2 * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
13 #include <openssl/opensslconf.h>
14 #include <openssl/bio.h>
15 #include <openssl/crypto.h>
16 #include <openssl/ssl.h>
17 #include <openssl/ocsp.h>
18 #include <openssl/srp.h>
19 #include <openssl/txt_db.h>
20 #include <openssl/aes.h>
21 #include <openssl/rand.h>
23 #include "ssltestlib.h"
25 #include "testutil/output.h"
26 #include "internal/nelem.h"
27 #include "internal/ktls.h"
28 #include "../ssl/ssl_locl.h"
30 #ifndef OPENSSL_NO_TLS1_3
32 static SSL_SESSION *clientpsk = NULL;
33 static SSL_SESSION *serverpsk = NULL;
34 static const char *pskid = "Identity";
35 static const char *srvid;
37 static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id,
38 size_t *idlen, SSL_SESSION **sess);
39 static int find_session_cb(SSL *ssl, const unsigned char *identity,
40 size_t identity_len, SSL_SESSION **sess);
42 static int use_session_cb_cnt = 0;
43 static int find_session_cb_cnt = 0;
45 static SSL_SESSION *create_a_psk(SSL *ssl);
48 static char *cert = NULL;
49 static char *privkey = NULL;
50 static char *srpvfile = NULL;
51 static char *tmpfilename = NULL;
53 #define LOG_BUFFER_SIZE 2048
54 static char server_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
55 static size_t server_log_buffer_index = 0;
56 static char client_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
57 static size_t client_log_buffer_index = 0;
58 static int error_writing_log = 0;
60 #ifndef OPENSSL_NO_OCSP
61 static const unsigned char orespder[] = "Dummy OCSP Response";
62 static int ocsp_server_called = 0;
63 static int ocsp_client_called = 0;
65 static int cdummyarg = 1;
66 static X509 *ocspcert = NULL;
69 #define NUM_EXTRA_CERTS 40
70 #define CLIENT_VERSION_LEN 2
73 * This structure is used to validate that the correct number of log messages
74 * of various types are emitted when emitting secret logs.
76 struct sslapitest_log_counts {
77 unsigned int rsa_key_exchange_count;
78 unsigned int master_secret_count;
79 unsigned int client_early_secret_count;
80 unsigned int client_handshake_secret_count;
81 unsigned int server_handshake_secret_count;
82 unsigned int client_application_secret_count;
83 unsigned int server_application_secret_count;
84 unsigned int early_exporter_secret_count;
85 unsigned int exporter_secret_count;
89 static unsigned char serverinfov1[] = {
90 0xff, 0xff, /* Dummy extension type */
91 0x00, 0x01, /* Extension length is 1 byte */
92 0xff /* Dummy extension data */
95 static unsigned char serverinfov2[] = {
97 (unsigned char)(SSL_EXT_CLIENT_HELLO & 0xff), /* Dummy context - 4 bytes */
98 0xff, 0xff, /* Dummy extension type */
99 0x00, 0x01, /* Extension length is 1 byte */
100 0xff /* Dummy extension data */
103 static void client_keylog_callback(const SSL *ssl, const char *line)
105 int line_length = strlen(line);
107 /* If the log doesn't fit, error out. */
108 if (client_log_buffer_index + line_length > sizeof(client_log_buffer) - 1) {
109 TEST_info("Client log too full");
110 error_writing_log = 1;
114 strcat(client_log_buffer, line);
115 client_log_buffer_index += line_length;
116 client_log_buffer[client_log_buffer_index++] = '\n';
119 static void server_keylog_callback(const SSL *ssl, const char *line)
121 int line_length = strlen(line);
123 /* If the log doesn't fit, error out. */
124 if (server_log_buffer_index + line_length > sizeof(server_log_buffer) - 1) {
125 TEST_info("Server log too full");
126 error_writing_log = 1;
130 strcat(server_log_buffer, line);
131 server_log_buffer_index += line_length;
132 server_log_buffer[server_log_buffer_index++] = '\n';
135 static int compare_hex_encoded_buffer(const char *hex_encoded,
143 if (!TEST_size_t_eq(raw_length * 2, hex_length))
146 for (i = j = 0; i < raw_length && j + 1 < hex_length; i++, j += 2) {
147 sprintf(hexed, "%02x", raw[i]);
148 if (!TEST_int_eq(hexed[0], hex_encoded[j])
149 || !TEST_int_eq(hexed[1], hex_encoded[j + 1]))
156 static int test_keylog_output(char *buffer, const SSL *ssl,
157 const SSL_SESSION *session,
158 struct sslapitest_log_counts *expected)
161 unsigned char actual_client_random[SSL3_RANDOM_SIZE] = {0};
162 size_t client_random_size = SSL3_RANDOM_SIZE;
163 unsigned char actual_master_key[SSL_MAX_MASTER_KEY_LENGTH] = {0};
164 size_t master_key_size = SSL_MAX_MASTER_KEY_LENGTH;
165 unsigned int rsa_key_exchange_count = 0;
166 unsigned int master_secret_count = 0;
167 unsigned int client_early_secret_count = 0;
168 unsigned int client_handshake_secret_count = 0;
169 unsigned int server_handshake_secret_count = 0;
170 unsigned int client_application_secret_count = 0;
171 unsigned int server_application_secret_count = 0;
172 unsigned int early_exporter_secret_count = 0;
173 unsigned int exporter_secret_count = 0;
175 for (token = strtok(buffer, " \n"); token != NULL;
176 token = strtok(NULL, " \n")) {
177 if (strcmp(token, "RSA") == 0) {
179 * Premaster secret. Tokens should be: 16 ASCII bytes of
180 * hex-encoded encrypted secret, then the hex-encoded pre-master
183 if (!TEST_ptr(token = strtok(NULL, " \n")))
185 if (!TEST_size_t_eq(strlen(token), 16))
187 if (!TEST_ptr(token = strtok(NULL, " \n")))
190 * We can't sensibly check the log because the premaster secret is
191 * transient, and OpenSSL doesn't keep hold of it once the master
192 * secret is generated.
194 rsa_key_exchange_count++;
195 } else if (strcmp(token, "CLIENT_RANDOM") == 0) {
197 * Master secret. Tokens should be: 64 ASCII bytes of hex-encoded
198 * client random, then the hex-encoded master secret.
200 client_random_size = SSL_get_client_random(ssl,
201 actual_client_random,
203 if (!TEST_size_t_eq(client_random_size, SSL3_RANDOM_SIZE))
206 if (!TEST_ptr(token = strtok(NULL, " \n")))
208 if (!TEST_size_t_eq(strlen(token), 64))
210 if (!TEST_false(compare_hex_encoded_buffer(token, 64,
211 actual_client_random,
212 client_random_size)))
215 if (!TEST_ptr(token = strtok(NULL, " \n")))
217 master_key_size = SSL_SESSION_get_master_key(session,
220 if (!TEST_size_t_ne(master_key_size, 0))
222 if (!TEST_false(compare_hex_encoded_buffer(token, strlen(token),
226 master_secret_count++;
227 } else if (strcmp(token, "CLIENT_EARLY_TRAFFIC_SECRET") == 0
228 || strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0
229 || strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0
230 || strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0
231 || strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0
232 || strcmp(token, "EARLY_EXPORTER_SECRET") == 0
233 || strcmp(token, "EXPORTER_SECRET") == 0) {
235 * TLSv1.3 secret. Tokens should be: 64 ASCII bytes of hex-encoded
236 * client random, and then the hex-encoded secret. In this case,
237 * we treat all of these secrets identically and then just
238 * distinguish between them when counting what we saw.
240 if (strcmp(token, "CLIENT_EARLY_TRAFFIC_SECRET") == 0)
241 client_early_secret_count++;
242 else if (strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0)
243 client_handshake_secret_count++;
244 else if (strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0)
245 server_handshake_secret_count++;
246 else if (strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0)
247 client_application_secret_count++;
248 else if (strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0)
249 server_application_secret_count++;
250 else if (strcmp(token, "EARLY_EXPORTER_SECRET") == 0)
251 early_exporter_secret_count++;
252 else if (strcmp(token, "EXPORTER_SECRET") == 0)
253 exporter_secret_count++;
255 client_random_size = SSL_get_client_random(ssl,
256 actual_client_random,
258 if (!TEST_size_t_eq(client_random_size, SSL3_RANDOM_SIZE))
261 if (!TEST_ptr(token = strtok(NULL, " \n")))
263 if (!TEST_size_t_eq(strlen(token), 64))
265 if (!TEST_false(compare_hex_encoded_buffer(token, 64,
266 actual_client_random,
267 client_random_size)))
270 if (!TEST_ptr(token = strtok(NULL, " \n")))
274 * TODO(TLS1.3): test that application traffic secrets are what
277 TEST_info("Unexpected token %s\n", token);
282 /* Got what we expected? */
283 if (!TEST_size_t_eq(rsa_key_exchange_count,
284 expected->rsa_key_exchange_count)
285 || !TEST_size_t_eq(master_secret_count,
286 expected->master_secret_count)
287 || !TEST_size_t_eq(client_early_secret_count,
288 expected->client_early_secret_count)
289 || !TEST_size_t_eq(client_handshake_secret_count,
290 expected->client_handshake_secret_count)
291 || !TEST_size_t_eq(server_handshake_secret_count,
292 expected->server_handshake_secret_count)
293 || !TEST_size_t_eq(client_application_secret_count,
294 expected->client_application_secret_count)
295 || !TEST_size_t_eq(server_application_secret_count,
296 expected->server_application_secret_count)
297 || !TEST_size_t_eq(early_exporter_secret_count,
298 expected->early_exporter_secret_count)
299 || !TEST_size_t_eq(exporter_secret_count,
300 expected->exporter_secret_count))
305 #if !defined(OPENSSL_NO_TLS1_2) || defined(OPENSSL_NO_TLS1_3)
306 static int test_keylog(void)
308 SSL_CTX *cctx = NULL, *sctx = NULL;
309 SSL *clientssl = NULL, *serverssl = NULL;
311 struct sslapitest_log_counts expected;
313 /* Clean up logging space */
314 memset(&expected, 0, sizeof(expected));
315 memset(client_log_buffer, 0, sizeof(client_log_buffer));
316 memset(server_log_buffer, 0, sizeof(server_log_buffer));
317 client_log_buffer_index = 0;
318 server_log_buffer_index = 0;
319 error_writing_log = 0;
321 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
324 &sctx, &cctx, cert, privkey)))
327 /* We cannot log the master secret for TLSv1.3, so we should forbid it. */
328 SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
329 SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
331 /* We also want to ensure that we use RSA-based key exchange. */
332 if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "RSA")))
335 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
336 || !TEST_true(SSL_CTX_get_keylog_callback(sctx) == NULL))
338 SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);
339 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx)
340 == client_keylog_callback))
342 SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);
343 if (!TEST_true(SSL_CTX_get_keylog_callback(sctx)
344 == server_keylog_callback))
347 /* Now do a handshake and check that the logs have been written to. */
348 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
349 &clientssl, NULL, NULL))
350 || !TEST_true(create_ssl_connection(serverssl, clientssl,
352 || !TEST_false(error_writing_log)
353 || !TEST_int_gt(client_log_buffer_index, 0)
354 || !TEST_int_gt(server_log_buffer_index, 0))
358 * Now we want to test that our output data was vaguely sensible. We
359 * do that by using strtok and confirming that we have more or less the
360 * data we expect. For both client and server, we expect to see one master
361 * secret. The client should also see a RSA key exchange.
363 expected.rsa_key_exchange_count = 1;
364 expected.master_secret_count = 1;
365 if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
366 SSL_get_session(clientssl), &expected)))
369 expected.rsa_key_exchange_count = 0;
370 if (!TEST_true(test_keylog_output(server_log_buffer, serverssl,
371 SSL_get_session(serverssl), &expected)))
386 #ifndef OPENSSL_NO_TLS1_3
387 static int test_keylog_no_master_key(void)
389 SSL_CTX *cctx = NULL, *sctx = NULL;
390 SSL *clientssl = NULL, *serverssl = NULL;
391 SSL_SESSION *sess = NULL;
393 struct sslapitest_log_counts expected;
394 unsigned char buf[1];
395 size_t readbytes, written;
397 /* Clean up logging space */
398 memset(&expected, 0, sizeof(expected));
399 memset(client_log_buffer, 0, sizeof(client_log_buffer));
400 memset(server_log_buffer, 0, sizeof(server_log_buffer));
401 client_log_buffer_index = 0;
402 server_log_buffer_index = 0;
403 error_writing_log = 0;
405 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
407 &sctx, &cctx, cert, privkey))
408 || !TEST_true(SSL_CTX_set_max_early_data(sctx,
409 SSL3_RT_MAX_PLAIN_LENGTH)))
412 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
413 || !TEST_true(SSL_CTX_get_keylog_callback(sctx) == NULL))
416 SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);
417 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx)
418 == client_keylog_callback))
421 SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);
422 if (!TEST_true(SSL_CTX_get_keylog_callback(sctx)
423 == server_keylog_callback))
426 /* Now do a handshake and check that the logs have been written to. */
427 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
428 &clientssl, NULL, NULL))
429 || !TEST_true(create_ssl_connection(serverssl, clientssl,
431 || !TEST_false(error_writing_log))
435 * Now we want to test that our output data was vaguely sensible. For this
436 * test, we expect no CLIENT_RANDOM entry because it doesn't make sense for
437 * TLSv1.3, but we do expect both client and server to emit keys.
439 expected.client_handshake_secret_count = 1;
440 expected.server_handshake_secret_count = 1;
441 expected.client_application_secret_count = 1;
442 expected.server_application_secret_count = 1;
443 expected.exporter_secret_count = 1;
444 if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
445 SSL_get_session(clientssl), &expected))
446 || !TEST_true(test_keylog_output(server_log_buffer, serverssl,
447 SSL_get_session(serverssl),
451 /* Terminate old session and resume with early data. */
452 sess = SSL_get1_session(clientssl);
453 SSL_shutdown(clientssl);
454 SSL_shutdown(serverssl);
457 serverssl = clientssl = NULL;
460 memset(client_log_buffer, 0, sizeof(client_log_buffer));
461 memset(server_log_buffer, 0, sizeof(server_log_buffer));
462 client_log_buffer_index = 0;
463 server_log_buffer_index = 0;
465 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
466 &clientssl, NULL, NULL))
467 || !TEST_true(SSL_set_session(clientssl, sess))
468 /* Here writing 0 length early data is enough. */
469 || !TEST_true(SSL_write_early_data(clientssl, NULL, 0, &written))
470 || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
472 SSL_READ_EARLY_DATA_ERROR)
473 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
474 SSL_EARLY_DATA_ACCEPTED)
475 || !TEST_true(create_ssl_connection(serverssl, clientssl,
477 || !TEST_true(SSL_session_reused(clientssl)))
480 /* In addition to the previous entries, expect early secrets. */
481 expected.client_early_secret_count = 1;
482 expected.early_exporter_secret_count = 1;
483 if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
484 SSL_get_session(clientssl), &expected))
485 || !TEST_true(test_keylog_output(server_log_buffer, serverssl,
486 SSL_get_session(serverssl),
493 SSL_SESSION_free(sess);
503 #ifndef OPENSSL_NO_TLS1_2
504 static int full_client_hello_callback(SSL *s, int *al, void *arg)
507 const unsigned char *p;
509 /* We only configure two ciphers, but the SCSV is added automatically. */
511 const unsigned char expected_ciphers[] = {0x00, 0x9d, 0x00, 0xff};
513 const unsigned char expected_ciphers[] = {0x00, 0x9d, 0xc0,
516 const int expected_extensions[] = {
517 #ifndef OPENSSL_NO_EC
523 /* Make sure we can defer processing and get called back. */
525 return SSL_CLIENT_HELLO_RETRY;
527 len = SSL_client_hello_get0_ciphers(s, &p);
528 if (!TEST_mem_eq(p, len, expected_ciphers, sizeof(expected_ciphers))
530 SSL_client_hello_get0_compression_methods(s, &p), 1)
531 || !TEST_int_eq(*p, 0))
532 return SSL_CLIENT_HELLO_ERROR;
533 if (!SSL_client_hello_get1_extensions_present(s, &exts, &len))
534 return SSL_CLIENT_HELLO_ERROR;
535 if (len != OSSL_NELEM(expected_extensions) ||
536 memcmp(exts, expected_extensions, len * sizeof(*exts)) != 0) {
537 printf("ClientHello callback expected extensions mismatch\n");
539 return SSL_CLIENT_HELLO_ERROR;
542 return SSL_CLIENT_HELLO_SUCCESS;
545 static int test_client_hello_cb(void)
547 SSL_CTX *cctx = NULL, *sctx = NULL;
548 SSL *clientssl = NULL, *serverssl = NULL;
549 int testctr = 0, testresult = 0;
551 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
553 &sctx, &cctx, cert, privkey)))
555 SSL_CTX_set_client_hello_cb(sctx, full_client_hello_callback, &testctr);
557 /* The gimpy cipher list we configure can't do TLS 1.3. */
558 SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
560 if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
561 "AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384"))
562 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
563 &clientssl, NULL, NULL))
564 || !TEST_false(create_ssl_connection(serverssl, clientssl,
565 SSL_ERROR_WANT_CLIENT_HELLO_CB))
567 * Passing a -1 literal is a hack since
568 * the real value was lost.
