EQUAL( ret, 0 ); ret = mbedtls_mock_socket_connect( &(client_ep.socket), &(server_ep.socket), 1024 ); TEST_EQUAL( ret, 0 ); while( 1 ) { mbedtls_test_set_step( ++step ); ret = mbedtls_move_handshake_to_state( &(server_ep.ssl), &(client_ep.ssl), MBEDTLS_SSL_CERTIFICATE_VERIFY ); TEST_EQUAL( ret, 0 ); ret = mbedtls_ssl_flush_output( &(server_ep.ssl) ); TEST_EQUAL( ret, 0 ); ret = mbedtls_move_handshake_to_state( &(client_ep.ssl), &(server_ep.ssl), MBEDTLS_SSL_SERVER_CERTIFICATE ); TEST_EQUAL( ret, 0 ); ret = mbedtls_ssl_tls13_fetch_handshake_msg( &(client_ep.ssl), MBEDTLS_SSL_HS_CERTIFICATE, &buf, &buf_len ); TEST_EQUAL( ret, 0 ); end = buf + buf_len; /* * Tweak server Certificate message and parse it. */ ret = tweak_tls13_certificate_msg_vector_len( buf, &end, step, &expected_result, &expected_chk_buf_ptr_args ); if( ret != 0 ) break; ret = mbedtls_ssl_tls13_parse_certificate( &(client_ep.ssl), buf, end ); TEST_EQUAL( ret, expected_result ); TEST_ASSERT( mbedtls_ssl_cmp_chk_buf_ptr_fail_args( &expected_chk_buf_ptr_args ) == 0 ); mbedtls_ssl_reset_chk_buf_ptr_fail_args( ); ret = mbedtls_ssl_session_reset( &(client_ep.ssl) ); TEST_EQUAL( ret, 0 ); ret = mbedtls_ssl_session_reset( &(server_ep.ssl) ); TEST_EQUAL( ret, 0 ); } exit: mbedtls_ssl_reset_chk_buf_ptr_fail_args( ); mbedtls_endpoint_free( &client_ep, NULL ); mbedtls_endpoint_free( &server_ep, NULL ); free_handshake_options( &client_options ); free_handshake_options( &server_options ); USE_PSA_DONE( ); } /* END_CASE */