+ *sess = SSL_get1_session(*clientssl);
+ SSL_shutdown(*clientssl);
+ SSL_shutdown(*serverssl);
+ SSL_free(*serverssl);
+ SSL_free(*clientssl);
+ *serverssl = *clientssl = NULL;
+
+ if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl,
+ clientssl, NULL, NULL))
+ || !TEST_true(SSL_set_session(*clientssl, *sess)))
+ return 0;
+
+ return 1;
+}
+
+static int test_early_data_read_write(int idx)
+{
+ SSL_CTX *cctx = NULL, *sctx = NULL;
+ SSL *clientssl = NULL, *serverssl = NULL;
+ int testresult = 0;
+ SSL_SESSION *sess = NULL;
+ unsigned char buf[20], data[1024];
+ size_t readbytes, written, eoedlen, rawread, rawwritten;
+ BIO *rbio;
+
+ if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
+ &serverssl, &sess, idx)))
+ goto end;
+
+ /* Write and read some early data */
+ if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
+ &written))
+ || !TEST_size_t_eq(written, strlen(MSG1))
+ || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
+ sizeof(buf), &readbytes),
+ SSL_READ_EARLY_DATA_SUCCESS)
+ || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
+ || !TEST_int_eq(SSL_get_early_data_status(serverssl),
+ SSL_EARLY_DATA_ACCEPTED))
+ goto end;
+
+ /*
+ * Server should be able to write data, and client should be able to
+ * read it.
+ */
+ if (!TEST_true(SSL_write_early_data(serverssl, MSG2, strlen(MSG2),
+ &written))
+ || !TEST_size_t_eq(written, strlen(MSG2))
+ || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
+ goto end;
+
+ /* Even after reading normal data, client should be able write early data */
+ if (!TEST_true(SSL_write_early_data(clientssl, MSG3, strlen(MSG3),
+ &written))
+ || !TEST_size_t_eq(written, strlen(MSG3)))
+ goto end;
+
+ /* Server should still be able read early data after writing data */
+ if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_SUCCESS)
+ || !TEST_mem_eq(buf, readbytes, MSG3, strlen(MSG3)))
+ goto end;
+
+ /* Write more data from server and read it from client */
+ if (!TEST_true(SSL_write_early_data(serverssl, MSG4, strlen(MSG4),
+ &written))
+ || !TEST_size_t_eq(written, strlen(MSG4))
+ || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG4, strlen(MSG4)))
+ goto end;
+
+ /*
+ * If client writes normal data it should mean writing early data is no
+ * longer possible.
+ */
+ if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
+ || !TEST_size_t_eq(written, strlen(MSG5))
+ || !TEST_int_eq(SSL_get_early_data_status(clientssl),
+ SSL_EARLY_DATA_ACCEPTED))
+ goto end;
+
+ /*
+ * At this point the client has written EndOfEarlyData, ClientFinished and
+ * normal (fully protected) data. We are going to cause a delay between the
+ * arrival of EndOfEarlyData and ClientFinished. We read out all the data
+ * in the read BIO, and then just put back the EndOfEarlyData message.
+ */
+ rbio = SSL_get_rbio(serverssl);
+ if (!TEST_true(BIO_read_ex(rbio, data, sizeof(data), &rawread))
+ || !TEST_size_t_lt(rawread, sizeof(data))
+ || !TEST_size_t_gt(rawread, SSL3_RT_HEADER_LENGTH))
+ goto end;
+
+ /* Record length is in the 4th and 5th bytes of the record header */
+ eoedlen = SSL3_RT_HEADER_LENGTH + (data[3] << 8 | data[4]);
+ if (!TEST_true(BIO_write_ex(rbio, data, eoedlen, &rawwritten))
+ || !TEST_size_t_eq(rawwritten, eoedlen))
+ goto end;
+
+ /* Server should be told that there is no more early data */
+ if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_FINISH)
+ || !TEST_size_t_eq(readbytes, 0))
+ goto end;
+
+ /*
+ * Server has not finished init yet, so should still be able to write early
+ * data.