570 || !TEST_int_eq(SSL_get_error(serverssl, -1),
571 SSL_ERROR_WANT_CLIENT_HELLO_CB)
572 || !TEST_true(create_ssl_connection(serverssl, clientssl,
587 static int test_no_ems(void)
589 SSL_CTX *cctx = NULL, *sctx = NULL;
590 SSL *clientssl = NULL, *serverssl = NULL;
593 if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
594 TLS1_VERSION, TLS1_2_VERSION,
595 &sctx, &cctx, cert, privkey)) {
596 printf("Unable to create SSL_CTX pair\n");
600 SSL_CTX_set_options(sctx, SSL_OP_NO_EXTENDED_MASTER_SECRET);
602 if (!create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL)) {
603 printf("Unable to create SSL objects\n");
607 if (!create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)) {
608 printf("Creating SSL connection failed\n");
612 if (SSL_get_extms_support(serverssl)) {
613 printf("Server reports Extended Master Secret support\n");
617 if (SSL_get_extms_support(clientssl)) {
618 printf("Client reports Extended Master Secret support\n");
633 static int execute_test_large_message(const SSL_METHOD *smeth,
634 const SSL_METHOD *cmeth,
635 int min_version, int max_version,
638 SSL_CTX *cctx = NULL, *sctx = NULL;
639 SSL *clientssl = NULL, *serverssl = NULL;
643 X509 *chaincert = NULL;
646 if (!TEST_ptr(certbio = BIO_new_file(cert, "r")))
648 chaincert = PEM_read_bio_X509(certbio, NULL, NULL, NULL);
651 if (!TEST_ptr(chaincert))
654 if (!TEST_true(create_ssl_ctx_pair(smeth, cmeth, min_version, max_version,
655 &sctx, &cctx, cert, privkey)))
660 * Test that read_ahead works correctly when dealing with large
663 SSL_CTX_set_read_ahead(cctx, 1);
667 * We assume the supplied certificate is big enough so that if we add
668 * NUM_EXTRA_CERTS it will make the overall message large enough. The
669 * default buffer size is requested to be 16k, but due to the way BUF_MEM
670 * works, it ends up allocating a little over 21k (16 * 4/3). So, in this
671 * test we need to have a message larger than that.
673 certlen = i2d_X509(chaincert, NULL);
674 OPENSSL_assert(certlen * NUM_EXTRA_CERTS >
675 (SSL3_RT_MAX_PLAIN_LENGTH * 4) / 3);
676 for (i = 0; i < NUM_EXTRA_CERTS; i++) {
677 if (!X509_up_ref(chaincert))
679 if (!SSL_CTX_add_extra_chain_cert(sctx, chaincert)) {
680 X509_free(chaincert);
685 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
687 || !TEST_true(create_ssl_connection(serverssl, clientssl,
692 * Calling SSL_clear() first is not required but this tests that SSL_clear()
693 * doesn't leak (when using enable-crypto-mdebug).
695 if (!TEST_true(SSL_clear(serverssl)))
700 X509_free(chaincert);
709 #if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_KTLS) \
710 && !defined(OPENSSL_NO_SOCK)
712 /* sock must be connected */
713 static int ktls_chk_platform(int sock)
715 if (!ktls_enable(sock))
720 static int ping_pong_query(SSL *clientssl, SSL *serverssl, int cfd, int sfd)
722 static char count = 1;
723 unsigned char cbuf[16000] = {0};
724 unsigned char sbuf[16000];
726 char crec_wseq_before[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE];
727 char crec_wseq_after[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE];
728 char crec_rseq_before[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE];
729 char crec_rseq_after[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE];
730 char srec_wseq_before[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE];
731 char srec_wseq_after[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE];
732 char srec_rseq_before[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE];
733 char srec_rseq_after[TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE];
736 memcpy(crec_wseq_before, &clientssl->rlayer.write_sequence,
737 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
738 memcpy(crec_rseq_before, &clientssl->rlayer.read_sequence,
739 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
740 memcpy(srec_wseq_before, &serverssl->rlayer.write_sequence,
741 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
742 memcpy(srec_rseq_before, &serverssl->rlayer.read_sequence,
743 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
745 if (!TEST_true(SSL_write(clientssl, cbuf, sizeof(cbuf)) == sizeof(cbuf)))
748 while ((err = SSL_read(serverssl, &sbuf, sizeof(sbuf))) != sizeof(sbuf)) {
749 if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_READ) {
754 if (!TEST_true(SSL_write(serverssl, sbuf, sizeof(sbuf)) == sizeof(sbuf)))
757 while ((err = SSL_read(clientssl, &cbuf, sizeof(cbuf))) != sizeof(cbuf)) {
758 if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ) {
763 memcpy(crec_wseq_after, &clientssl->rlayer.write_sequence,
764 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
765 memcpy(crec_rseq_after, &clientssl->rlayer.read_sequence,
766 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
767 memcpy(srec_wseq_after, &serverssl->rlayer.write_sequence,
768 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
769 memcpy(srec_rseq_after, &serverssl->rlayer.read_sequence,
770 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
772 /* verify the payload */
773 if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(sbuf)))
776 /* ktls is used then kernel sequences are used instead of OpenSSL sequences */
777 if (clientssl->mode & SSL_MODE_NO_KTLS_TX) {
778 if (!TEST_mem_ne(crec_wseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE,
779 crec_wseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE))
782 if (!TEST_mem_eq(crec_wseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE,
783 crec_wseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE))
787 if (serverssl->mode & SSL_MODE_NO_KTLS_TX) {
788 if (!TEST_mem_ne(srec_wseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE,
789 srec_wseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE))
792 if (!TEST_mem_eq(srec_wseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE,
793 srec_wseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE))
797 if (clientssl->mode & SSL_MODE_NO_KTLS_RX) {
798 if (!TEST_mem_ne(crec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE,
799 crec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE))
802 if (!TEST_mem_eq(crec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE,
803 crec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE))
807 if (serverssl->mode & SSL_MODE_NO_KTLS_RX) {
808 if (!TEST_mem_ne(srec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE,
809 srec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE))
812 if (!TEST_mem_eq(srec_rseq_before, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE,
813 srec_rseq_after, TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE))
822 static int execute_test_ktls(int cis_ktls_tx, int cis_ktls_rx,
823 int sis_ktls_tx, int sis_ktls_rx)
825 SSL_CTX *cctx = NULL, *sctx = NULL;
826 SSL *clientssl = NULL, *serverssl = NULL;
830 if (!TEST_true(create_test_sockets(&cfd, &sfd)))
833 /* Skip this test if the platform does not support ktls */
834 if (!ktls_chk_platform(cfd))
837 /* Create a session based on SHA-256 */
838 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
840 TLS1_2_VERSION, TLS1_2_VERSION,
841 &sctx, &cctx, cert, privkey))
842 || !TEST_true(SSL_CTX_set_cipher_list(cctx,
843 "AES128-GCM-SHA256"))
844 || !TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
845 &clientssl, sfd, cfd)))
849 if (!TEST_true(SSL_set_mode(clientssl, SSL_MODE_NO_KTLS_TX)))
854 if (!TEST_true(SSL_set_mode(serverssl, SSL_MODE_NO_KTLS_TX)))
859 if (!TEST_true(SSL_set_mode(clientssl, SSL_MODE_NO_KTLS_RX)))
864 if (!TEST_true(SSL_set_mode(serverssl, SSL_MODE_NO_KTLS_RX)))
868 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
873 if (!TEST_false(BIO_get_ktls_send(clientssl->wbio)))
876 if (!TEST_true(BIO_get_ktls_send(clientssl->wbio)))
881 if (!TEST_false(BIO_get_ktls_send(serverssl->wbio)))
884 if (!TEST_true(BIO_get_ktls_send(serverssl->wbio)))
889 if (!TEST_false(BIO_get_ktls_recv(clientssl->rbio)))
892 if (!TEST_true(BIO_get_ktls_recv(clientssl->rbio)))
897 if (!TEST_false(BIO_get_ktls_recv(serverssl->rbio)))
900 if (!TEST_true(BIO_get_ktls_recv(serverssl->rbio)))
904 if (!TEST_true(ping_pong_query(clientssl, serverssl, cfd, sfd)))
910 SSL_shutdown(clientssl);
914 SSL_shutdown(serverssl);
919 serverssl = clientssl = NULL;
923 #define SENDFILE_SZ (16 * 4096)
924 #define SENDFILE_CHUNK (4 * 4096)
925 #define min(a,b) ((a) > (b) ? (b) : (a))
927 static int test_ktls_sendfile(void)
929 SSL_CTX *cctx = NULL, *sctx = NULL;
930 SSL *clientssl = NULL, *serverssl = NULL;
931 unsigned char *buf, *buf_dst;
932 BIO *out = NULL, *in = NULL;
933 int cfd, sfd, ffd, err;
934 ssize_t chunk_size = 0;
939 buf = OPENSSL_zalloc(SENDFILE_SZ);
940 buf_dst = OPENSSL_zalloc(SENDFILE_SZ);
941 if (!TEST_ptr(buf) || !TEST_ptr(buf_dst)
942 || !TEST_true(create_test_sockets(&cfd, &sfd)))
945 /* Skip this test if the platform does not support ktls */
946 if (!ktls_chk_platform(sfd)) {
951 /* Create a session based on SHA-256 */
952 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
954 TLS1_2_VERSION, TLS1_2_VERSION,
955 &sctx, &cctx, cert, privkey))
956 || !TEST_true(SSL_CTX_set_cipher_list(cctx,
957 "AES128-GCM-SHA256"))
958 || !TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
959 &clientssl, sfd, cfd)))
962 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
964 || !TEST_true(BIO_get_ktls_send(serverssl->wbio)))
967 RAND_bytes(buf, SENDFILE_SZ);
968 out = BIO_new_file(tmpfilename, "wb");
972 if (BIO_write(out, buf, SENDFILE_SZ) != SENDFILE_SZ)
977 in = BIO_new_file(tmpfilename, "rb");
978 BIO_get_fp(in, &ffdp);
981 while (chunk_off < SENDFILE_SZ) {
982 chunk_size = min(SENDFILE_CHUNK, SENDFILE_SZ - chunk_off);
983 while ((err = SSL_sendfile(serverssl,
988 if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_WRITE)
991 while ((err = SSL_read(clientssl,
993 chunk_size)) != chunk_size) {
994 if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ)
998 /* verify the payload */
999 if (!TEST_mem_eq(buf_dst + chunk_off,
1005 chunk_off += chunk_size;
1011 SSL_shutdown(clientssl);
1012 SSL_free(clientssl);
1015 SSL_shutdown(serverssl);
1016 SSL_free(serverssl);
1020 serverssl = clientssl = NULL;
1024 OPENSSL_free(buf_dst);
1028 static int test_ktls_no_txrx_client_no_txrx_server(void)
1030 return execute_test_ktls(0, 0, 0, 0);
1033 static int test_ktls_no_rx_client_no_txrx_server(void)
1035 return execute_test_ktls(1, 0, 0, 0);
1038 static int test_ktls_no_tx_client_no_txrx_server(void)
1040 return execute_test_ktls(0, 1, 0, 0);
1043 static int test_ktls_client_no_txrx_server(void)
1045 return execute_test_ktls(1, 1, 0, 0);
1048 static int test_ktls_no_txrx_client_no_rx_server(void)
1050 return execute_test_ktls(0, 0, 1, 0);
1053 static int test_ktls_no_rx_client_no_rx_server(void)
1055 return execute_test_ktls(1, 0, 1, 0);
1058 static int test_ktls_no_tx_client_no_rx_server(void)
1060 return execute_test_ktls(0, 1, 1, 0);
1063 static int test_ktls_client_no_rx_server(void)
1065 return execute_test_ktls(1, 1, 1, 0);
1068 static int test_ktls_no_txrx_client_no_tx_server(void)
1070 return execute_test_ktls(0, 0, 0, 1);
1073 static int test_ktls_no_rx_client_no_tx_server(void)
1075 return execute_test_ktls(1, 0, 0, 1);
1078 static int test_ktls_no_tx_client_no_tx_server(void)
1080 return execute_test_ktls(0, 1, 0, 1);
1083 static int test_ktls_client_no_tx_server(void)
1085 return execute_test_ktls(1, 1, 0, 1);
1088 static int test_ktls_no_txrx_client_server(void)
1090 return execute_test_ktls(0, 0, 1, 1);
1093 static int test_ktls_no_rx_client_server(void)
1095 return execute_test_ktls(1, 0, 1, 1);
1098 static int test_ktls_no_tx_client_server(void)
1100 return execute_test_ktls(0, 1, 1, 1);
1103 static int test_ktls_client_server(void)
1105 return execute_test_ktls(1, 1, 1, 1);
1109 static int test_large_message_tls(void)
1111 return execute_test_large_message(TLS_server_method(), TLS_client_method(),
1112 TLS1_VERSION, 0, 0);
1115 static int test_large_message_tls_read_ahead(void)
1117 return execute_test_large_message(TLS_server_method(), TLS_client_method(),
1118 TLS1_VERSION, 0, 1);
1121 #ifndef OPENSSL_NO_DTLS
1122 static int test_large_message_dtls(void)
1125 * read_ahead is not relevant to DTLS because DTLS always acts as if
1126 * read_ahead is set.
