X-Git-Url: https://git.openssl.org/?a=blobdiff_plain;f=test%2Fsslapitest.c;h=876be310931f5507e1d847206aa89eef8146f453;hb=a8b2b52fe57249f5093e190eb40def9fed9c9627;hp=64f10cc1922f2a473e67a9d46402562794e9aa09;hpb=78fb5374e1cc0f1f1d49055150e5415727b155a7;p=openssl.git diff --git a/test/sslapitest.c b/test/sslapitest.c index 64f10cc192..876be31093 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -272,6 +272,7 @@ static int test_keylog(void) if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, &sctx, &cctx, cert, privkey))) return 0; @@ -349,9 +350,9 @@ static int test_keylog_no_master_key(void) server_log_buffer_index = 0; error_writing_log = 0; - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey))) return 0; if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL) @@ -452,9 +453,9 @@ static int test_client_hello_cb(void) SSL *clientssl = NULL, *serverssl = NULL; int testctr = 0, testresult = 0; - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey))) goto end; SSL_CTX_set_client_hello_cb(sctx, full_client_hello_callback, &testctr); @@ -490,7 +491,9 @@ end: #endif static int execute_test_large_message(const SSL_METHOD *smeth, - const SSL_METHOD *cmeth, int read_ahead) + const SSL_METHOD *cmeth, + int min_version, int max_version, + int read_ahead) { SSL_CTX *cctx = NULL, *sctx = NULL; SSL *clientssl = NULL, *serverssl = NULL; @@ -508,8 +511,8 @@ static int execute_test_large_message(const SSL_METHOD *smeth, if (!TEST_ptr(chaincert)) goto end; - if (!TEST_true(create_ssl_ctx_pair(smeth, cmeth, &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(smeth, cmeth, min_version, max_version, + &sctx, &cctx, cert, privkey))) goto end; if (read_ahead) { @@ -566,12 +569,14 @@ static int execute_test_large_message(const SSL_METHOD *smeth, static int test_large_message_tls(void) { return execute_test_large_message(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, 0); } static int test_large_message_tls_read_ahead(void) { return execute_test_large_message(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, 1); } @@ -583,7 +588,9 @@ static int test_large_message_dtls(void) * read_ahead is set. */ return execute_test_large_message(DTLS_server_method(), - DTLS_client_method(), 0); + DTLS_client_method(), + DTLS1_VERSION, DTLS_MAX_VERSION, + 0); } #endif @@ -642,8 +649,9 @@ static int test_tlsext_status_type(void) OCSP_RESPID *id = NULL; BIO *certbio = NULL; - if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), &sctx, - &cctx, cert, privkey)) + if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey)) return 0; if (SSL_CTX_get_tlsext_status_type(cctx) != -1) @@ -806,9 +814,9 @@ static int execute_test_session(int maxprot, int use_int_cache, new_called = remove_called = 0; - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey))) return 0; /* @@ -1341,9 +1349,9 @@ static int test_set_sigalgs(int idx) curr = testctx ? &testsigalgs[idx] : &testsigalgs[idx - OSSL_NELEM(testsigalgs)]; - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey))) return 0; /* @@ -1455,6 +1463,7 @@ static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id, return 1; } +#ifndef OPENSSL_NO_PSK static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *id, unsigned int max_id_len, unsigned char *psk, @@ -1482,6 +1491,7 @@ static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *id, return psklen; } +#endif /* OPENSSL_NO_PSK */ static int find_session_cb(SSL *ssl, const unsigned char *identity, size_t identity_len, SSL_SESSION **sess) @@ -1509,6 +1519,7 @@ static int find_session_cb(SSL *ssl, const unsigned char *identity, return 1; } +#ifndef OPENSSL_NO_PSK static unsigned int psk_server_cb(SSL *ssl, const char *identity, unsigned char *psk, unsigned int max_psk_len) { @@ -1535,6 +1546,7 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity, return psklen; } +#endif /* OPENSSL_NO_PSK */ #define MSG1 "Hello" #define MSG2 "World." @@ -1554,9 +1566,9 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity, static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl, SSL **serverssl, SSL_SESSION **sess, int idx) { - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), sctx, - cctx, cert, privkey)) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + sctx, cctx, cert, privkey)) || !TEST_true(SSL_CTX_set_max_early_data(*sctx, SSL3_RT_MAX_PLAIN_LENGTH)) || !TEST_true(SSL_CTX_set_max_early_data(*cctx, @@ -2427,6 +2439,87 @@ static int test_early_data_tls1_2(int idx) } # endif /* OPENSSL_NO_TLS1_2 */ +/* + * Test configuring the TLSv1.3 ciphersuites + * + * Test 0: Set a default ciphersuite in the SSL_CTX (no explicit cipher_list) + * Test 1: Set a non-default ciphersuite in the SSL_CTX (no explicit cipher_list) + * Test 2: Set a default ciphersuite in the SSL (no explicit cipher_list) + * Test 3: Set a non-default ciphersuite in the SSL (no explicit cipher_list) + * Test 4: Set a default ciphersuite in the SSL_CTX (SSL_CTX cipher_list) + * Test 5: Set a non-default ciphersuite in the SSL_CTX (SSL_CTX cipher_list) + * Test 