+ */
+ if (!TEST_true(SSL_write_early_data(serverssl, MSG6, strlen(MSG6),
+ &written))
+ || !TEST_size_t_eq(written, strlen(MSG6)))
+ goto end;
+
+ /* Push the ClientFinished and the normal data back into the server rbio */
+ if (!TEST_true(BIO_write_ex(rbio, data + eoedlen, rawread - eoedlen,
+ &rawwritten))
+ || !TEST_size_t_eq(rawwritten, rawread - eoedlen))
+ goto end;
+
+ /* Server should be able to read normal data */
+ if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
+ || !TEST_size_t_eq(readbytes, strlen(MSG5)))
+ goto end;
+
+ /* Client and server should not be able to write/read early data now */
+ if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
+ &written)))
+ goto end;
+ ERR_clear_error();
+ if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_ERROR))
+ goto end;
+ ERR_clear_error();
+
+ /* Client should be able to read the data sent by the server */
+ if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG6, strlen(MSG6)))
+ goto end;
+
+ /*
+ * Make sure we process the NewSessionTicket. This arrives post-handshake.
+ * We attempt a read which we do not expect to return any data.
+ */
+ if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)))
+ goto end;
+
+ /* Server should be able to write normal data */
+ if (!TEST_true(SSL_write_ex(serverssl, MSG7, strlen(MSG7), &written))
+ || !TEST_size_t_eq(written, strlen(MSG7))
+ || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG7, strlen(MSG7)))
+ goto end;
+
+ SSL_SESSION_free(sess);
+ sess = SSL_get1_session(clientssl);
+
+ SSL_shutdown(clientssl);
+ SSL_shutdown(serverssl);
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ serverssl = clientssl = NULL;
+ if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
+ &clientssl, NULL, NULL))
+ || !TEST_true(SSL_set_session(clientssl, sess)))
+ goto end;
+
+ /* Write and read some early data */
+ if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
+ &written))
+ || !TEST_size_t_eq(written, strlen(MSG1))
+ || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_SUCCESS)
+ || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
+ goto end;
+
+ if (!TEST_int_gt(SSL_connect(clientssl), 0)
+ || !TEST_int_gt(SSL_accept(serverssl), 0))
+ goto end;
+
+ /* Client and server should not be able to write/read early data now */
+ if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
+ &written)))
+ goto end;
+ ERR_clear_error();
+ if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_ERROR))
+ goto end;
+ ERR_clear_error();
+
+ /* Client and server should be able to write/read normal data */
+ if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
+ || !TEST_size_t_eq(written, strlen(MSG5))
+ || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
+ || !TEST_size_t_eq(readbytes, strlen(MSG5)))
+ goto end;
+
+ testresult = 1;
+
+ end:
+ SSL_SESSION_free(sess);
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ SSL_CTX_free(sctx);
+ SSL_CTX_free(cctx);
+ return testresult;
+}
+
+/*
+ * Test that a server attempting to read early data can handle a connection
+ * from a client where the early data is not acceptable.
+ */
+static int test_early_data_skip(int idx)
+{
+ SSL_CTX *cctx = NULL, *sctx = NULL;
+ SSL *clientssl = NULL, *serverssl = NULL;
+ int testresult = 0;
+ SSL_SESSION *sess = NULL;
+ unsigned char buf[20];
+ size_t readbytes, written;
+
+ if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
+ &serverssl, &sess, idx)))
+ goto end;
+
+ /*
+ * Deliberately corrupt the creation time. We take 20 seconds off the time.
+ * It could be any value as long as it is not within tolerance. This should
+ * mean the ticket is rejected.
+ */
+ if (!TEST_true(SSL_SESSION_set_time(sess, time(NULL) - 20)))
+ goto end;
+
+ /* Write some early data */
+ if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
+ &written))
+ || !TEST_size_t_eq(written, strlen(MSG1)))
+ goto end;
+
+ /* Server should reject the early data and skip over it */
+ if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_FINISH)
+ || !TEST_size_t_eq(readbytes, 0)
+ || !TEST_int_eq(SSL_get_early_data_status(serverssl),
+ SSL_EARLY_DATA_REJECTED))
+ goto end;
+
+ /* Should be able to send normal data despite rejection of early data */
+ if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
+ || !TEST_size_t_eq(written, strlen(MSG2))
+ || !TEST_int_eq(SSL_get_early_data_status(clientssl),
+ SSL_EARLY_DATA_REJECTED)
+ || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
+ goto end;
+
+ testresult = 1;
+
+ end:
+ SSL_SESSION_free(sess);
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ SSL_CTX_free(sctx);
+ SSL_CTX_free(cctx);
+ return testresult;
+}
+
+/*
+ * Test that a server attempting to read early data can handle a connection
+ * from a client that doesn't send any.