1128 return execute_test_large_message(DTLS_server_method(),
1129 DTLS_client_method(),
1130 DTLS1_VERSION, 0, 0);
1134 #ifndef OPENSSL_NO_OCSP
1135 static int ocsp_server_cb(SSL *s, void *arg)
1137 int *argi = (int *)arg;
1138 unsigned char *copy = NULL;
1139 STACK_OF(OCSP_RESPID) *ids = NULL;
1140 OCSP_RESPID *id = NULL;
1143 /* In this test we are expecting exactly 1 OCSP_RESPID */
1144 SSL_get_tlsext_status_ids(s, &ids);
1145 if (ids == NULL || sk_OCSP_RESPID_num(ids) != 1)
1146 return SSL_TLSEXT_ERR_ALERT_FATAL;
1148 id = sk_OCSP_RESPID_value(ids, 0);
1149 if (id == NULL || !OCSP_RESPID_match(id, ocspcert))
1150 return SSL_TLSEXT_ERR_ALERT_FATAL;
1151 } else if (*argi != 1) {
1152 return SSL_TLSEXT_ERR_ALERT_FATAL;
1155 if (!TEST_ptr(copy = OPENSSL_memdup(orespder, sizeof(orespder))))
1156 return SSL_TLSEXT_ERR_ALERT_FATAL;
1158 SSL_set_tlsext_status_ocsp_resp(s, copy, sizeof(orespder));
1159 ocsp_server_called = 1;
1160 return SSL_TLSEXT_ERR_OK;
1163 static int ocsp_client_cb(SSL *s, void *arg)
1165 int *argi = (int *)arg;
1166 const unsigned char *respderin;
1169 if (*argi != 1 && *argi != 2)
1172 len = SSL_get_tlsext_status_ocsp_resp(s, &respderin);
1173 if (!TEST_mem_eq(orespder, len, respderin, len))
1176 ocsp_client_called = 1;
1180 static int test_tlsext_status_type(void)
1182 SSL_CTX *cctx = NULL, *sctx = NULL;
1183 SSL *clientssl = NULL, *serverssl = NULL;
1185 STACK_OF(OCSP_RESPID) *ids = NULL;
1186 OCSP_RESPID *id = NULL;
1187 BIO *certbio = NULL;
1189 if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
1191 &sctx, &cctx, cert, privkey))
1194 if (SSL_CTX_get_tlsext_status_type(cctx) != -1)
1197 /* First just do various checks getting and setting tlsext_status_type */
1199 clientssl = SSL_new(cctx);
1200 if (!TEST_int_eq(SSL_get_tlsext_status_type(clientssl), -1)
1201 || !TEST_true(SSL_set_tlsext_status_type(clientssl,
1202 TLSEXT_STATUSTYPE_ocsp))
1203 || !TEST_int_eq(SSL_get_tlsext_status_type(clientssl),
1204 TLSEXT_STATUSTYPE_ocsp))
1207 SSL_free(clientssl);
1210 if (!SSL_CTX_set_tlsext_status_type(cctx, TLSEXT_STATUSTYPE_ocsp)
1211 || SSL_CTX_get_tlsext_status_type(cctx) != TLSEXT_STATUSTYPE_ocsp)
1214 clientssl = SSL_new(cctx);
1215 if (SSL_get_tlsext_status_type(clientssl) != TLSEXT_STATUSTYPE_ocsp)
1217 SSL_free(clientssl);
1221 * Now actually do a handshake and check OCSP information is exchanged and
1222 * the callbacks get called
1224 SSL_CTX_set_tlsext_status_cb(cctx, ocsp_client_cb);
1225 SSL_CTX_set_tlsext_status_arg(cctx, &cdummyarg);
1226 SSL_CTX_set_tlsext_status_cb(sctx, ocsp_server_cb);
1227 SSL_CTX_set_tlsext_status_arg(sctx, &cdummyarg);
1228 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
1229 &clientssl, NULL, NULL))
1230 || !TEST_true(create_ssl_connection(serverssl, clientssl,
1232 || !TEST_true(ocsp_client_called)
1233 || !TEST_true(ocsp_server_called))
1235 SSL_free(serverssl);
1236 SSL_free(clientssl);
1240 /* Try again but this time force the server side callback to fail */
1241 ocsp_client_called = 0;
1242 ocsp_server_called = 0;
1244 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
1245 &clientssl, NULL, NULL))
1246 /* This should fail because the callback will fail */
1247 || !TEST_false(create_ssl_connection(serverssl, clientssl,
1249 || !TEST_false(ocsp_client_called)
1250 || !TEST_false(ocsp_server_called))
1252 SSL_free(serverssl);
1253 SSL_free(clientssl);
1258 * This time we'll get the client to send an OCSP_RESPID that it will
1261 ocsp_client_called = 0;
1262 ocsp_server_called = 0;
1264 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
1265 &clientssl, NULL, NULL)))
1269 * We'll just use any old cert for this test - it doesn't have to be an OCSP
1270 * specific one. We'll use the server cert.
1272 if (!TEST_ptr(certbio = BIO_new_file(cert, "r"))
1273 || !TEST_ptr(id = OCSP_RESPID_new())
1274 || !TEST_ptr(ids = sk_OCSP_RESPID_new_null())
1275 || !TEST_ptr(ocspcert = PEM_read_bio_X509(certbio,
1277 || !TEST_true(OCSP_RESPID_set_by_key(id, ocspcert))
1278 || !TEST_true(sk_OCSP_RESPID_push(ids, id)))
1281 SSL_set_tlsext_status_ids(clientssl, ids);
1282 /* Control has been transferred */
1288 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
1290 || !TEST_true(ocsp_client_called)
1291 || !TEST_true(ocsp_server_called))
1297 SSL_free(serverssl);
1298 SSL_free(clientssl);
1301 sk_OCSP_RESPID_pop_free(ids, OCSP_RESPID_free);
1302 OCSP_RESPID_free(id);
1304 X509_free(ocspcert);
1311 #if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
1312 static int new_called, remove_called, get_called;
1314 static int new_session_cb(SSL *ssl, SSL_SESSION *sess)
1318 * sess has been up-refed for us, but we don't actually need it so free it
1321 SSL_SESSION_free(sess);
1325 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
1330 static SSL_SESSION *get_sess_val = NULL;
1332 static SSL_SESSION *get_session_cb(SSL *ssl, const unsigned char *id, int len,
1337 return get_sess_val;
1340 static int execute_test_session(int maxprot, int use_int_cache,
1343 SSL_CTX *sctx = NULL, *cctx = NULL;
1344 SSL *serverssl1 = NULL, *clientssl1 = NULL;
1345 SSL *serverssl2 = NULL, *clientssl2 = NULL;
1346 # ifndef OPENSSL_NO_TLS1_1
1347 SSL *serverssl3 = NULL, *clientssl3 = NULL;
1349 SSL_SESSION *sess1 = NULL, *sess2 = NULL;
1350 int testresult = 0, numnewsesstick = 1;
1352 new_called = remove_called = 0;
1354 /* TLSv1.3 sends 2 NewSessionTickets */
1355 if (maxprot == TLS1_3_VERSION)
1358 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
1360 &sctx, &cctx, cert, privkey)))
1364 * Only allow the max protocol version so we can force a connection failure
1367 SSL_CTX_set_min_proto_version(cctx, maxprot);
1368 SSL_CTX_set_max_proto_version(cctx, maxprot);
1370 /* Set up session cache */
1371 if (use_ext_cache) {
1372 SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
1373 SSL_CTX_sess_set_remove_cb(cctx, remove_session_cb);
1375 if (use_int_cache) {
1376 /* Also covers instance where both are set */
1377 SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT);
1379 SSL_CTX_set_session_cache_mode(cctx,
1380 SSL_SESS_CACHE_CLIENT
1381 | SSL_SESS_CACHE_NO_INTERNAL_STORE);
1384 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1,
1386 || !TEST_true(create_ssl_connection(serverssl1, clientssl1,
1388 || !TEST_ptr(sess1 = SSL_get1_session(clientssl1)))
1391 /* Should fail because it should already be in the cache */
1392 if (use_int_cache && !TEST_false(SSL_CTX_add_session(cctx, sess1)))
1395 && (!TEST_int_eq(new_called, numnewsesstick)
1397 || !TEST_int_eq(remove_called, 0)))
1400 new_called = remove_called = 0;
1401 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
1402 &clientssl2, NULL, NULL))
1403 || !TEST_true(SSL_set_session(clientssl2, sess1))
1404 || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
1406 || !TEST_true(SSL_session_reused(clientssl2)))
1409 if (maxprot == TLS1_3_VERSION) {
1411 * In TLSv1.3 we should have created a new session even though we have
1412 * resumed. Since we attempted a resume we should also have removed the
1413 * old ticket from the cache so that we try to only use tickets once.
1416 && (!TEST_int_eq(new_called, 1)
1417 || !TEST_int_eq(remove_called, 1)))
1421 * In TLSv1.2 we expect to have resumed so no sessions added or
1425 && (!TEST_int_eq(new_called, 0)
1426 || !TEST_int_eq(remove_called, 0)))
1430 SSL_SESSION_free(sess1);
1431 if (!TEST_ptr(sess1 = SSL_get1_session(clientssl2)))
1433 shutdown_ssl_connection(serverssl2, clientssl2);
1434 serverssl2 = clientssl2 = NULL;
1436 new_called = remove_called = 0;
1437 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
1438 &clientssl2, NULL, NULL))
1439 || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
1443 if (!TEST_ptr(sess2 = SSL_get1_session(clientssl2)))
1447 && (!TEST_int_eq(new_called, numnewsesstick)
1448 || !TEST_int_eq(remove_called, 0)))
1451 new_called = remove_called = 0;
1453 * This should clear sess2 from the cache because it is a "bad" session.
1454 * See SSL_set_session() documentation.
1456 if (!TEST_true(SSL_set_session(clientssl2, sess1)))
1459 && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
1461 if (!TEST_ptr_eq(SSL_get_session(clientssl2), sess1))
1464 if (use_int_cache) {
1465 /* Should succeeded because it should not already be in the cache */
1466 if (!TEST_true(SSL_CTX_add_session(cctx, sess2))
1467 || !TEST_true(SSL_CTX_remove_session(cctx, sess2)))
1471 new_called = remove_called = 0;
1472 /* This shouldn't be in the cache so should fail */
1473 if (!TEST_false(SSL_CTX_remove_session(cctx, sess2)))
1477 && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
1480 # if !defined(OPENSSL_NO_TLS1_1)
1481 new_called = remove_called = 0;
1482 /* Force a connection failure */
1483 SSL_CTX_set_max_proto_version(sctx, TLS1_1_VERSION);
1484 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl3,
1485 &clientssl3, NULL, NULL))
1486 || !TEST_true(SSL_set_session(clientssl3, sess1))
1487 /* This should fail because of the mismatched protocol versions */
1488 || !TEST_false(create_ssl_connection(serverssl3, clientssl3,
1492 /* We should have automatically removed the session from the cache */
1494 && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
1497 /* Should succeed because it should not already be in the cache */
1498 if (use_int_cache && !TEST_true(SSL_CTX_add_session(cctx, sess2)))
1502 /* Now do some tests for server side caching */
1503 if (use_ext_cache) {
1504 SSL_CTX_sess_set_new_cb(cctx, NULL);
1505 SSL_CTX_sess_set_remove_cb(cctx, NULL);
1506 SSL_CTX_sess_set_new_cb(sctx, new_session_cb);
1507 SSL_CTX_sess_set_remove_cb(sctx, remove_session_cb);
1508 SSL_CTX_sess_set_get_cb(sctx, get_session_cb);
1509 get_sess_val = NULL;
1512 SSL_CTX_set_session_cache_mode(cctx, 0);
1513 /* Internal caching is the default on the server side */
1515 SSL_CTX_set_session_cache_mode(sctx,
1516 SSL_SESS_CACHE_SERVER
1517 | SSL_SESS_CACHE_NO_INTERNAL_STORE);
1519 SSL_free(serverssl1);
1520 SSL_free(clientssl1);
1521 serverssl1 = clientssl1 = NULL;
1522 SSL_free(serverssl2);
1523 SSL_free(clientssl2);
1524 serverssl2 = clientssl2 = NULL;
1525 SSL_SESSION_free(sess1);
1527 SSL_SESSION_free(sess2);
1530 SSL_CTX_set_max_proto_version(sctx, maxprot);
1531 if (maxprot == TLS1_2_VERSION)
1532 SSL_CTX_set_options(sctx, SSL_OP_NO_TICKET);
1533 new_called = remove_called = get_called = 0;
1534 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1,
1536 || !TEST_true(create_ssl_connection(serverssl1, clientssl1,
1538 || !TEST_ptr(sess1 = SSL_get1_session(clientssl1))
1539 || !TEST_ptr(sess2 = SSL_get1_session(serverssl1)))
1542 if (use_int_cache) {
1543 if (maxprot == TLS1_3_VERSION && !use_ext_cache) {
1545 * In TLSv1.3 it should not have been added to the internal cache,
1546 * except in the case where we also have an external cache (in that
1547 * case it gets added to the cache in order to generate remove
1548 * events after timeout).
1550 if (!TEST_false(SSL_CTX_remove_session(sctx, sess2)))
1553 /* Should fail because it should already be in the cache */
1554 if (!TEST_false(SSL_CTX_add_session(sctx, sess2)))
1559 if (use_ext_cache) {
1560 SSL_SESSION *tmp = sess2;
1562 if (!TEST_int_eq(new_called, numnewsesstick)
1563 || !TEST_int_eq(remove_called, 0)
1564 || !TEST_int_eq(get_called, 0))
1567 * Delete the session from the internal cache to force a lookup from
1568 * the external cache. We take a copy first because
1569 * SSL_CTX_remove_session() also marks the session as non-resumable.
1571 if (use_int_cache && maxprot != TLS1_3_VERSION) {
1572 if (!TEST_ptr(tmp = SSL_SESSION_dup(sess2))
1573 || !TEST_true(SSL_CTX_remove_session(sctx, sess2)))
1575 SSL_SESSION_free(sess2);
1580 new_called = remove_called = get_called = 0;
1581 get_sess_val = sess2;
1582 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
1583 &clientssl2, NULL, NULL))
1584 || !TEST_true(SSL_set_session(clientssl2, sess1))
1585 || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
1587 || !TEST_true(SSL_session_reused(clientssl2)))
1590 if (use_ext_cache) {
1591 if (!TEST_int_eq(remove_called, 0))
1594 if (maxprot == TLS1_3_VERSION) {
1595 if (!TEST_int_eq(new_called, 1)
1596 || !TEST_int_eq(get_called, 0))
1599 if (!TEST_int_eq(new_called, 0)
1600 || !TEST_int_eq(get_called, 1))
1608 SSL_free(serverssl1);
1609 SSL_free(clientssl1);
1610 SSL_free(serverssl2);
1611 SSL_free(clientssl2);
1612 # ifndef OPENSSL_NO_TLS1_1
1613 SSL_free(serverssl3);
1614 SSL_free(clientssl3);
1616 SSL_SESSION_free(sess1);
1617 SSL_SESSION_free(sess2);
1623 #endif /* !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2) */
1625 static int test_session_with_only_int_cache(void)
1627 #ifndef OPENSSL_NO_TLS1_3
1628 if (!execute_test_session(TLS1_3_VERSION, 1, 0))
1632 #ifndef OPENSSL_NO_TLS1_2
1633 return execute_test_session(TLS1_2_VERSION, 1, 0);
1639 static int test_session_with_only_ext_cache(void)
1641 #ifndef OPENSSL_NO_TLS1_3
1642 if (!execute_test_session(TLS1_3_VERSION, 0, 1))
1646 #ifndef OPENSSL_NO_TLS1_2
1647 return execute_test_session(TLS1_2_VERSION, 0, 1);
1653 static int test_session_with_both_cache(void)
1655 #ifndef OPENSSL_NO_TLS1_3
1656 if (!execute_test_session(TLS1_3_VERSION, 1, 1))
1660 #ifndef OPENSSL_NO_TLS1_2
1661 return execute_test_session(TLS1_2_VERSION, 1, 1);
1667 #ifndef OPENSSL_NO_TLS1_3
1668 static SSL_SESSION *sesscache[6];
1669 static int do_cache;
1671 static int new_cachesession_cb(SSL *ssl, SSL_SESSION *sess)
1674 sesscache[new_called] = sess;
1676 /* We don't need the reference to the session, so free it */
1677 SSL_SESSION_free(sess);
1684 static int post_handshake_verify(SSL *sssl, SSL *cssl)
1686 SSL_set_verify(sssl, SSL_VERIFY_PEER, NULL);
1687 if (!TEST_true(SSL_verify_client_post_handshake(sssl)))
1690 /* Start handshake on the server and client */
1691 if (!TEST_int_eq(SSL_do_handshake(sssl), 1)
1692 || !TEST_int_le(SSL_read(cssl, NULL, 0), 0)
1693 || !TEST_int_le(SSL_read(sssl, NULL, 0), 0)
1694 || !TEST_true(create_ssl_connection(sssl, cssl,
1701 static int setup_ticket_test(int stateful, int idx, SSL_CTX **sctx,
1704 int sess_id_ctx = 1;
1706 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
1707 TLS1_VERSION, 0, sctx,
1708 cctx, cert, privkey))
1709 || !TEST_true(SSL_CTX_set_num_tickets(*sctx, idx))
1710 || !TEST_true(SSL_CTX_set_session_id_context(*sctx,
1711 (void *)&sess_id_ctx,
1712 sizeof(sess_id_ctx))))
1716 SSL_CTX_set_options(*sctx, SSL_OP_NO_TICKET);
1718 SSL_CTX_set_session_cache_mode(*cctx, SSL_SESS_CACHE_CLIENT
1719 | SSL_SESS_CACHE_NO_INTERNAL_STORE);
1720 SSL_CTX_sess_set_new_cb(*cctx, new_cachesession_cb);
1725 static int check_resumption(int idx, SSL_CTX *sctx, SSL_CTX *cctx, int succ)
1727 SSL *serverssl = NULL, *clientssl = NULL;
1730 /* Test that we can resume with all the tickets we got given */
1731 for (i = 0; i < idx * 2; i++) {
1733 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
1734 &clientssl, NULL, NULL))
1735 || !TEST_true(SSL_set_session(clientssl, sesscache[i])))
1738 SSL_set_post_handshake_auth(clientssl, 1);
1740 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
1745 * Following a successful resumption we only get 1 ticket. After a
1746 * failed one we should get idx tickets.