6: Set a default ciphersuite in the SSL (SSL_CTX cipher_list) + * Test 7: Set a non-default ciphersuite in the SSL (SSL_CTX cipher_list) + * Test 8: Set a default ciphersuite in the SSL (SSL cipher_list) + * Test 9: Set a non-default ciphersuite in the SSL (SSL cipher_list) + */ +static int test_set_ciphersuite(int idx) +{ + SSL_CTX *cctx = NULL, *sctx = NULL; + SSL *clientssl = NULL, *serverssl = NULL; + int testresult = 0; + + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey)) + || !TEST_true(SSL_CTX_set_ciphersuites(sctx, + "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256"))) + goto end; + + if (idx >=4 && idx <= 7) { + /* SSL_CTX explicit cipher list */ + if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "AES256-GCM-SHA384"))) + goto end; + } + + if (idx == 0 || idx == 4) { + /* Default ciphersuite */ + if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, + "TLS_AES_128_GCM_SHA256"))) + goto end; + } else if (idx == 1 || idx == 5) { + /* Non default ciphersuite */ + if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, + "TLS_AES_128_CCM_SHA256"))) + goto end; + } + + if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, + &clientssl, NULL, NULL))) + goto end; + + if (idx == 8 || idx == 9) { + /* SSL explicit cipher list */ + if (!TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384"))) + goto end; + } + + if (idx == 2 || idx == 6 || idx == 8) { + /* Default ciphersuite */ + if (!TEST_true(SSL_set_ciphersuites(clientssl, + "TLS_AES_128_GCM_SHA256"))) + goto end; + } else if (idx == 3 || idx == 7 || idx == 9) { + /* Non default ciphersuite */ + if (!TEST_true(SSL_set_ciphersuites(clientssl, + "TLS_AES_128_CCM_SHA256"))) + goto end; + } + + if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) + goto end; + + testresult = 1; + + end: + SSL_free(serverssl); + SSL_free(clientssl); + SSL_CTX_free(sctx); + SSL_CTX_free(cctx); + + return testresult; +} + static int test_ciphersuite_change(void) { SSL_CTX *cctx = NULL, *sctx = NULL; @@ -2436,9 +2529,9 @@ static int test_ciphersuite_change(void) const SSL_CIPHER *aes_128_gcm_sha256 = NULL; /* Create a session based on SHA-256 */ - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey)) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey)) || !TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_128_GCM_SHA256")) || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, @@ -2569,9 +2662,9 @@ static int test_tls13_psk(int idx) }; int testresult = 0; - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey))) goto end; /* @@ -2590,10 +2683,12 @@ static int test_tls13_psk(int idx) SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb); SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb); } +#ifndef OPENSSL_NO_PSK if (idx == 1 || idx == 2) { SSL_CTX_set_psk_client_callback(cctx, psk_client_cb); SSL_CTX_set_psk_server_callback(sctx, psk_server_cb); } +#endif srvid = pskid; use_session_cb_cnt = 0; find_session_cb_cnt = 0; @@ -2802,9 +2897,9 @@ static int test_stateless(void) SSL *serverssl = NULL, *clientssl = NULL; int testresult = 0; - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey))) goto end; /* The arrival of CCS messages can confuse the test */ @@ -3026,14 +3121,15 @@ static int test_custom_exts(int tst) clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0; snicb = 0; - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey))) goto end; if (tst == 2 - && !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL, &sctx2, - NULL, cert, privkey))) + && !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL, + TLS1_VERSION, TLS_MAX_VERSION, + &sctx2, NULL, cert, privkey))) goto end; @@ -3302,9 +3398,9 @@ static int test_export_key_mat(int tst) if (tst == 3) return 1; #endif - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey))) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey))) goto end; OPENSSL_assert(tst >= 0 && (size_t)tst < OSSL_NELEM(protocols)); @@ -3482,9 +3578,9 @@ static int test_ssl_clear(int idx) #endif /* Create an initial connection */ - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), &sctx, - &cctx, cert, privkey)) + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, + &sctx, &cctx, cert, privkey)) || (idx == 1 && !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION))) @@ -3638,8 +3734,8 @@ static int test_pha_key_update(void) SSL *clientssl = NULL, *serverssl = NULL; int testresult = 0; - if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), - TLS_client_method(), + if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), + TLS1_VERSION, TLS_MAX_VERSION, &sctx, &cctx, cert, privkey))) return 0; @@ -3755,8 +3851,13 @@ int setup_tests(void) # endif #endif #ifndef OPENSSL_NO_TLS1_3 + ADD_ALL_TESTS(test_set_ciphersuite, 10); ADD_TEST(test_ciphersuite_change); +#ifdef OPENSSL_NO_PSK + ADD_ALL_TESTS(test_tls13_psk, 1); +#else ADD_ALL_TESTS(test_tls13_psk, 3); +#endif /* OPENSSL_NO_PSK */ ADD_ALL_TESTS(test_custom_exts, 5); ADD_TEST(test_stateless); ADD_TEST(test_pha_key_update);