+ */
+static int test_early_data_not_sent(int idx)
+{
+ SSL_CTX *cctx = NULL, *sctx = NULL;
+ SSL *clientssl = NULL, *serverssl = NULL;
+ int testresult = 0;
+ SSL_SESSION *sess = NULL;
+ unsigned char buf[20];
+ size_t readbytes, written;
+
+ if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
+ &serverssl, &sess, idx)))
+ goto end;
+
+ /* Write some data - should block due to handshake with server */
+ SSL_set_connect_state(clientssl);
+ if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
+ goto end;
+
+ /* Server should detect that early data has not been sent */
+ if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_FINISH)
+ || !TEST_size_t_eq(readbytes, 0)
+ || !TEST_int_eq(SSL_get_early_data_status(serverssl),
+ SSL_EARLY_DATA_NOT_SENT)
+ || !TEST_int_eq(SSL_get_early_data_status(clientssl),
+ SSL_EARLY_DATA_NOT_SENT))
+ goto end;
+
+ /* Continue writing the message we started earlier */
+ if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
+ || !TEST_size_t_eq(written, strlen(MSG1))
+ || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
+ || !SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written)
+ || !TEST_size_t_eq(written, strlen(MSG2)))
+ goto end;
+
+ /*
+ * Should block due to the NewSessionTicket arrival unless we're using
+ * read_ahead
+ */
+ if (idx == 0) {
+ if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)))
+ goto end;
+ }
+
+ if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
+ goto end;
+
+ testresult = 1;
+
+ end:
+ SSL_SESSION_free(sess);
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ SSL_CTX_free(sctx);
+ SSL_CTX_free(cctx);
+ return testresult;
+}
+
+/*
+ * Test that a server that doesn't try to read early data can handle a
+ * client sending some.
+ */
+static int test_early_data_not_expected(int idx)
+{
+ SSL_CTX *cctx = NULL, *sctx = NULL;
+ SSL *clientssl = NULL, *serverssl = NULL;
+ int testresult = 0;
+ SSL_SESSION *sess = NULL;
+ unsigned char buf[20];
+ size_t readbytes, written;
+
+
+ if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
+ &serverssl, &sess, idx)))
+ goto end;
+
+ /* Write some early data */
+ if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
+ &written)))
+ goto end;
+
+ /*
+ * Server should skip over early data and then block waiting for client to
+ * continue handshake
+ */
+ if (!TEST_int_le(SSL_accept(serverssl), 0)
+ || !TEST_int_gt(SSL_connect(clientssl), 0)
+ || !TEST_int_eq(SSL_get_early_data_status(serverssl),
+ SSL_EARLY_DATA_REJECTED)
+ || !TEST_int_gt(SSL_accept(serverssl), 0)
+ || !TEST_int_eq(SSL_get_early_data_status(clientssl),
+ SSL_EARLY_DATA_REJECTED))
+ goto end;
+
+ /* Send some normal data from client to server */
+ if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
+ || !TEST_size_t_eq(written, strlen(MSG2)))
+ goto end;
+
+ if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
+ goto end;
+
+ testresult = 1;
+
+ end:
+ SSL_SESSION_free(sess);
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ SSL_CTX_free(sctx);
+ SSL_CTX_free(cctx);
+ return testresult;
+}
+
+
+# ifndef OPENSSL_NO_TLS1_2
+/*
+ * Test that a server attempting to read early data can handle a connection
+ * from a TLSv1.2 client.