1749 if (!TEST_true(SSL_session_reused(clientssl))
1750 || !TEST_int_eq(new_called, 1))
1753 if (!TEST_false(SSL_session_reused(clientssl))
1754 || !TEST_int_eq(new_called, idx))
1759 /* After a post-handshake authentication we should get 1 new ticket */
1761 && (!post_handshake_verify(serverssl, clientssl)
1762 || !TEST_int_eq(new_called, 1)))
1765 SSL_shutdown(clientssl);
1766 SSL_shutdown(serverssl);
1767 SSL_free(serverssl);
1768 SSL_free(clientssl);
1769 serverssl = clientssl = NULL;
1770 SSL_SESSION_free(sesscache[i]);
1771 sesscache[i] = NULL;
1777 SSL_free(clientssl);
1778 SSL_free(serverssl);
1782 static int test_tickets(int stateful, int idx)
1784 SSL_CTX *sctx = NULL, *cctx = NULL;
1785 SSL *serverssl = NULL, *clientssl = NULL;
1789 /* idx is the test number, but also the number of tickets we want */
1794 if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
1797 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
1798 &clientssl, NULL, NULL)))
1801 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
1803 /* Check we got the number of tickets we were expecting */
1804 || !TEST_int_eq(idx, new_called))
1807 SSL_shutdown(clientssl);
1808 SSL_shutdown(serverssl);
1809 SSL_free(serverssl);
1810 SSL_free(clientssl);
1813 clientssl = serverssl = NULL;
1817 * Now we try to resume with the tickets we previously created. The
1818 * resumption attempt is expected to fail (because we're now using a new
1819 * SSL_CTX). We should see idx number of tickets issued again.
1822 /* Stop caching sessions - just count them */
1825 if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
1828 if (!check_resumption(idx, sctx, cctx, 0))
1831 /* Start again with caching sessions */
1838 if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
1841 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
1842 &clientssl, NULL, NULL)))
1845 SSL_set_post_handshake_auth(clientssl, 1);
1847 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
1849 /* Check we got the number of tickets we were expecting */
1850 || !TEST_int_eq(idx, new_called))
1853 /* After a post-handshake authentication we should get new tickets issued */
1854 if (!post_handshake_verify(serverssl, clientssl)
1855 || !TEST_int_eq(idx * 2, new_called))
1858 SSL_shutdown(clientssl);
1859 SSL_shutdown(serverssl);
1860 SSL_free(serverssl);
1861 SSL_free(clientssl);
1862 serverssl = clientssl = NULL;
1864 /* Stop caching sessions - just count them */
1868 * Check we can resume with all the tickets we created. This time around the
1869 * resumptions should all be successful.
1871 if (!check_resumption(idx, sctx, cctx, 1))
1877 SSL_free(serverssl);
1878 SSL_free(clientssl);
1879 for (j = 0; j < OSSL_NELEM(sesscache); j++) {
1880 SSL_SESSION_free(sesscache[j]);
1881 sesscache[j] = NULL;
1889 static int test_stateless_tickets(int idx)
1891 return test_tickets(0, idx);
1894 static int test_stateful_tickets(int idx)
1896 return test_tickets(1, idx);
1899 static int test_psk_tickets(void)
1901 SSL_CTX *sctx = NULL, *cctx = NULL;
1902 SSL *serverssl = NULL, *clientssl = NULL;
1904 int sess_id_ctx = 1;
1906 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
1907 TLS1_VERSION, 0, &sctx,
1909 || !TEST_true(SSL_CTX_set_session_id_context(sctx,
1910 (void *)&sess_id_ctx,
1911 sizeof(sess_id_ctx))))
1914 SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT
1915 | SSL_SESS_CACHE_NO_INTERNAL_STORE);
1916 SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb);
1917 SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb);
1918 SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
1919 use_session_cb_cnt = 0;
1920 find_session_cb_cnt = 0;
1924 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
1927 clientpsk = serverpsk = create_a_psk(clientssl);
1928 if (!TEST_ptr(clientpsk))
1930 SSL_SESSION_up_ref(clientpsk);
1932 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
1934 || !TEST_int_eq(1, find_session_cb_cnt)
1935 || !TEST_int_eq(1, use_session_cb_cnt)
1936 /* We should always get 1 ticket when using external PSK */
1937 || !TEST_int_eq(1, new_called))
1943 SSL_free(serverssl);
1944 SSL_free(clientssl);
1947 SSL_SESSION_free(clientpsk);
1948 SSL_SESSION_free(serverpsk);
1949 clientpsk = serverpsk = NULL;
1958 #define USE_DEFAULT 3
1960 #define CONNTYPE_CONNECTION_SUCCESS 0
1961 #define CONNTYPE_CONNECTION_FAIL 1
1962 #define CONNTYPE_NO_CONNECTION 2
1964 #define TOTAL_NO_CONN_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)
1965 #define TOTAL_CONN_SUCCESS_SSL_SET_BIO_TESTS (2 * 2)
1966 #if !defined(OPENSSL_NO_TLS1_3) && !defined(OPENSSL_NO_TLS1_2)
1967 # define TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS (2 * 2)
1969 # define TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS 0
1972 #define TOTAL_SSL_SET_BIO_TESTS TOTAL_NO_CONN_SSL_SET_BIO_TESTS \
1973 + TOTAL_CONN_SUCCESS_SSL_SET_BIO_TESTS \
1974 + TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS
1976 static void setupbio(BIO **res, BIO *bio1, BIO *bio2, int type)
1993 * Tests calls to SSL_set_bio() under various conditions.
1995 * For the first 3 * 3 * 3 * 3 = 81 tests we do 2 calls to SSL_set_bio() with
1996 * various combinations of valid BIOs or NULL being set for the rbio/wbio. We
1997 * then do more tests where we create a successful connection first using our
1998 * standard connection setup functions, and then call SSL_set_bio() with
1999 * various combinations of valid BIOs or NULL. We then repeat these tests
2000 * following a failed connection. In this last case we are looking to check that
2001 * SSL_set_bio() functions correctly in the case where s->bbio is not NULL.
2003 static int test_ssl_set_bio(int idx)
2005 SSL_CTX *sctx = NULL, *cctx = NULL;
2008 BIO *irbio = NULL, *iwbio = NULL, *nrbio = NULL, *nwbio = NULL;
2009 SSL *serverssl = NULL, *clientssl = NULL;
2010 int initrbio, initwbio, newrbio, newwbio, conntype;
2013 if (idx < TOTAL_NO_CONN_SSL_SET_BIO_TESTS) {
2021 conntype = CONNTYPE_NO_CONNECTION;
2023 idx -= TOTAL_NO_CONN_SSL_SET_BIO_TESTS;
2024 initrbio = initwbio = USE_DEFAULT;
2032 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
2034 &sctx, &cctx, cert, privkey)))
2037 if (conntype == CONNTYPE_CONNECTION_FAIL) {
2039 * We won't ever get here if either TLSv1.3 or TLSv1.2 is disabled
2040 * because we reduced the number of tests in the definition of
2041 * TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS to avoid this scenario. By setting
2042 * mismatched protocol versions we will force a connection failure.
2044 SSL_CTX_set_min_proto_version(sctx, TLS1_3_VERSION);
2045 SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
2048 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2052 if (initrbio == USE_BIO_1
2053 || initwbio == USE_BIO_1
2054 || newrbio == USE_BIO_1
2055 || newwbio == USE_BIO_1) {
2056 if (!TEST_ptr(bio1 = BIO_new(BIO_s_mem())))
2060 if (initrbio == USE_BIO_2
2061 || initwbio == USE_BIO_2
2062 || newrbio == USE_BIO_2
2063 || newwbio == USE_BIO_2) {
2064 if (!TEST_ptr(bio2 = BIO_new(BIO_s_mem())))
2068 if (initrbio != USE_DEFAULT) {
2069 setupbio(&irbio, bio1, bio2, initrbio);
2070 setupbio(&iwbio, bio1, bio2, initwbio);
2071 SSL_set_bio(clientssl, irbio, iwbio);
2074 * We want to maintain our own refs to these BIO, so do an up ref for
2075 * each BIO that will have ownership transferred in the SSL_set_bio()
2080 if (iwbio != NULL && iwbio != irbio)
2084 if (conntype != CONNTYPE_NO_CONNECTION
2085 && !TEST_true(create_ssl_connection(serverssl, clientssl,
2087 == (conntype == CONNTYPE_CONNECTION_SUCCESS)))
2090 setupbio(&nrbio, bio1, bio2, newrbio);
2091 setupbio(&nwbio, bio1, bio2, newwbio);
2094 * We will (maybe) transfer ownership again so do more up refs.
2095 * SSL_set_bio() has some really complicated ownership rules where BIOs have
2100 && (nwbio != iwbio || nrbio != nwbio))
2104 && (nwbio != iwbio || (nwbio == iwbio && irbio == iwbio)))
2107 SSL_set_bio(clientssl, nrbio, nwbio);
2116 * This test is checking that the ref counting for SSL_set_bio is correct.
2117 * If we get here and we did too many frees then we will fail in the above
2118 * functions. If we haven't done enough then this will only be detected in
2119 * a crypto-mdebug build
2121 SSL_free(serverssl);
2122 SSL_free(clientssl);
2128 typedef enum { NO_BIO_CHANGE, CHANGE_RBIO, CHANGE_WBIO } bio_change_t;
2130 static int execute_test_ssl_bio(int pop_ssl, bio_change_t change_bio)
2132 BIO *sslbio = NULL, *membio1 = NULL, *membio2 = NULL;
2137 if (!TEST_ptr(ctx = SSL_CTX_new(TLS_method()))
2138 || !TEST_ptr(ssl = SSL_new(ctx))
2139 || !TEST_ptr(sslbio = BIO_new(BIO_f_ssl()))
2140 || !TEST_ptr(membio1 = BIO_new(BIO_s_mem())))
2143 BIO_set_ssl(sslbio, ssl, BIO_CLOSE);
2146 * If anything goes wrong here then we could leak memory, so this will
2147 * be caught in a crypto-mdebug build
2149 BIO_push(sslbio, membio1);
2151 /* Verify changing the rbio/wbio directly does not cause leaks */
2152 if (change_bio != NO_BIO_CHANGE) {
2153 if (!TEST_ptr(membio2 = BIO_new(BIO_s_mem())))
2155 if (change_bio == CHANGE_RBIO)
2156 SSL_set0_rbio(ssl, membio2);
2158 SSL_set0_wbio(ssl, membio2);
2177 static int test_ssl_bio_pop_next_bio(void)
2179 return execute_test_ssl_bio(0, NO_BIO_CHANGE);
2182 static int test_ssl_bio_pop_ssl_bio(void)
2184 return execute_test_ssl_bio(1, NO_BIO_CHANGE);
2187 static int test_ssl_bio_change_rbio(void)
2189 return execute_test_ssl_bio(0, CHANGE_RBIO);
2192 static int test_ssl_bio_change_wbio(void)
2194 return execute_test_ssl_bio(0, CHANGE_WBIO);
2197 #if !defined(OPENSSL_NO_TLS1_2) || defined(OPENSSL_NO_TLS1_3)
2199 /* The list of sig algs */
2201 /* The length of the list */
2203 /* A sigalgs list in string format */
2204 const char *liststr;
2205 /* Whether setting the list should succeed */
2207 /* Whether creating a connection with the list should succeed */
2211 static const int validlist1[] = {NID_sha256, EVP_PKEY_RSA};
2212 # ifndef OPENSSL_NO_EC
2213 static const int validlist2[] = {NID_sha256, EVP_PKEY_RSA, NID_sha512, EVP_PKEY_EC};
2214 static const int validlist3[] = {NID_sha512, EVP_PKEY_EC};
2216 static const int invalidlist1[] = {NID_undef, EVP_PKEY_RSA};
2217 static const int invalidlist2[] = {NID_sha256, NID_undef};
2218 static const int invalidlist3[] = {NID_sha256, EVP_PKEY_RSA, NID_sha256};
2219 static const int invalidlist4[] = {NID_sha256};
2220 static const sigalgs_list testsigalgs[] = {
2221 {validlist1, OSSL_NELEM(validlist1), NULL, 1, 1},
2222 # ifndef OPENSSL_NO_EC
2223 {validlist2, OSSL_NELEM(validlist2), NULL, 1, 1},
2224 {validlist3, OSSL_NELEM(validlist3), NULL, 1, 0},
2226 {NULL, 0, "RSA+SHA256", 1, 1},
2227 # ifndef OPENSSL_NO_EC
2228 {NULL, 0, "RSA+SHA256:ECDSA+SHA512", 1, 1},
2229 {NULL, 0, "ECDSA+SHA512", 1, 0},
2231 {invalidlist1, OSSL_NELEM(invalidlist1), NULL, 0, 0},
2232 {invalidlist2, OSSL_NELEM(invalidlist2), NULL, 0, 0},
2233 {invalidlist3, OSSL_NELEM(invalidlist3), NULL, 0, 0},
2234 {invalidlist4, OSSL_NELEM(invalidlist4), NULL, 0, 0},
2235 {NULL, 0, "RSA", 0, 0},
2236 {NULL, 0, "SHA256", 0, 0},
2237 {NULL, 0, "RSA+SHA256:SHA256", 0, 0},
2238 {NULL, 0, "Invalid", 0, 0}
2241 static int test_set_sigalgs(int idx)
2243 SSL_CTX *cctx = NULL, *sctx = NULL;
2244 SSL *clientssl = NULL, *serverssl = NULL;
2246 const sigalgs_list *curr;
2249 /* Should never happen */
2250 if (!TEST_size_t_le((size_t)idx, OSSL_NELEM(testsigalgs) * 2))
2253 testctx = ((size_t)idx < OSSL_NELEM(testsigalgs));
2254 curr = testctx ? &testsigalgs[idx]
2255 : &testsigalgs[idx - OSSL_NELEM(testsigalgs)];
2257 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
2259 &sctx, &cctx, cert, privkey)))
2263 * TODO(TLS1.3): These APIs cannot set TLSv1.3 sig algs so we just test it
2264 * for TLSv1.2 for now until we add a new API.
2266 SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
2271 if (curr->list != NULL)
2272 ret = SSL_CTX_set1_sigalgs(cctx, curr->list, curr->listlen);
2274 ret = SSL_CTX_set1_sigalgs_list(cctx, curr->liststr);
2278 TEST_info("Failure setting sigalgs in SSL_CTX (%d)\n", idx);
2284 TEST_info("Not-failed setting sigalgs in SSL_CTX (%d)\n", idx);
2289 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
2290 &clientssl, NULL, NULL)))
2296 if (curr->list != NULL)
2297 ret = SSL_set1_sigalgs(clientssl, curr->list, curr->listlen);
2299 ret = SSL_set1_sigalgs_list(clientssl, curr->liststr);
2302 TEST_info("Failure setting sigalgs in SSL (%d)\n", idx);
2311 if (!TEST_int_eq(create_ssl_connection(serverssl, clientssl,
2319 SSL_free(serverssl);
2320 SSL_free(clientssl);
2328 #ifndef OPENSSL_NO_TLS1_3
2329 static int psk_client_cb_cnt = 0;
2330 static int psk_server_cb_cnt = 0;
2332 static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id,
2333 size_t *idlen, SSL_SESSION **sess)
2335 switch (++use_session_cb_cnt) {
2337 /* The first call should always have a NULL md */
2343 /* The second call should always have an md */
2349 /* We should only be called a maximum of twice */
2353 if (clientpsk != NULL)
2354 SSL_SESSION_up_ref(clientpsk);
2357 *id = (const unsigned char *)pskid;
2358 *idlen = strlen(pskid);
2363 #ifndef OPENSSL_NO_PSK
2364 static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *id,
2365 unsigned int max_id_len,
2367 unsigned int max_psk_len)
2369 unsigned int psklen = 0;
2371 psk_client_cb_cnt++;
2373 if (strlen(pskid) + 1 > max_id_len)
2376 /* We should only ever be called a maximum of twice per connection */
2377 if (psk_client_cb_cnt > 2)
2380 if (clientpsk == NULL)
2383 /* We'll reuse the PSK we set up for TLSv1.3 */
2384 if (SSL_SESSION_get_master_key(clientpsk, NULL, 0) > max_psk_len)
2386 psklen = SSL_SESSION_get_master_key(clientpsk, psk, max_psk_len);
2387 strncpy(id, pskid, max_id_len);
2391 #endif /* OPENSSL_NO_PSK */
2393 static int find_session_cb(SSL *ssl, const unsigned char *identity,
2394 size_t identity_len, SSL_SESSION **sess)
2396 find_session_cb_cnt++;
2398 /* We should only ever be called a maximum of twice per connection */
2399 if (find_session_cb_cnt > 2)
2402 if (serverpsk == NULL)
2405 /* Identity should match that set by the client */
2406 if (strlen(srvid) != identity_len
2407 || strncmp(srvid, (const char *)identity, identity_len) != 0) {
2408 /* No PSK found, continue but without a PSK */
2413 SSL_SESSION_up_ref(serverpsk);
2419 #ifndef OPENSSL_NO_PSK
2420 static unsigned int psk_server_cb(SSL *ssl, const char *identity,
2421 unsigned char *psk, unsigned int max_psk_len)
2423 unsigned int psklen = 0;
2425 psk_server_cb_cnt++;
2427 /* We should only ever be called a maximum of twice per connection */
2428 if (find_session_cb_cnt > 2)
2431 if (serverpsk == NULL)
2434 /* Identity should match that set by the client */
2435 if (strcmp(srvid, identity) != 0) {
2439 /* We'll reuse the PSK we set up for TLSv1.3 */
2440 if (SSL_SESSION_get_master_key(serverpsk, NULL, 0) > max_psk_len)
2442 psklen = SSL_SESSION_get_master_key(serverpsk, psk, max_psk_len);
2446 #endif /* OPENSSL_NO_PSK */
2448 #define MSG1 "Hello"
2449 #define MSG2 "World."
