Add some SSL BIO tests
[openssl.git] / ssl / t1_reneg.c
1 /*
2  * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the OpenSSL license (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9
10 #include <stdio.h>
11 #include <openssl/objects.h>
12 #include "ssl_locl.h"
13
14 /* Add the client's renegotiation binding */
15 int ssl_add_clienthello_renegotiate_ext(SSL *s, unsigned char *p, int *len,
16                                         int maxlen)
17 {
18     if (p) {
19         if ((s->s3->previous_client_finished_len + 1) > maxlen) {
20             SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT,
21                    SSL_R_RENEGOTIATE_EXT_TOO_LONG);
22             return 0;
23         }
24
25         /* Length byte */
26         *p = s->s3->previous_client_finished_len;
27         p++;
28
29         memcpy(p, s->s3->previous_client_finished,
30                s->s3->previous_client_finished_len);
31     }
32
33     *len = s->s3->previous_client_finished_len + 1;
34
35     return 1;
36 }
37
38 /*
39  * Parse the client's renegotiation binding and abort if it's not right
40  */
41 int ssl_parse_clienthello_renegotiate_ext(SSL *s, PACKET *pkt, int *al)
42 {
43     unsigned int ilen;
44     const unsigned char *d;
45
46     /* Parse the length byte */
47     if (!PACKET_get_1(pkt, &ilen)
48             || !PACKET_get_bytes(pkt, &d, ilen)) {
49         SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT,
50                SSL_R_RENEGOTIATION_ENCODING_ERR);
51         *al = SSL_AD_ILLEGAL_PARAMETER;
52         return 0;
53     }
54
55     /* Check that the extension matches */
56     if (ilen != s->s3->previous_client_finished_len) {
57         SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT,
58                SSL_R_RENEGOTIATION_MISMATCH);
59         *al = SSL_AD_HANDSHAKE_FAILURE;
60         return 0;
61     }
62
63     if (memcmp(d, s->s3->previous_client_finished,
64                s->s3->previous_client_finished_len)) {
65         SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT,
66                SSL_R_RENEGOTIATION_MISMATCH);
67         *al = SSL_AD_HANDSHAKE_FAILURE;
68         return 0;
69     }
70
71     s->s3->send_connection_binding = 1;
72
73     return 1;
74 }
75
76 /* Add the server's renegotiation binding */
77 int ssl_add_serverhello_renegotiate_ext(SSL *s, unsigned char *p, int *len,
78                                         int maxlen)
79 {
80     if (p) {
81         if ((s->s3->previous_client_finished_len +
82              s->s3->previous_server_finished_len + 1) > maxlen) {
83             SSLerr(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT,
84                    SSL_R_RENEGOTIATE_EXT_TOO_LONG);
85             return 0;
86         }
87
88         /* Length byte */
89         *p = s->s3->previous_client_finished_len +
90             s->s3->previous_server_finished_len;
91         p++;
92
93         memcpy(p, s->s3->previous_client_finished,
94                s->s3->previous_client_finished_len);
95         p += s->s3->previous_client_finished_len;
96
97         memcpy(p, s->s3->previous_server_finished,
98                s->s3->previous_server_finished_len);
99     }
100
101     *len = s->s3->previous_client_finished_len
102         + s->s3->previous_server_finished_len + 1;
103
104     return 1;
105 }
106
107 /*
108  * Parse the server's renegotiation binding and abort if it's not right
109  */
110 int ssl_parse_serverhello_renegotiate_ext(SSL *s, PACKET *pkt, int *al)
111 {
112     unsigned int expected_len = s->s3->previous_client_finished_len
113         + s->s3->previous_server_finished_len;
114     unsigned int ilen;
115     const unsigned char *data;
116
117     /* Check for logic errors */
118     OPENSSL_assert(!expected_len || s->s3->previous_client_finished_len);
119     OPENSSL_assert(!expected_len || s->s3->previous_server_finished_len);
120
121     /* Parse the length byte */
122     if (!PACKET_get_1(pkt, &ilen)) {
123         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,
124                SSL_R_RENEGOTIATION_ENCODING_ERR);
125         *al = SSL_AD_ILLEGAL_PARAMETER;
126         return 0;
127     }
128
129     /* Consistency check */
130     if (PACKET_remaining(pkt) != ilen) {
131         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,
132                SSL_R_RENEGOTIATION_ENCODING_ERR);
133         *al = SSL_AD_ILLEGAL_PARAMETER;
134         return 0;
135     }
136
137     /* Check that the extension matches */
138     if (ilen != expected_len) {
139         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,
140                SSL_R_RENEGOTIATION_MISMATCH);
141         *al = SSL_AD_HANDSHAKE_FAILURE;
142         return 0;
143     }
144
145     if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len)
146             || memcmp(data, s->s3->previous_client_finished,
147                s->s3->previous_client_finished_len) != 0) {
148         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,
149                SSL_R_RENEGOTIATION_MISMATCH);
150         *al = SSL_AD_HANDSHAKE_FAILURE;
151         return 0;
152     }
153
154     if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len)
155             || memcmp(data, s->s3->previous_server_finished,
156                s->s3->previous_server_finished_len) != 0) {
157         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,
158                SSL_R_RENEGOTIATION_MISMATCH);
159         *al = SSL_AD_ILLEGAL_PARAMETER;
160         return 0;
161     }
162     s->s3->send_connection_binding = 1;
163
164     return 1;
165 }