+ */
+static int test_early_data_tls1_2(int idx)
+{
+ SSL_CTX *cctx = NULL, *sctx = NULL;
+ SSL *clientssl = NULL, *serverssl = NULL;
+ int testresult = 0;
+ unsigned char buf[20];
+ size_t readbytes, written;
+
+ if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
+ TLS_client_method(), &sctx,
+ &cctx, cert, privkey)))
+ goto end;
+
+ /* When idx == 1 we repeat the tests with read_ahead set */
+ if (idx > 0) {
+ SSL_CTX_set_read_ahead(cctx, 1);
+ SSL_CTX_set_read_ahead(sctx, 1);
+ }
+
+ if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
+ &clientssl, NULL, NULL)))
+ goto end;
+
+ /* Write some data - should block due to handshake with server */
+ SSL_set_max_proto_version(clientssl, TLS1_2_VERSION);
+ SSL_set_connect_state(clientssl);
+ if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
+ goto end;
+
+ /*
+ * Server should do TLSv1.2 handshake. First it will block waiting for more
+ * messages from client after ServerDone. Then SSL_read_early_data should
+ * finish and detect that early data has not been sent
+ */
+ if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_ERROR))
+ goto end;
+
+ /*
+ * Continue writing the message we started earlier. Will still block waiting
+ * for the CCS/Finished from server
+ */
+ if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
+ || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
+ &readbytes),
+ SSL_READ_EARLY_DATA_FINISH)
+ || !TEST_size_t_eq(readbytes, 0)
+ || !TEST_int_eq(SSL_get_early_data_status(serverssl),
+ SSL_EARLY_DATA_NOT_SENT))
+ goto end;
+
+ /* Continue writing the message we started earlier */
+ if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
+ || !TEST_size_t_eq(written, strlen(MSG1))
+ || !TEST_int_eq(SSL_get_early_data_status(clientssl),
+ SSL_EARLY_DATA_NOT_SENT)
+ || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
+ || !TEST_true(SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written))
+ || !TEST_size_t_eq(written, strlen(MSG2))
+ || !SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)
+ || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
+ goto end;
+
+ testresult = 1;
+
+ end:
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ SSL_CTX_free(sctx);
+ SSL_CTX_free(cctx);
+
+ return testresult;
+}
+# endif
+#endif
+
+static int clntaddoldcb = 0;
+static int clntparseoldcb = 0;
+static int srvaddoldcb = 0;
+static int srvparseoldcb = 0;
+static int clntaddnewcb = 0;
+static int clntparsenewcb = 0;
+static int srvaddnewcb = 0;
+static int srvparsenewcb = 0;
+static int snicb = 0;
+
+#define TEST_EXT_TYPE1 0xff00
+
+static int old_add_cb(SSL *s, unsigned int ext_type, const unsigned char **out,
+ size_t *outlen, int *al, void *add_arg)
+{
+ int *server = (int *)add_arg;
+ unsigned char *data;
+
+ if (SSL_is_server(s))
+ srvaddoldcb++;
+ else
+ clntaddoldcb++;
+
+ if (*server != SSL_is_server(s)
+ || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
+ return -1;
+
+ *data = 1;
+ *out = data;
+ *outlen = sizeof(char);
+ return 1;
+}
+
+static void old_free_cb(SSL *s, unsigned int ext_type, const unsigned char *out,
+ void *add_arg)
+{
+ OPENSSL_free((unsigned char *)out);
+}
+
+static int old_parse_cb(SSL *s, unsigned int ext_type, const unsigned char *in,
+ size_t inlen, int *al, void *parse_arg)
+{
+ int *server = (int *)parse_arg;
+
+ if (SSL_is_server(s))
+ srvparseoldcb++;
+ else
+ clntparseoldcb++;
+
+ if (*server != SSL_is_server(s)
+ || inlen != sizeof(char)
+ || *in != 1)
+ return -1;
+
+ return 1;
+}
+
+static int new_add_cb(SSL *s, unsigned int ext_type, unsigned int context,
+ const unsigned char **out, size_t *outlen, X509 *x,
+ size_t chainidx, int *al, void *add_arg)
+{
+ int *server = (int *)add_arg;
+ unsigned char *data;
+
+ if (SSL_is_server(s))
+ srvaddnewcb++;
+ else
+ clntaddnewcb++;
+
+ if (*server != SSL_is_server(s)
+ || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
+ return -1;
+
+ *data = 1;
+ *out = data;
+ *outlen = sizeof(*data);
+ return 1;
+}
+
+static void new_free_cb(SSL *s, unsigned int ext_type, unsigned int context,
+ const unsigned char *out, void *add_arg)
+{
+ OPENSSL_free((unsigned char *)out);
+}
+
+static int new_parse_cb(SSL *s, unsigned int ext_type, unsigned int context,
+ const unsigned char *in, size_t inlen, X509 *x,
+ size_t chainidx, int *al, void *parse_arg)
+{
+ int *server = (int *)parse_arg;
+
+ if (SSL_is_server(s))
+ srvparsenewcb++;
+ else
+ clntparsenewcb++;
+
+ if (*server != SSL_is_server(s)
+ || inlen != sizeof(char) || *in != 1)
+ return -1;
+
+ return 1;
+}
+
+static int sni_cb(SSL *s, int *al, void *arg)
+{
+ SSL_CTX *ctx = (SSL_CTX *)arg;
+
+ if (SSL_set_SSL_CTX(s, ctx) == NULL) {
+ *al = SSL_AD_INTERNAL_ERROR;
+ return SSL_TLSEXT_ERR_ALERT_FATAL;
+ }
+ snicb++;
+ return SSL_TLSEXT_ERR_OK;
+}
+
+/*
+ * Custom call back tests.