2454 #define MSG7 "message."
2456 #define TLS13_AES_256_GCM_SHA384_BYTES ((const unsigned char *)"\x13\x02")
2457 #define TLS13_AES_128_GCM_SHA256_BYTES ((const unsigned char *)"\x13\x01")
2460 static SSL_SESSION *create_a_psk(SSL *ssl)
2462 const SSL_CIPHER *cipher = NULL;
2463 const unsigned char key[] = {
2464 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
2465 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
2466 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
2467 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
2468 0x2c, 0x2d, 0x2e, 0x2f
2470 SSL_SESSION *sess = NULL;
2472 cipher = SSL_CIPHER_find(ssl, TLS13_AES_256_GCM_SHA384_BYTES);
2473 sess = SSL_SESSION_new();
2475 || !TEST_ptr(cipher)
2476 || !TEST_true(SSL_SESSION_set1_master_key(sess, key,
2478 || !TEST_true(SSL_SESSION_set_cipher(sess, cipher))
2480 SSL_SESSION_set_protocol_version(sess,
2482 SSL_SESSION_free(sess);
2489 * Helper method to setup objects for early data test. Caller frees objects on
2492 static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl,
2493 SSL **serverssl, SSL_SESSION **sess, int idx)
2496 && !TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2497 TLS_client_method(),
2499 sctx, cctx, cert, privkey)))
2502 if (!TEST_true(SSL_CTX_set_max_early_data(*sctx, SSL3_RT_MAX_PLAIN_LENGTH)))
2506 /* When idx == 1 we repeat the tests with read_ahead set */
2507 SSL_CTX_set_read_ahead(*cctx, 1);
2508 SSL_CTX_set_read_ahead(*sctx, 1);
2509 } else if (idx == 2) {
2510 /* When idx == 2 we are doing early_data with a PSK. Set up callbacks */
2511 SSL_CTX_set_psk_use_session_callback(*cctx, use_session_cb);
2512 SSL_CTX_set_psk_find_session_callback(*sctx, find_session_cb);
2513 use_session_cb_cnt = 0;
2514 find_session_cb_cnt = 0;
2518 if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl, clientssl,
2523 * For one of the run throughs (doesn't matter which one), we'll try sending
2524 * some SNI data in the initial ClientHello. This will be ignored (because
2525 * there is no SNI cb set up by the server), so it should not impact
2529 && !TEST_true(SSL_set_tlsext_host_name(*clientssl, "localhost")))
2533 clientpsk = create_a_psk(*clientssl);
2534 if (!TEST_ptr(clientpsk)
2536 * We just choose an arbitrary value for max_early_data which
2537 * should be big enough for testing purposes.
2539 || !TEST_true(SSL_SESSION_set_max_early_data(clientpsk,
2541 || !TEST_true(SSL_SESSION_up_ref(clientpsk))) {
2542 SSL_SESSION_free(clientpsk);
2546 serverpsk = clientpsk;
2549 if (!TEST_true(SSL_SESSION_up_ref(clientpsk))) {
2550 SSL_SESSION_free(clientpsk);
2551 SSL_SESSION_free(serverpsk);
2552 clientpsk = serverpsk = NULL;
2563 if (!TEST_true(create_ssl_connection(*serverssl, *clientssl,
2567 *sess = SSL_get1_session(*clientssl);
2568 SSL_shutdown(*clientssl);
2569 SSL_shutdown(*serverssl);
2570 SSL_free(*serverssl);
2571 SSL_free(*clientssl);
2572 *serverssl = *clientssl = NULL;
2574 if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl,
2575 clientssl, NULL, NULL))
2576 || !TEST_true(SSL_set_session(*clientssl, *sess)))
2582 static int test_early_data_read_write(int idx)
2584 SSL_CTX *cctx = NULL, *sctx = NULL;
2585 SSL *clientssl = NULL, *serverssl = NULL;
2587 SSL_SESSION *sess = NULL;
2588 unsigned char buf[20], data[1024];
2589 size_t readbytes, written, eoedlen, rawread, rawwritten;
2592 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
2593 &serverssl, &sess, idx)))
2596 /* Write and read some early data */
2597 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
2599 || !TEST_size_t_eq(written, strlen(MSG1))
2600 || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
2601 sizeof(buf), &readbytes),
2602 SSL_READ_EARLY_DATA_SUCCESS)
2603 || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
2604 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
2605 SSL_EARLY_DATA_ACCEPTED))
2609 * Server should be able to write data, and client should be able to
2612 if (!TEST_true(SSL_write_early_data(serverssl, MSG2, strlen(MSG2),
2614 || !TEST_size_t_eq(written, strlen(MSG2))
2615 || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
2616 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
2619 /* Even after reading normal data, client should be able write early data */
2620 if (!TEST_true(SSL_write_early_data(clientssl, MSG3, strlen(MSG3),
2622 || !TEST_size_t_eq(written, strlen(MSG3)))
2625 /* Server should still be able read early data after writing data */
2626 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2628 SSL_READ_EARLY_DATA_SUCCESS)
2629 || !TEST_mem_eq(buf, readbytes, MSG3, strlen(MSG3)))
2632 /* Write more data from server and read it from client */
2633 if (!TEST_true(SSL_write_early_data(serverssl, MSG4, strlen(MSG4),
2635 || !TEST_size_t_eq(written, strlen(MSG4))
2636 || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
2637 || !TEST_mem_eq(buf, readbytes, MSG4, strlen(MSG4)))
2641 * If client writes normal data it should mean writing early data is no
2644 if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
2645 || !TEST_size_t_eq(written, strlen(MSG5))
2646 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
2647 SSL_EARLY_DATA_ACCEPTED))
2651 * At this point the client has written EndOfEarlyData, ClientFinished and
2652 * normal (fully protected) data. We are going to cause a delay between the
2653 * arrival of EndOfEarlyData and ClientFinished. We read out all the data
2654 * in the read BIO, and then just put back the EndOfEarlyData message.
2656 rbio = SSL_get_rbio(serverssl);
2657 if (!TEST_true(BIO_read_ex(rbio, data, sizeof(data), &rawread))
2658 || !TEST_size_t_lt(rawread, sizeof(data))
2659 || !TEST_size_t_gt(rawread, SSL3_RT_HEADER_LENGTH))
2662 /* Record length is in the 4th and 5th bytes of the record header */
2663 eoedlen = SSL3_RT_HEADER_LENGTH + (data[3] << 8 | data[4]);
2664 if (!TEST_true(BIO_write_ex(rbio, data, eoedlen, &rawwritten))
2665 || !TEST_size_t_eq(rawwritten, eoedlen))
2668 /* Server should be told that there is no more early data */
2669 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2671 SSL_READ_EARLY_DATA_FINISH)
2672 || !TEST_size_t_eq(readbytes, 0))
2676 * Server has not finished init yet, so should still be able to write early
2679 if (!TEST_true(SSL_write_early_data(serverssl, MSG6, strlen(MSG6),
2681 || !TEST_size_t_eq(written, strlen(MSG6)))
2684 /* Push the ClientFinished and the normal data back into the server rbio */
2685 if (!TEST_true(BIO_write_ex(rbio, data + eoedlen, rawread - eoedlen,
2687 || !TEST_size_t_eq(rawwritten, rawread - eoedlen))
2690 /* Server should be able to read normal data */
2691 if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
2692 || !TEST_size_t_eq(readbytes, strlen(MSG5)))
2695 /* Client and server should not be able to write/read early data now */
2696 if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
2700 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2702 SSL_READ_EARLY_DATA_ERROR))
2706 /* Client should be able to read the data sent by the server */
2707 if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
2708 || !TEST_mem_eq(buf, readbytes, MSG6, strlen(MSG6)))
2712 * Make sure we process the two NewSessionTickets. These arrive
2713 * post-handshake. We attempt reads which we do not expect to return any
2716 if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
2717 || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf),
2721 /* Server should be able to write normal data */
2722 if (!TEST_true(SSL_write_ex(serverssl, MSG7, strlen(MSG7), &written))
2723 || !TEST_size_t_eq(written, strlen(MSG7))
2724 || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
2725 || !TEST_mem_eq(buf, readbytes, MSG7, strlen(MSG7)))
2728 SSL_SESSION_free(sess);
2729 sess = SSL_get1_session(clientssl);
2730 use_session_cb_cnt = 0;
2731 find_session_cb_cnt = 0;
2733 SSL_shutdown(clientssl);
2734 SSL_shutdown(serverssl);
2735 SSL_free(serverssl);
2736 SSL_free(clientssl);
2737 serverssl = clientssl = NULL;
2738 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
2739 &clientssl, NULL, NULL))
2740 || !TEST_true(SSL_set_session(clientssl, sess)))
2743 /* Write and read some early data */
2744 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
2746 || !TEST_size_t_eq(written, strlen(MSG1))
2747 || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2749 SSL_READ_EARLY_DATA_SUCCESS)
2750 || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
2753 if (!TEST_int_gt(SSL_connect(clientssl), 0)
2754 || !TEST_int_gt(SSL_accept(serverssl), 0))
2757 /* Client and server should not be able to write/read early data now */
2758 if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
2762 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2764 SSL_READ_EARLY_DATA_ERROR))
2768 /* Client and server should be able to write/read normal data */
2769 if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
2770 || !TEST_size_t_eq(written, strlen(MSG5))
2771 || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
2772 || !TEST_size_t_eq(readbytes, strlen(MSG5)))
2778 SSL_SESSION_free(sess);
2779 SSL_SESSION_free(clientpsk);
2780 SSL_SESSION_free(serverpsk);
2781 clientpsk = serverpsk = NULL;
2782 SSL_free(serverssl);
2783 SSL_free(clientssl);
2789 static int allow_ed_cb_called = 0;
2791 static int allow_early_data_cb(SSL *s, void *arg)
2793 int *usecb = (int *)arg;
2795 allow_ed_cb_called++;
2804 * idx == 0: Standard early_data setup
2805 * idx == 1: early_data setup using read_ahead
2806 * usecb == 0: Don't use a custom early data callback
2807 * usecb == 1: Use a custom early data callback and reject the early data
2808 * usecb == 2: Use a custom early data callback and accept the early data
2809 * confopt == 0: Configure anti-replay directly
2810 * confopt == 1: Configure anti-replay using SSL_CONF
2812 static int test_early_data_replay_int(int idx, int usecb, int confopt)
2814 SSL_CTX *cctx = NULL, *sctx = NULL;
2815 SSL *clientssl = NULL, *serverssl = NULL;
2817 SSL_SESSION *sess = NULL;
2818 size_t readbytes, written;
2819 unsigned char buf[20];
2821 allow_ed_cb_called = 0;
2823 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
2824 TLS1_VERSION, 0, &sctx,
2825 &cctx, cert, privkey)))
2830 SSL_CTX_set_options(sctx, SSL_OP_NO_ANTI_REPLAY);
2832 SSL_CONF_CTX *confctx = SSL_CONF_CTX_new();
2834 if (!TEST_ptr(confctx))
2836 SSL_CONF_CTX_set_flags(confctx, SSL_CONF_FLAG_FILE
2837 | SSL_CONF_FLAG_SERVER);
2838 SSL_CONF_CTX_set_ssl_ctx(confctx, sctx);
2839 if (!TEST_int_eq(SSL_CONF_cmd(confctx, "Options", "-AntiReplay"),
2841 SSL_CONF_CTX_free(confctx);
2844 SSL_CONF_CTX_free(confctx);
2846 SSL_CTX_set_allow_early_data_cb(sctx, allow_early_data_cb, &usecb);
2849 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
2850 &serverssl, &sess, idx)))
2854 * The server is configured to accept early data. Create a connection to
2855 * "use up" the ticket
2857 if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
2858 || !TEST_true(SSL_session_reused(clientssl)))
2861 SSL_shutdown(clientssl);
2862 SSL_shutdown(serverssl);
2863 SSL_free(serverssl);
2864 SSL_free(clientssl);
2865 serverssl = clientssl = NULL;
2867 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
2868 &clientssl, NULL, NULL))
2869 || !TEST_true(SSL_set_session(clientssl, sess)))
2872 /* Write and read some early data */
2873 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
2875 || !TEST_size_t_eq(written, strlen(MSG1)))
2879 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2881 SSL_READ_EARLY_DATA_FINISH)
2883 * The ticket was reused, so the we should have rejected the
2886 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
2887 SSL_EARLY_DATA_REJECTED))
2890 /* In this case the callback decides to accept the early data */
2891 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2893 SSL_READ_EARLY_DATA_SUCCESS)
2894 || !TEST_mem_eq(MSG1, strlen(MSG1), buf, readbytes)
2896 * Server will have sent its flight so client can now send
2897 * end of early data and complete its half of the handshake
2899 || !TEST_int_gt(SSL_connect(clientssl), 0)
2900 || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2902 SSL_READ_EARLY_DATA_FINISH)
2903 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
2904 SSL_EARLY_DATA_ACCEPTED))
2908 /* Complete the connection */
2909 if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
2910 || !TEST_int_eq(SSL_session_reused(clientssl), (usecb > 0) ? 1 : 0)
2911 || !TEST_int_eq(allow_ed_cb_called, usecb > 0 ? 1 : 0))
2917 SSL_SESSION_free(sess);
2918 SSL_SESSION_free(clientpsk);
2919 SSL_SESSION_free(serverpsk);
2920 clientpsk = serverpsk = NULL;
2921 SSL_free(serverssl);
2922 SSL_free(clientssl);
2928 static int test_early_data_replay(int idx)
2930 int ret = 1, usecb, confopt;
2932 for (usecb = 0; usecb < 3; usecb++) {
2933 for (confopt = 0; confopt < 2; confopt++)
2934 ret &= test_early_data_replay_int(idx, usecb, confopt);
2941 * Helper function to test that a server attempting to read early data can
2942 * handle a connection from a client where the early data should be skipped.
2943 * testtype: 0 == No HRR
2944 * testtype: 1 == HRR
2945 * testtype: 2 == HRR, invalid early_data sent after HRR
2946 * testtype: 3 == recv_max_early_data set to 0
2948 static int early_data_skip_helper(int testtype, int idx)
2950 SSL_CTX *cctx = NULL, *sctx = NULL;
2951 SSL *clientssl = NULL, *serverssl = NULL;
2953 SSL_SESSION *sess = NULL;
2954 unsigned char buf[20];
2955 size_t readbytes, written;
2957 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
2958 &serverssl, &sess, idx)))
2961 if (testtype == 1 || testtype == 2) {
2962 /* Force an HRR to occur */
2963 if (!TEST_true(SSL_set1_groups_list(serverssl, "P-256")))
2965 } else if (idx == 2) {
2967 * We force early_data rejection by ensuring the PSK identity is
2970 srvid = "Dummy Identity";
2973 * Deliberately corrupt the creation time. We take 20 seconds off the
2974 * time. It could be any value as long as it is not within tolerance.
2975 * This should mean the ticket is rejected.
2977 if (!TEST_true(SSL_SESSION_set_time(sess, (long)(time(NULL) - 20))))
2982 && !TEST_true(SSL_set_recv_max_early_data(serverssl, 0)))
2985 /* Write some early data */
2986 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
2988 || !TEST_size_t_eq(written, strlen(MSG1)))
2991 /* Server should reject the early data */
2992 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2994 SSL_READ_EARLY_DATA_FINISH)
2995 || !TEST_size_t_eq(readbytes, 0)
2996 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
2997 SSL_EARLY_DATA_REJECTED))
3007 * Finish off the handshake. We perform the same writes and reads as
3008 * further down but we expect them to fail due to the incomplete
3011 if (!TEST_false(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
3012 || !TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf),
3019 BIO *wbio = SSL_get_wbio(clientssl);
3020 /* A record that will appear as bad early_data */
3021 const unsigned char bad_early_data[] = {
3022 0x17, 0x03, 0x03, 0x00, 0x01, 0x00
3026 * We force the client to attempt a write. This will fail because
3027 * we're still in the handshake. It will cause the second
3028 * ClientHello to be sent.
3030 if (!TEST_false(SSL_write_ex(clientssl, MSG2, strlen(MSG2),
3035 * Inject some early_data after the second ClientHello. This should
3036 * cause the server to fail
3038 if (!TEST_true(BIO_write_ex(wbio, bad_early_data,
3039 sizeof(bad_early_data), &written)))
3046 * This client has sent more early_data than we are willing to skip
3047 * (case 3) or sent invalid early_data (case 2) so the connection should
3050 if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
3051 || !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_SSL))
3054 /* Connection has failed - nothing more to do */
3059 TEST_error("Invalid test type");
3064 * Should be able to send normal data despite rejection of early data. The
3065 * early_data should be skipped.
3067 if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
3068 || !TEST_size_t_eq(written, strlen(MSG2))
3069 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
3070 SSL_EARLY_DATA_REJECTED)
3071 || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
3072 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
3078 SSL_SESSION_free(clientpsk);
3079 SSL_SESSION_free(serverpsk);
3080 clientpsk = serverpsk = NULL;
3081 SSL_SESSION_free(sess);
3082 SSL_free(serverssl);
3083 SSL_free(clientssl);
3090 * Test that a server attempting to read early data can handle a connection
3091 * from a client where the early data is not acceptable.
3093 static int test_early_data_skip(int idx)
3095 return early_data_skip_helper(0, idx);
3099 * Test that a server attempting to read early data can handle a connection
3100 * from a client where an HRR occurs.
3102 static int test_early_data_skip_hrr(int idx)
3104 return early_data_skip_helper(1, idx);
3108 * Test that a server attempting to read early data can handle a connection
3109 * from a client where an HRR occurs and correctly fails if early_data is sent
3112 static int test_early_data_skip_hrr_fail(int idx)
3114 return early_data_skip_helper(2, idx);
3118 * Test that a server attempting to read early data will abort if it tries to
3119 * skip over too much.
3121 static int test_early_data_skip_abort(int idx)
3123 return early_data_skip_helper(3, idx);
3127 * Test that a server attempting to read early data can handle a connection
3128 * from a client that doesn't send any.
3130 static int test_early_data_not_sent(int idx)
3132 SSL_CTX *cctx = NULL, *sctx = NULL;
3133 SSL *clientssl = NULL, *serverssl = NULL;
3135 SSL_SESSION *sess = NULL;
3136 unsigned char buf[20];
3137 size_t readbytes, written;
3139 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
3140 &serverssl, &sess, idx)))
3143 /* Write some data - should block due to handshake with server */
3144 SSL_set_connect_state(clientssl);
3145 if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
3148 /* Server should detect that early data has not been sent */
3149 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
3151 SSL_READ_EARLY_DATA_FINISH)
3152 || !TEST_size_t_eq(readbytes, 0)
3153 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
3154 SSL_EARLY_DATA_NOT_SENT)
3155 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
3156 SSL_EARLY_DATA_NOT_SENT))
3159 /* Continue writing the message we started earlier */
3160 if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
3161 || !TEST_size_t_eq(written, strlen(MSG1))
3162 || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
3163 || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
3164 || !SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written)
3165 || !TEST_size_t_eq(written, strlen(MSG2)))
3168 if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
3169 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
3175 SSL_SESSION_free(sess);
3176 SSL_SESSION_free(clientpsk);
3177 SSL_SESSION_free(serverpsk);
3178 clientpsk = serverpsk = NULL;
3179 SSL_free(serverssl);
3180 SSL_free(clientssl);
3186 static int hostname_cb(SSL *s, int *al, void *arg)
3188 const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3190 if (hostname != NULL && strcmp(hostname, "goodhost") == 0)
3191 return SSL_TLSEXT_ERR_OK;
3193 return SSL_TLSEXT_ERR_NOACK;
3196 static const char *servalpn;
3198 static int alpn_select_cb(SSL *ssl, const unsigned char **out,
3199 unsigned char *outlen, const unsigned char *in,
3200 unsigned int inlen, void *arg)
3202 unsigned int protlen = 0;
3203 const unsigned char *prot;
3205 for (prot = in; prot < in + inlen; prot += protlen) {
3207 if (in + inlen < prot + protlen)
3208 return SSL_TLSEXT_ERR_NOACK;
3210 if (protlen == strlen(servalpn)
3211 && memcmp(prot, servalpn, protlen) == 0) {
3214 return SSL_TLSEXT_ERR_OK;
3218 return SSL_TLSEXT_ERR_NOACK;
3221 /* Test that a PSK can be used to send early_data */
3222 static int test_early_data_psk(int idx)
3224 SSL_CTX *cctx = NULL, *sctx = NULL;
3225 SSL *clientssl = NULL, *serverssl = NULL;
3227 SSL_SESSION *sess = NULL;
3228 unsigned char alpnlist[] = {
3229 0x08, 'g', 'o', 'o', 'd', 'a', 'l', 'p', 'n', 0x07, 'b', 'a', 'd', 'a',
3232 #define GOODALPNLEN 9
3233 #define BADALPNLEN 8
3234 #define GOODALPN (alpnlist)
3235 #define BADALPN (alpnlist + GOODALPNLEN)
3237 unsigned char buf[20];
3238 size_t readbytes, written;
3239 int readearlyres = SSL_READ_EARLY_DATA_SUCCESS, connectres = 1;
3240 int edstatus = SSL_EARLY_DATA_ACCEPTED;
3242 /* We always set this up with a final parameter of "2" for PSK */
3243 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
3244 &serverssl, &sess, 2)))
3247 servalpn = "goodalpn";
3250 * Note: There is no test for inconsistent SNI with late client detection.
3251 * This is because servers do not acknowledge SNI even if they are using
3252 * it in a resumption handshake - so it is not actually possible for a
3253 * client to detect a problem.
3257 /* Set inconsistent SNI (early client detection) */
3258 err = SSL_R_INCONSISTENT_EARLY_DATA_SNI;
3259 if (!TEST_true(SSL_SESSION_set1_hostname(sess, "goodhost"))
3260 || !TEST_true(SSL_set_tlsext_host_name(clientssl, "badhost")))
3265 /* Set inconsistent ALPN (early client detection) */
3266 err = SSL_R_INCONSISTENT_EARLY_DATA_ALPN;
3267 /* SSL_set_alpn_protos returns 0 for success and 1 for failure */
3268 if (!TEST_true(SSL_SESSION_set1_alpn_selected(sess, GOODALPN,
3270 || !TEST_false(SSL_set_alpn_protos(clientssl, BADALPN,
3277 * Set invalid protocol version. Technically this affects PSKs without
3278 * early_data too, but we test it here because it is similar to the
3279 * SNI/ALPN consistency tests.
3281 err = SSL_R_BAD_PSK;
3282 if (!TEST_true(SSL_SESSION_set_protocol_version(sess, TLS1_2_VERSION)))
3288 * Set inconsistent SNI (server detected). In this case the connection
3289 * will succeed but reject early_data.
3291 SSL_SESSION_free(serverpsk);
3292 serverpsk = SSL_SESSION_dup(clientpsk);
3293 if (!TEST_ptr(serverpsk)
3294 || !TEST_true(SSL_SESSION_set1_hostname(serverpsk, "badhost")))
3296 edstatus = SSL_EARLY_DATA_REJECTED;
3297 readearlyres = SSL_READ_EARLY_DATA_FINISH;
3300 /* Set consistent SNI */
3301 if (!TEST_true(SSL_SESSION_set1_hostname(sess, "goodhost"))
3302 || !TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost"))
3303 || !TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx,
3310 * Set inconsistent ALPN (server detected). In this case the connection
3311 * will succeed but reject early_data.
3313 servalpn = "badalpn";
3314 edstatus = SSL_EARLY_DATA_REJECTED;
3315 readearlyres = SSL_READ_EARLY_DATA_FINISH;
3319 * Set consistent ALPN.
3320 * SSL_set_alpn_protos returns 0 for success and 1 for failure. It
3321 * accepts a list of protos (each one length prefixed).
3322 * SSL_set1_alpn_selected accepts a single protocol (not length
3325 if (!TEST_true(SSL_SESSION_set1_alpn_selected(sess, GOODALPN + 1,
3327 || !TEST_false(SSL_set_alpn_protos(clientssl, GOODALPN,
3331 SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb, NULL);
3335 /* Set inconsistent ALPN (late client detection) */
3336 SSL_SESSION_free(serverpsk);
3337 serverpsk = SSL_SESSION_dup(clientpsk);
3338 if (!TEST_ptr(serverpsk)
3339 || !TEST_true(SSL_SESSION_set1_alpn_selected(clientpsk,
3342 || !TEST_true(SSL_SESSION_set1_alpn_selected(serverpsk,
3345 || !TEST_false(SSL_set_alpn_protos(clientssl, alpnlist,
3348 SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb, NULL);
3349 edstatus = SSL_EARLY_DATA_ACCEPTED;
3350 readearlyres = SSL_READ_EARLY_DATA_SUCCESS;
3351 /* SSL_connect() call should fail */
3356 TEST_error("Bad test index");
3360 SSL_set_connect_state(clientssl);
3362 if (!TEST_false(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
3364 || !TEST_int_eq(SSL_get_error(clientssl, 0), SSL_ERROR_SSL)
3365 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), err))
3368 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
3372 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
3373 &readbytes), readearlyres)
3374 || (readearlyres == SSL_READ_EARLY_DATA_SUCCESS
3375 && !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
3376 || !TEST_int_eq(SSL_get_early_data_status(serverssl), edstatus)
3377 || !TEST_int_eq(SSL_connect(clientssl), connectres))
3384 SSL_SESSION_free(sess);
3385 SSL_SESSION_free(clientpsk);
3386 SSL_SESSION_free(serverpsk);
3387 clientpsk = serverpsk = NULL;
3388 SSL_free(serverssl);
3389 SSL_free(clientssl);
3396 * Test that a server that doesn't try to read early data can handle a
3397 * client sending some.
3399 static int test_early_data_not_expected(int idx)
3401 SSL_CTX *cctx = NULL, *sctx = NULL;
3402 SSL *clientssl = NULL, *serverssl = NULL;
3404 SSL_SESSION *sess = NULL;
3405 unsigned char buf[20];
3406 size_t readbytes, written;
3408 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
3409 &serverssl, &sess, idx)))
3412 /* Write some early data */
3413 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
3418 * Server should skip over early data and then block waiting for client to
3419 * continue handshake
3421 if (!TEST_int_le(SSL_accept(serverssl), 0)
3422 || !TEST_int_gt(SSL_connect(clientssl), 0)
3423 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
3424 SSL_EARLY_DATA_REJECTED)
3425 || !TEST_int_gt(SSL_accept(serverssl), 0)
3426 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
3427 SSL_EARLY_DATA_REJECTED))
3430 /* Send some normal data from client to server */
3431 if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
3432 || !TEST_size_t_eq(written, strlen(MSG2)))
3435 if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
3436 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
3442 SSL_SESSION_free(sess);
3443 SSL_SESSION_free(clientpsk);
3444 SSL_SESSION_free(serverpsk);
3445 clientpsk = serverpsk = NULL;
3446 SSL_free(serverssl);
3447 SSL_free(clientssl);
3454 # ifndef OPENSSL_NO_TLS1_2
3456 * Test that a server attempting to read early data can handle a connection
3457 * from a TLSv1.2 client.
3459 static int test_early_data_tls1_2(int idx)
3461 SSL_CTX *cctx = NULL, *sctx = NULL;
3462 SSL *clientssl = NULL, *serverssl = NULL;
3464 unsigned char buf[20];
3465 size_t readbytes, written;
3467 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
3468 &serverssl, NULL, idx)))
3471 /* Write some data - should block due to handshake with server */
3472 SSL_set_max_proto_version(clientssl, TLS1_2_VERSION);
3473 SSL_set_connect_state(clientssl);
3474 if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
3478 * Server should do TLSv1.2 handshake. First it will block waiting for more
3479 * messages from client after ServerDone. Then SSL_read_early_data should
3480 * finish and detect that early data has not been sent
3482 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
3484 SSL_READ_EARLY_DATA_ERROR))
3488 * Continue writing the message we started earlier. Will still block waiting
3489 * for the CCS/Finished from server
3491 if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
3492 || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
3494 SSL_READ_EARLY_DATA_FINISH)
3495 || !TEST_size_t_eq(readbytes, 0)
3496 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
3497 SSL_EARLY_DATA_NOT_SENT))
3500 /* Continue writing the message we started earlier */
3501 if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
3502 || !TEST_size_t_eq(written, strlen(MSG1))
3503 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
3504 SSL_EARLY_DATA_NOT_SENT)
3505 || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
3506 || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
3507 || !TEST_true(SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written))
3508 || !TEST_size_t_eq(written, strlen(MSG2))
3509 || !SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)
3510 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
3516 SSL_SESSION_free(clientpsk);
3517 SSL_SESSION_free(serverpsk);
3518 clientpsk = serverpsk = NULL;
3519 SSL_free(serverssl);
3520 SSL_free(clientssl);
3526 # endif /* OPENSSL_NO_TLS1_2 */
3529 * Test configuring the TLSv1.3 ciphersuites
3531 * Test 0: Set a default ciphersuite in the SSL_CTX (no explicit cipher_list)
3532 * Test 1: Set a non-default ciphersuite in the SSL_CTX (no explicit cipher_list)
3533 * Test 2: Set a default ciphersuite in the SSL (no explicit cipher_list)
3534 * Test 3: Set a non-default ciphersuite in the SSL (no explicit cipher_list)
3535 * Test 4: Set a default ciphersuite in the SSL_CTX (SSL_CTX cipher_list)
3536 * Test 5: Set a non-default ciphersuite in the SSL_CTX (SSL_CTX cipher_list)
3537 * Test 6: Set a default ciphersuite in the SSL (SSL_CTX cipher_list)
3538 * Test 7: Set a non-default ciphersuite in the SSL (SSL_CTX cipher_list)
3539 * Test 8: Set a default ciphersuite in the SSL (SSL cipher_list)
3540 * Test 9: Set a non-default ciphersuite in the SSL (SSL cipher_list)
3542 static int test_set_ciphersuite(int idx)
3544 SSL_CTX *cctx = NULL, *sctx = NULL;
3545 SSL *clientssl = NULL, *serverssl = NULL;
3548 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
3550 &sctx, &cctx, cert, privkey))
3551 || !TEST_true(SSL_CTX_set_ciphersuites(sctx,
3552 "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256")))
3555 if (idx >=4 && idx <= 7) {
3556 /* SSL_CTX explicit cipher list */
3557 if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "AES256-GCM-SHA384")))
3561 if (idx == 0 || idx == 4) {
3562 /* Default ciphersuite */
3563 if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
3564 "TLS_AES_128_GCM_SHA256")))
3566 } else if (idx == 1 || idx == 5) {
3567 /* Non default ciphersuite */
3568 if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
3569 "TLS_AES_128_CCM_SHA256")))
3573 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
3574 &clientssl, NULL, NULL)))
3577 if (idx == 8 || idx == 9) {
3578 /* SSL explicit cipher list */
3579 if (!TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384")))
3583 if (idx == 2 || idx == 6 || idx == 8) {
3584 /* Default ciphersuite */
3585 if (!TEST_true(SSL_set_ciphersuites(clientssl,
3586 "TLS_AES_128_GCM_SHA256")))
3588 } else if (idx == 3 || idx == 7 || idx == 9) {
3589 /* Non default ciphersuite */
3590 if (!TEST_true(SSL_set_ciphersuites(clientssl,
3591 "TLS_AES_128_CCM_SHA256")))
3595 if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
3601 SSL_free(serverssl);
3602 SSL_free(clientssl);
3609 static int test_ciphersuite_change(void)
3611 SSL_CTX *cctx = NULL, *sctx = NULL;
3612 SSL *clientssl = NULL, *serverssl = NULL;
3613 SSL_SESSION *clntsess = NULL;
3615 const SSL_CIPHER *aes_128_gcm_sha256 = NULL;
3617 /* Create a session based on SHA-256 */
3618 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
3620 &sctx, &cctx, cert, privkey))
3621 || !TEST_true(SSL_CTX_set_ciphersuites(cctx,
3622 "TLS_AES_128_GCM_SHA256"))
3623 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
3624 &clientssl, NULL, NULL))
3625 || !TEST_true(create_ssl_connection(serverssl, clientssl,
3629 clntsess = SSL_get1_session(clientssl);
3630 /* Save for later */
3631 aes_128_gcm_sha256 = SSL_SESSION_get0_cipher(clntsess);
3632 SSL_shutdown(clientssl);
3633 SSL_shutdown(serverssl);
3634 SSL_free(serverssl);
3635 SSL_free(clientssl);
3636 serverssl = clientssl = NULL;
3638 # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
3639 /* Check we can resume a session with a different SHA-256 ciphersuite */
3640 if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
3641 "TLS_CHACHA20_POLY1305_SHA256"))
3642 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3644 || !TEST_true(SSL_set_session(clientssl, clntsess))
3645 || !TEST_true(create_ssl_connection(serverssl, clientssl,
3647 || !TEST_true(SSL_session_reused(clientssl)))
3650 SSL_SESSION_free(clntsess);
3651 clntsess = SSL_get1_session(clientssl);
3652 SSL_shutdown(clientssl);
3653 SSL_shutdown(serverssl);
3654 SSL_free(serverssl);
3655 SSL_free(clientssl);
3656 serverssl = clientssl = NULL;
3660 * Check attempting to resume a SHA-256 session with no SHA-256 ciphersuites
3661 * succeeds but does not resume.