+ * Test 0: Old style callbacks in TLSv1.2
+ * Test 1: New style callbacks in TLSv1.2
+ * Test 2: New style callbacks in TLSv1.2 with SNI
+ * Test 3: New style callbacks in TLSv1.3. Extensions in CH and EE
+ * Test 4: New style callbacks in TLSv1.3. Extensions in CH, SH, EE, Cert + NST
+ */
+static int test_custom_exts(int tst)
+{
+ SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
+ SSL *clientssl = NULL, *serverssl = NULL;
+ int testresult = 0;
+ static int server = 1;
+ static int client = 0;
+ SSL_SESSION *sess = NULL;
+ unsigned int context;
+
+ /* Reset callback counters */
+ clntaddoldcb = clntparseoldcb = srvaddoldcb = srvparseoldcb = 0;
+ clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
+ snicb = 0;
+
+ if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
+ TLS_client_method(), &sctx,
+ &cctx, cert, privkey)))
+ goto end;
+
+ if (tst == 2
+ && !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL, &sctx2,
+ NULL, cert, privkey)))
+ goto end;
+
+
+ if (tst < 3) {
+ SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
+ SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
+ if (sctx2 != NULL)
+ SSL_CTX_set_options(sctx2, SSL_OP_NO_TLSv1_3);
+ }
+
+ if (tst == 4) {
+ context = SSL_EXT_CLIENT_HELLO
+ | SSL_EXT_TLS1_2_SERVER_HELLO
+ | SSL_EXT_TLS1_3_SERVER_HELLO
+ | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
+ | SSL_EXT_TLS1_3_CERTIFICATE
+ | SSL_EXT_TLS1_3_NEW_SESSION_TICKET;
+ } else {
+ context = SSL_EXT_CLIENT_HELLO
+ | SSL_EXT_TLS1_2_SERVER_HELLO
+ | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS;
+ }
+
+ /* Create a client side custom extension */
+ if (tst == 0) {
+ if (!TEST_true(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
+ old_add_cb, old_free_cb,
+ &client, old_parse_cb,
+ &client)))
+ goto end;
+ } else {
+ if (!TEST_true(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1, context,
+ new_add_cb, new_free_cb,
+ &client, new_parse_cb, &client)))
+ goto end;
+ }
+
+ /* Should not be able to add duplicates */
+ if (!TEST_false(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
+ old_add_cb, old_free_cb,
+ &client, old_parse_cb,
+ &client))
+ || !TEST_false(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1,
+ context, new_add_cb,
+ new_free_cb, &client,
+ new_parse_cb, &client)))
+ goto end;
+
+ /* Create a server side custom extension */
+ if (tst == 0) {
+ if (!TEST_true(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
+ old_add_cb, old_free_cb,
+ &server, old_parse_cb,
+ &server)))
+ goto end;
+ } else {
+ if (!TEST_true(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1, context,
+ new_add_cb, new_free_cb,
+ &server, new_parse_cb, &server)))
+ goto end;
+ if (sctx2 != NULL
+ && !TEST_true(SSL_CTX_add_custom_ext(sctx2, TEST_EXT_TYPE1,
+ context, new_add_cb,
+ new_free_cb, &server,
+ new_parse_cb, &server)))
+ goto end;
+ }
+
+ /* Should not be able to add duplicates */
+ if (!TEST_false(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
+ old_add_cb, old_free_cb,
+ &server, old_parse_cb,
+ &server))
+ || !TEST_false(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1,
+ context, new_add_cb,
+ new_free_cb, &server,
+ new_parse_cb, &server)))
+ goto end;
+
+ if (tst == 2) {
+ /* Set up SNI */
+ if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
+ || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
+ goto end;
+ }
+
+ if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
+ &clientssl, NULL, NULL))
+ || !TEST_true(create_ssl_connection(serverssl, clientssl,
+ SSL_ERROR_NONE)))
+ goto end;
+
+ if (tst == 0) {
+ if (clntaddoldcb != 1
+ || clntparseoldcb != 1
+ || srvaddoldcb != 1
+ || srvparseoldcb != 1)
+ goto end;
+ } else if (tst == 1 || tst == 2 || tst == 3) {
+ if (clntaddnewcb != 1
+ || clntparsenewcb != 1
+ || srvaddnewcb != 1
+ || srvparsenewcb != 1
+ || (tst != 2 && snicb != 0)
+ || (tst == 2 && snicb != 1))
+ goto end;
+ } else {
+ if (clntaddnewcb != 1
+ || clntparsenewcb != 4
+ || srvaddnewcb != 4
+ || srvparsenewcb != 1)
+ goto end;
+ }
+
+ sess = SSL_get1_session(clientssl);
+ SSL_shutdown(clientssl);
+ SSL_shutdown(serverssl);
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ serverssl = clientssl = NULL;
+
+ if (tst == 3) {
+ /* We don't bother with the resumption aspects for this test */
+ testresult = 1;
+ goto end;
+ }
+
+ if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
+ NULL, NULL))
+ || !TEST_true(SSL_set_session(clientssl, sess))
+ || !TEST_true(create_ssl_connection(serverssl, clientssl,
+ SSL_ERROR_NONE)))
+ goto end;
+
+ /*
+ * For a resumed session we expect to add the ClientHello extension. For the
+ * old style callbacks we ignore it on the server side because they set
+ * SSL_EXT_IGNORE_ON_RESUMPTION. The new style callbacks do not ignore
+ * them.
+ */
+ if (tst == 0) {
+ if (clntaddoldcb != 2
+ || clntparseoldcb != 1
+ || srvaddoldcb != 1
+ || srvparseoldcb != 1)
+ goto end;
+ } else if (tst == 1 || tst == 2 || tst == 3) {
+ if (clntaddnewcb != 2
+ || clntparsenewcb != 2
+ || srvaddnewcb != 2
+ || srvparsenewcb != 2)
+ goto end;
+ } else {
+ /* No Certificate message extensions in the resumption handshake */
+ if (clntaddnewcb != 2
+ || clntparsenewcb != 7
+ || srvaddnewcb != 7
+ || srvparsenewcb != 2)
+ goto end;
+ }
+
+ testresult = 1;
+
+end:
+ SSL_SESSION_free(sess);
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ SSL_CTX_free(sctx2);
+ SSL_CTX_free(sctx);
+ SSL_CTX_free(cctx);
+ return testresult;
+}
+
+/*
+ * Test loading of serverinfo data in various formats. test_sslmessages actually
+ * tests to make sure the extensions appear in the handshake
+ */
+static int test_serverinfo(int tst)
+{
+ unsigned int version;
+ unsigned char *sibuf;
+ size_t sibuflen;
+ int ret, expected, testresult = 0;
+ SSL_CTX *ctx;
+
+ ctx = SSL_CTX_new(TLS_method());
+ if (!TEST_ptr(ctx))
+ goto end;
+
+ if ((tst & 0x01) == 0x01)
+ version = SSL_SERVERINFOV2;
+ else
+ version = SSL_SERVERINFOV1;
+
+ if ((tst & 0x02) == 0x02) {
+ sibuf = serverinfov2;
+ sibuflen = sizeof(serverinfov2);
+ expected = (version == SSL_SERVERINFOV2);
+ } else {
+ sibuf = serverinfov1;
+ sibuflen = sizeof(serverinfov1);
+ expected = (version == SSL_SERVERINFOV1);
+ }
+
+ if ((tst & 0x04) == 0x04) {
+ ret = SSL_CTX_use_serverinfo_ex(ctx, version, sibuf, sibuflen);
+ } else {
+ ret = SSL_CTX_use_serverinfo(ctx, sibuf, sibuflen);
+
+ /*
+ * The version variable is irrelevant in this case - it's what is in the
+ * buffer that matters
+ */
+ if ((tst & 0x02) == 0x02)
+ expected = 0;
+ else
+ expected = 1;
+ }
+
+ if (!TEST_true(ret == expected))
+ goto end;
+
+ testresult = 1;
+
+ end:
+ SSL_CTX_free(ctx);
+
+ return testresult;
+}
+
+int test_main(int argc, char *argv[])
+{
+ int testresult = 1;
+
+ if (argc != 3) {
+ TEST_error("Wrong argument count");
+ return 0;
+ }
+
+ cert = argv[1];
+ privkey = argv[2];
+
+ ADD_TEST(test_large_message_tls);
+ ADD_TEST(test_large_message_tls_read_ahead);
+#ifndef OPENSSL_NO_DTLS