3663 if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_256_GCM_SHA384"))
3664 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3666 || !TEST_true(SSL_set_session(clientssl, clntsess))
3667 || !TEST_true(create_ssl_connection(serverssl, clientssl,
3669 || !TEST_false(SSL_session_reused(clientssl)))
3672 SSL_SESSION_free(clntsess);
3674 SSL_shutdown(clientssl);
3675 SSL_shutdown(serverssl);
3676 SSL_free(serverssl);
3677 SSL_free(clientssl);
3678 serverssl = clientssl = NULL;
3680 /* Create a session based on SHA384 */
3681 if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_256_GCM_SHA384"))
3682 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
3683 &clientssl, NULL, NULL))
3684 || !TEST_true(create_ssl_connection(serverssl, clientssl,
3688 clntsess = SSL_get1_session(clientssl);
3689 SSL_shutdown(clientssl);
3690 SSL_shutdown(serverssl);
3691 SSL_free(serverssl);
3692 SSL_free(clientssl);
3693 serverssl = clientssl = NULL;
3695 if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
3696 "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"))
3697 || !TEST_true(SSL_CTX_set_ciphersuites(sctx,
3698 "TLS_AES_256_GCM_SHA384"))
3699 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3701 || !TEST_true(SSL_set_session(clientssl, clntsess))
3703 * We use SSL_ERROR_WANT_READ below so that we can pause the
3704 * connection after the initial ClientHello has been sent to
3705 * enable us to make some session changes.
3707 || !TEST_false(create_ssl_connection(serverssl, clientssl,
3708 SSL_ERROR_WANT_READ)))
3711 /* Trick the client into thinking this session is for a different digest */
3712 clntsess->cipher = aes_128_gcm_sha256;
3713 clntsess->cipher_id = clntsess->cipher->id;
3716 * Continue the previously started connection. Server has selected a SHA-384
3717 * ciphersuite, but client thinks the session is for SHA-256, so it should
3720 if (!TEST_false(create_ssl_connection(serverssl, clientssl,
3722 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()),
3723 SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED))
3729 SSL_SESSION_free(clntsess);
3730 SSL_free(serverssl);
3731 SSL_free(clientssl);
3739 * Test TLSv1.3 Key exchange
3740 * Test 0 = Test ECDHE Key exchange
3741 * Test 1 = Test FFDHE Key exchange
3742 * Test 2 = Test ECDHE with TLSv1.2 client and TLSv1.2 server
3743 * Test 3 = Test FFDHE with TLSv1.2 client and TLSv1.2 server
3745 static int test_tls13_key_exchange(int idx)
3747 SSL_CTX *sctx = NULL, *cctx = NULL;
3748 SSL *serverssl = NULL, *clientssl = NULL;
3750 int ecdhe_kexch_groups[] = {NID_X9_62_prime256v1, NID_secp384r1, NID_secp521r1,
3751 NID_X25519, NID_X448};
3752 int ffdhe_kexch_groups[] = {NID_ffdhe2048, NID_ffdhe3072, NID_ffdhe4096,
3753 NID_ffdhe6144, NID_ffdhe8192};
3754 int *kexch_groups = NULL;
3755 int kexch_groups_size = 0;
3756 int max_version = TLS1_3_VERSION;
3757 int want_err = SSL_ERROR_NONE;
3758 int expected_err_func = 0;
3759 int expected_err_reason = 0;
3763 kexch_groups = ecdhe_kexch_groups;
3764 kexch_groups_size = OSSL_NELEM(ecdhe_kexch_groups);
3767 kexch_groups = ffdhe_kexch_groups;
3768 kexch_groups_size = OSSL_NELEM(ffdhe_kexch_groups);
3771 kexch_groups = ecdhe_kexch_groups;
3772 kexch_groups_size = OSSL_NELEM(ecdhe_kexch_groups);
3773 max_version = TLS1_2_VERSION;
3774 expected_err_func = SSL_F_TLS_POST_PROCESS_CLIENT_HELLO;
3775 expected_err_reason = SSL_R_NO_SHARED_CIPHER;
3776 want_err = SSL_ERROR_SSL;
3779 kexch_groups = ffdhe_kexch_groups;
3780 kexch_groups_size = OSSL_NELEM(ffdhe_kexch_groups);
3781 max_version = TLS1_2_VERSION;
3782 want_err = SSL_ERROR_SSL;
3783 expected_err_func = SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS;
3784 expected_err_reason = ERR_R_INTERNAL_ERROR;
3788 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
3789 TLS1_VERSION, max_version,
3790 &sctx, &cctx, cert, privkey)))
3793 if (!TEST_true(SSL_CTX_set_ciphersuites(sctx, TLS1_3_RFC_AES_128_GCM_SHA256)))
3796 if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, TLS1_3_RFC_AES_128_GCM_SHA256)))
3799 if (!TEST_true(SSL_CTX_set_cipher_list(sctx, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM)))
3802 if (!TEST_true(SSL_CTX_set_cipher_list(cctx, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM)))
3805 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3809 if (!TEST_true(SSL_set1_groups(serverssl, kexch_groups, kexch_groups_size))
3810 || !TEST_true(SSL_set1_groups(clientssl, kexch_groups, kexch_groups_size)))
3813 if (!TEST_true(create_ssl_connection(serverssl, clientssl, want_err))) {
3814 /* Fail only if no error is expected in handshake */
3815 if (expected_err_func == 0)
3819 /* Fail if expected error is not happening for failure testcases */
3820 if (expected_err_func) {
3821 unsigned long err_code = ERR_get_error();
3822 if (TEST_int_eq(ERR_GET_FUNC(err_code), expected_err_func)
3823 && TEST_int_eq(ERR_GET_REASON(err_code), expected_err_reason))
3828 /* If Handshake succeeds the negotiated kexch alg should the first one in configured */
3829 if (!TEST_int_eq(SSL_get_shared_group(serverssl, 0), kexch_groups[0]))
3834 SSL_free(serverssl);
3835 SSL_free(clientssl);
3843 * Test 0 = Test new style callbacks
3844 * Test 1 = Test both new and old style callbacks
3845 * Test 2 = Test old style callbacks
3846 * Test 3 = Test old style callbacks with no certificate
3848 static int test_tls13_psk(int idx)
3850 SSL_CTX *sctx = NULL, *cctx = NULL;
3851 SSL *serverssl = NULL, *clientssl = NULL;
3852 const SSL_CIPHER *cipher = NULL;
3853 const unsigned char key[] = {
3854 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
3855 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
3856 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
3857 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f
3861 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
3863 &sctx, &cctx, idx == 3 ? NULL : cert,
3864 idx == 3 ? NULL : privkey)))
3869 * We use a ciphersuite with SHA256 to ease testing old style PSK
3870 * callbacks which will always default to SHA256. This should not be
3871 * necessary if we have no cert/priv key. In that case the server should
3872 * prefer SHA256 automatically.
3874 if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
3875 "TLS_AES_128_GCM_SHA256")))
3880 * Test 0: New style callbacks only
3881 * Test 1: New and old style callbacks (only the new ones should be used)
3882 * Test 2: Old style callbacks only
3884 if (idx == 0 || idx == 1) {
3885 SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb);
3886 SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb);
3888 #ifndef OPENSSL_NO_PSK
3890 SSL_CTX_set_psk_client_callback(cctx, psk_client_cb);
3891 SSL_CTX_set_psk_server_callback(sctx, psk_server_cb);
3895 use_session_cb_cnt = 0;
3896 find_session_cb_cnt = 0;
3897 psk_client_cb_cnt = 0;
3898 psk_server_cb_cnt = 0;
3902 * Check we can create a connection if callback decides not to send a
3905 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3907 || !TEST_true(create_ssl_connection(serverssl, clientssl,
3909 || !TEST_false(SSL_session_reused(clientssl))
3910 || !TEST_false(SSL_session_reused(serverssl)))
3913 if (idx == 0 || idx == 1) {
3914 if (!TEST_true(use_session_cb_cnt == 1)
3915 || !TEST_true(find_session_cb_cnt == 0)
3917 * If no old style callback then below should be 0
3920 || !TEST_true(psk_client_cb_cnt == idx)
3921 || !TEST_true(psk_server_cb_cnt == 0))
3924 if (!TEST_true(use_session_cb_cnt == 0)
3925 || !TEST_true(find_session_cb_cnt == 0)
3926 || !TEST_true(psk_client_cb_cnt == 1)
3927 || !TEST_true(psk_server_cb_cnt == 0))
3931 shutdown_ssl_connection(serverssl, clientssl);
3932 serverssl = clientssl = NULL;
3933 use_session_cb_cnt = psk_client_cb_cnt = 0;
3936 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3940 /* Create the PSK */
3941 cipher = SSL_CIPHER_find(clientssl, TLS13_AES_128_GCM_SHA256_BYTES);
3942 clientpsk = SSL_SESSION_new();
3943 if (!TEST_ptr(clientpsk)
3944 || !TEST_ptr(cipher)
3945 || !TEST_true(SSL_SESSION_set1_master_key(clientpsk, key,
3947 || !TEST_true(SSL_SESSION_set_cipher(clientpsk, cipher))
3948 || !TEST_true(SSL_SESSION_set_protocol_version(clientpsk,
3950 || !TEST_true(SSL_SESSION_up_ref(clientpsk)))
3952 serverpsk = clientpsk;
3954 /* Check we can create a connection and the PSK is used */
3955 if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
3956 || !TEST_true(SSL_session_reused(clientssl))
3957 || !TEST_true(SSL_session_reused(serverssl)))
3960 if (idx == 0 || idx == 1) {
3961 if (!TEST_true(use_session_cb_cnt == 1)
3962 || !TEST_true(find_session_cb_cnt == 1)
3963 || !TEST_true(psk_client_cb_cnt == 0)
3964 || !TEST_true(psk_server_cb_cnt == 0))
3967 if (!TEST_true(use_session_cb_cnt == 0)
3968 || !TEST_true(find_session_cb_cnt == 0)
3969 || !TEST_true(psk_client_cb_cnt == 1)
3970 || !TEST_true(psk_server_cb_cnt == 1))
3974 shutdown_ssl_connection(serverssl, clientssl);
3975 serverssl = clientssl = NULL;
3976 use_session_cb_cnt = find_session_cb_cnt = 0;
3977 psk_client_cb_cnt = psk_server_cb_cnt = 0;
3979 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3984 if (!TEST_true(SSL_set1_groups_list(serverssl, "P-256")))
3988 * Check we can create a connection, the PSK is used and the callbacks are
3991 if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
3992 || !TEST_true(SSL_session_reused(clientssl))
3993 || !TEST_true(SSL_session_reused(serverssl)))
3996 if (idx == 0 || idx == 1) {
3997 if (!TEST_true(use_session_cb_cnt == 2)
3998 || !TEST_true(find_session_cb_cnt == 2)
3999 || !TEST_true(psk_client_cb_cnt == 0)
4000 || !TEST_true(psk_server_cb_cnt == 0))
4003 if (!TEST_true(use_session_cb_cnt == 0)
4004 || !TEST_true(find_session_cb_cnt == 0)
4005 || !TEST_true(psk_client_cb_cnt == 2)
4006 || !TEST_true(psk_server_cb_cnt == 2))
4010 shutdown_ssl_connection(serverssl, clientssl);
4011 serverssl = clientssl = NULL;
4012 use_session_cb_cnt = find_session_cb_cnt = 0;
4013 psk_client_cb_cnt = psk_server_cb_cnt = 0;
4017 * Check that if the server rejects the PSK we can still connect, but with
4020 srvid = "Dummy Identity";
4021 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
4023 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4025 || !TEST_false(SSL_session_reused(clientssl))
4026 || !TEST_false(SSL_session_reused(serverssl)))
4029 if (idx == 0 || idx == 1) {
4030 if (!TEST_true(use_session_cb_cnt == 1)
4031 || !TEST_true(find_session_cb_cnt == 1)
4032 || !TEST_true(psk_client_cb_cnt == 0)
4034 * If no old style callback then below should be 0
4037 || !TEST_true(psk_server_cb_cnt == idx))
4040 if (!TEST_true(use_session_cb_cnt == 0)
4041 || !TEST_true(find_session_cb_cnt == 0)
4042 || !TEST_true(psk_client_cb_cnt == 1)
4043 || !TEST_true(psk_server_cb_cnt == 1))
4047 shutdown_ssl_connection(serverssl, clientssl);
4048 serverssl = clientssl = NULL;
4053 SSL_SESSION_free(clientpsk);
4054 SSL_SESSION_free(serverpsk);
4055 clientpsk = serverpsk = NULL;
4056 SSL_free(serverssl);
4057 SSL_free(clientssl);
4063 static unsigned char cookie_magic_value[] = "cookie magic";
4065 static int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
4066 unsigned int *cookie_len)
4069 * Not suitable as a real cookie generation function but good enough for
4072 memcpy(cookie, cookie_magic_value, sizeof(cookie_magic_value) - 1);
4073 *cookie_len = sizeof(cookie_magic_value) - 1;
4078 static int verify_cookie_callback(SSL *ssl, const unsigned char *cookie,
4079 unsigned int cookie_len)
4081 if (cookie_len == sizeof(cookie_magic_value) - 1
4082 && memcmp(cookie, cookie_magic_value, cookie_len) == 0)
4088 static int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
4092 int res = generate_cookie_callback(ssl, cookie, &temp);
4097 static int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie,
4100 return verify_cookie_callback(ssl, cookie, cookie_len);
4103 static int test_stateless(void)
4105 SSL_CTX *sctx = NULL, *cctx = NULL;
4106 SSL *serverssl = NULL, *clientssl = NULL;
4109 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
4111 &sctx, &cctx, cert, privkey)))
4114 /* The arrival of CCS messages can confuse the test */
4115 SSL_CTX_clear_options(cctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
4117 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
4119 /* Send the first ClientHello */
4120 || !TEST_false(create_ssl_connection(serverssl, clientssl,
4121 SSL_ERROR_WANT_READ))
4123 * This should fail with a -1 return because we have no callbacks
4126 || !TEST_int_eq(SSL_stateless(serverssl), -1))
4129 /* Fatal error so abandon the connection from this client */
4130 SSL_free(clientssl);
4133 /* Set up the cookie generation and verification callbacks */
4134 SSL_CTX_set_stateless_cookie_generate_cb(sctx, generate_stateless_cookie_callback);
4135 SSL_CTX_set_stateless_cookie_verify_cb(sctx, verify_stateless_cookie_callback);
4138 * Create a new connection from the client (we can reuse the server SSL
4141 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
4143 /* Send the first ClientHello */
4144 || !TEST_false(create_ssl_connection(serverssl, clientssl,
4145 SSL_ERROR_WANT_READ))
4146 /* This should fail because there is no cookie */
4147 || !TEST_int_eq(SSL_stateless(serverssl), 0))
4150 /* Abandon the connection from this client */
4151 SSL_free(clientssl);
4155 * Now create a connection from a new client but with the same server SSL
4158 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
4160 /* Send the first ClientHello */
4161 || !TEST_false(create_ssl_connection(serverssl, clientssl,
4162 SSL_ERROR_WANT_READ))
4163 /* This should fail because there is no cookie */
4164 || !TEST_int_eq(SSL_stateless(serverssl), 0)
4165 /* Send the second ClientHello */
4166 || !TEST_false(create_ssl_connection(serverssl, clientssl,
4167 SSL_ERROR_WANT_READ))
4168 /* This should succeed because a cookie is now present */
4169 || !TEST_int_eq(SSL_stateless(serverssl), 1)
4170 /* Complete the connection */
4171 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4175 shutdown_ssl_connection(serverssl, clientssl);
4176 serverssl = clientssl = NULL;
4180 SSL_free(serverssl);
4181 SSL_free(clientssl);
4187 #endif /* OPENSSL_NO_TLS1_3 */
4189 static int clntaddoldcb = 0;
4190 static int clntparseoldcb = 0;
4191 static int srvaddoldcb = 0;
4192 static int srvparseoldcb = 0;
4193 static int clntaddnewcb = 0;
4194 static int clntparsenewcb = 0;
4195 static int srvaddnewcb = 0;
4196 static int srvparsenewcb = 0;
4197 static int snicb = 0;
4199 #define TEST_EXT_TYPE1 0xff00
4201 static int old_add_cb(SSL *s, unsigned int ext_type, const unsigned char **out,
4202 size_t *outlen, int *al, void *add_arg)
4204 int *server = (int *)add_arg;
4205 unsigned char *data;
4207 if (SSL_is_server(s))
4212 if (*server != SSL_is_server(s)
4213 || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
4218 *outlen = sizeof(char);
4222 static void old_free_cb(SSL *s, unsigned int ext_type, const unsigned char *out,
4225 OPENSSL_free((unsigned char *)out);
4228 static int old_parse_cb(SSL *s, unsigned int ext_type, const unsigned char *in,
4229 size_t inlen, int *al, void *parse_arg)
4231 int *server = (int *)parse_arg;
4233 if (SSL_is_server(s))
4238 if (*server != SSL_is_server(s)
4239 || inlen != sizeof(char)
4246 static int new_add_cb(SSL *s, unsigned int ext_type, unsigned int context,
4247 const unsigned char **out, size_t *outlen, X509 *x,
4248 size_t chainidx, int *al, void *add_arg)
4250 int *server = (int *)add_arg;
4251 unsigned char *data;
4253 if (SSL_is_server(s))
4258 if (*server != SSL_is_server(s)
4259 || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
4264 *outlen = sizeof(*data);
4268 static void new_free_cb(SSL *s, unsigned int ext_type, unsigned int context,
4269 const unsigned char *out, void *add_arg)
4271 OPENSSL_free((unsigned char *)out);
4274 static int new_parse_cb(SSL *s, unsigned int ext_type, unsigned int context,
4275 const unsigned char *in, size_t inlen, X509 *x,
4276 size_t chainidx, int *al, void *parse_arg)
4278 int *server = (int *)parse_arg;
4280 if (SSL_is_server(s))
4285 if (*server != SSL_is_server(s)
4286 || inlen != sizeof(char) || *in != 1)
4292 static int sni_cb(SSL *s, int *al, void *arg)
4294 SSL_CTX *ctx = (SSL_CTX *)arg;
4296 if (SSL_set_SSL_CTX(s, ctx) == NULL) {
4297 *al = SSL_AD_INTERNAL_ERROR;
4298 return SSL_TLSEXT_ERR_ALERT_FATAL;
4301 return SSL_TLSEXT_ERR_OK;
4305 * Custom call back tests.
4306 * Test 0: Old style callbacks in TLSv1.2
4307 * Test 1: New style callbacks in TLSv1.2
4308 * Test 2: New style callbacks in TLSv1.2 with SNI
4309 * Test 3: New style callbacks in TLSv1.3. Extensions in CH and EE
4310 * Test 4: New style callbacks in TLSv1.3. Extensions in CH, SH, EE, Cert + NST
4312 static int test_custom_exts(int tst)
4314 SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
4315 SSL *clientssl = NULL, *serverssl = NULL;
4317 static int server = 1;
4318 static int client = 0;
4319 SSL_SESSION *sess = NULL;
4320 unsigned int context;
4322 #if defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_TLS1_3)
4323 /* Skip tests for TLSv1.2 and below in this case */
4328 /* Reset callback counters */
4329 clntaddoldcb = clntparseoldcb = srvaddoldcb = srvparseoldcb = 0;
4330 clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
4333 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
4335 &sctx, &cctx, cert, privkey)))
4339 && !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL,
4341 &sctx2, NULL, cert, privkey)))
4346 SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
4347 SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
4349 SSL_CTX_set_options(sctx2, SSL_OP_NO_TLSv1_3);
4353 context = SSL_EXT_CLIENT_HELLO
4354 | SSL_EXT_TLS1_2_SERVER_HELLO
4355 | SSL_EXT_TLS1_3_SERVER_HELLO
4356 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
4357 | SSL_EXT_TLS1_3_CERTIFICATE
4358 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET;
4360 context = SSL_EXT_CLIENT_HELLO
4361 | SSL_EXT_TLS1_2_SERVER_HELLO
4362 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS;
4365 /* Create a client side custom extension */
4367 if (!TEST_true(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
4368 old_add_cb, old_free_cb,
4369 &client, old_parse_cb,
4373 if (!TEST_true(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1, context,
4374 new_add_cb, new_free_cb,
4375 &client, new_parse_cb, &client)))
4379 /* Should not be able to add duplicates */
4380 if (!TEST_false(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
4381 old_add_cb, old_free_cb,
4382 &client, old_parse_cb,
4384 || !TEST_false(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1,
4385 context, new_add_cb,
4386 new_free_cb, &client,
4387 new_parse_cb, &client)))
4390 /* Create a server side custom extension */
4392 if (!TEST_true(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
4393 old_add_cb, old_free_cb,
4394 &server, old_parse_cb,
4398 if (!TEST_true(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1, context,
4399 new_add_cb, new_free_cb,
4400 &server, new_parse_cb, &server)))
4403 && !TEST_true(SSL_CTX_add_custom_ext(sctx2, TEST_EXT_TYPE1,
4404 context, new_add_cb,
4405 new_free_cb, &server,
4406 new_parse_cb, &server)))
4410 /* Should not be able to add duplicates */
4411 if (!TEST_false(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
4412 old_add_cb, old_free_cb,
4413 &server, old_parse_cb,
4415 || !TEST_false(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1,
4416 context, new_add_cb,
4417 new_free_cb, &server,
4418 new_parse_cb, &server)))
4423 if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
4424 || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
4428 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
4429 &clientssl, NULL, NULL))
4430 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4435 if (clntaddoldcb != 1
4436 || clntparseoldcb != 1
4438 || srvparseoldcb != 1)
4440 } else if (tst == 1 || tst == 2 || tst == 3) {
4441 if (clntaddnewcb != 1
4442 || clntparsenewcb != 1
4444 || srvparsenewcb != 1
4445 || (tst != 2 && snicb != 0)
4446 || (tst == 2 && snicb != 1))
4449 /* In this case there 2 NewSessionTicket messages created */
4450 if (clntaddnewcb != 1
4451 || clntparsenewcb != 5
4453 || srvparsenewcb != 1)
4457 sess = SSL_get1_session(clientssl);
4458 SSL_shutdown(clientssl);
4459 SSL_shutdown(serverssl);
4460 SSL_free(serverssl);
4461 SSL_free(clientssl);
4462 serverssl = clientssl = NULL;
4465 /* We don't bother with the resumption aspects for this test */
4470 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
4472 || !TEST_true(SSL_set_session(clientssl, sess))
4473 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4478 * For a resumed session we expect to add the ClientHello extension. For the
4479 * old style callbacks we ignore it on the server side because they set
4480 * SSL_EXT_IGNORE_ON_RESUMPTION. The new style callbacks do not ignore
4484 if (clntaddoldcb != 2
4485 || clntparseoldcb != 1
4487 || srvparseoldcb != 1)
4489 } else if (tst == 1 || tst == 2 || tst == 3) {
4490 if (clntaddnewcb != 2
4491 || clntparsenewcb != 2
4493 || srvparsenewcb != 2)
4497 * No Certificate message extensions in the resumption handshake,
4498 * 2 NewSessionTickets in the initial handshake, 1 in the resumption
4500 if (clntaddnewcb != 2
4501 || clntparsenewcb != 8
4503 || srvparsenewcb != 2)
4510 SSL_SESSION_free(sess);
4511 SSL_free(serverssl);
4512 SSL_free(clientssl);
4513 SSL_CTX_free(sctx2);
4520 * Test loading of serverinfo data in various formats. test_sslmessages actually
4521 * tests to make sure the extensions appear in the handshake
4523 static int test_serverinfo(int tst)
4525 unsigned int version;
4526 unsigned char *sibuf;
4528 int ret, expected, testresult = 0;
4531 ctx = SSL_CTX_new(TLS_method());
4535 if ((tst & 0x01) == 0x01)
4536 version = SSL_SERVERINFOV2;
4538 version = SSL_SERVERINFOV1;
4540 if ((tst & 0x02) == 0x02) {
4541 sibuf = serverinfov2;
4542 sibuflen = sizeof(serverinfov2);
4543 expected = (version == SSL_SERVERINFOV2);
4545 sibuf = serverinfov1;
4546 sibuflen = sizeof(serverinfov1);
4547 expected = (version == SSL_SERVERINFOV1);
4550 if ((tst & 0x04) == 0x04) {
4551 ret = SSL_CTX_use_serverinfo_ex(ctx, version, sibuf, sibuflen);
4553 ret = SSL_CTX_use_serverinfo(ctx, sibuf, sibuflen);
4556 * The version variable is irrelevant in this case - it's what is in the
4557 * buffer that matters
4559 if ((tst & 0x02) == 0x02)
4565 if (!TEST_true(ret == expected))
4577 * Test that SSL_export_keying_material() produces expected results. There are
4578 * no test vectors so all we do is test that both sides of the communication
4579 * produce the same results for different protocol versions.
4581 #define SMALL_LABEL_LEN 10
4582 #define LONG_LABEL_LEN 249
4583 static int test_export_key_mat(int tst)
4586 SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
4587 SSL *clientssl = NULL, *serverssl = NULL;
4588 const char label[LONG_LABEL_LEN + 1] = "test label";
4589 const unsigned char context[] = "context";
4590 const unsigned char *emptycontext = NULL;
4591 unsigned char ckeymat1[80], ckeymat2[80], ckeymat3[80];
4592 unsigned char skeymat1[80], skeymat2[80], skeymat3[80];
4594 const int protocols[] = {
4603 #ifdef OPENSSL_NO_TLS1
4607 #ifdef OPENSSL_NO_TLS1_1
4611 #ifdef OPENSSL_NO_TLS1_2
4615 #ifdef OPENSSL_NO_TLS1_3
4619 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
4621 &sctx, &cctx, cert, privkey)))
4624 OPENSSL_assert(tst >= 0 && (size_t)tst < OSSL_NELEM(protocols));
4625 SSL_CTX_set_max_proto_version(cctx, protocols[tst]);
4626 SSL_CTX_set_min_proto_version(cctx, protocols[tst]);
4628 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
4630 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4636 * TLSv1.3 imposes a maximum label len of 249 bytes. Check we fail if we
4639 if (!TEST_int_le(SSL_export_keying_material(clientssl, ckeymat1,
4640 sizeof(ckeymat1), label,
4641 LONG_LABEL_LEN + 1, context,
4642 sizeof(context) - 1, 1), 0))
4647 } else if (tst == 4) {
4648 labellen = LONG_LABEL_LEN;
4650 labellen = SMALL_LABEL_LEN;
4653 if (!TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat1,
4654 sizeof(ckeymat1), label,
4656 sizeof(context) - 1, 1), 1)
4657 || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat2,
4658 sizeof(ckeymat2), label,
4662 || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat3,
4663 sizeof(ckeymat3), label,
4666 || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat1,
4667 sizeof(skeymat1), label,
4670 sizeof(context) -1, 1),
4672 || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat2,
4673 sizeof(skeymat2), label,
4677 || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat3,
4678 sizeof(skeymat3), label,
4682 * Check that both sides created the same key material with the
4685 || !TEST_mem_eq(ckeymat1, sizeof(ckeymat1), skeymat1,
4688 * Check that both sides created the same key material with an
4691 || !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), skeymat2,
4694 * Check that both sides created the same key material without a
4697 || !TEST_mem_eq(ckeymat3, sizeof(ckeymat3), skeymat3,
4699 /* Different contexts should produce different results */
4700 || !TEST_mem_ne(ckeymat1, sizeof(ckeymat1), ckeymat2,
4705 * Check that an empty context and no context produce different results in
4706 * protocols less than TLSv1.3. In TLSv1.3 they should be the same.
4708 if ((tst < 3 && !TEST_mem_ne(ckeymat2, sizeof(ckeymat2), ckeymat3,
4710 || (tst >= 3 && !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), ckeymat3,
4717 SSL_free(serverssl);
4718 SSL_free(clientssl);
4719 SSL_CTX_free(sctx2);
4726 #ifndef OPENSSL_NO_TLS1_3
4728 * Test that SSL_export_keying_material_early() produces expected
4729 * results. There are no test vectors so all we do is test that both
4730 * sides of the communication produce the same results for different
4731 * protocol versions.
4733 static int test_export_key_mat_early(int idx)
4735 static const char label[] = "test label";
4736 static const unsigned char context[] = "context";
4738 SSL_CTX *cctx = NULL, *sctx = NULL;
4739 SSL *clientssl = NULL, *serverssl = NULL;
4740 SSL_SESSION *sess = NULL;
4741 const unsigned char *emptycontext = NULL;
4742 unsigned char ckeymat1[80], ckeymat2[80];
4743 unsigned char skeymat1[80], skeymat2[80];
4744 unsigned char buf[1];
4745 size_t readbytes, written;
4747 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl, &serverssl,
4751 /* Here writing 0 length early data is enough. */
4752 if (!TEST_true(SSL_write_early_data(clientssl, NULL, 0, &written))
4753 || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
4755 SSL_READ_EARLY_DATA_ERROR)
4756 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
4757 SSL_EARLY_DATA_ACCEPTED))
4760 if (!TEST_int_eq(SSL_export_keying_material_early(
4761 clientssl, ckeymat1, sizeof(ckeymat1), label,
4762 sizeof(label) - 1, context, sizeof(context) - 1), 1)
4763 || !TEST_int_eq(SSL_export_keying_material_early(
4764 clientssl, ckeymat2, sizeof(ckeymat2), label,
4765 sizeof(label) - 1, emptycontext, 0), 1)
4766 || !TEST_int_eq(SSL_export_keying_material_early(
4767 serverssl, skeymat1, sizeof(skeymat1), label,
4768 sizeof(label) - 1, context, sizeof(context) - 1), 1)
4769 || !TEST_int_eq(SSL_export_keying_material_early(
4770 serverssl, skeymat2, sizeof(skeymat2), label,
4771 sizeof(label) - 1, emptycontext, 0), 1)
4773 * Check that both sides created the same key material with the
4776 || !TEST_mem_eq(ckeymat1, sizeof(ckeymat1), skeymat1,
4779 * Check that both sides created the same key material with an
4782 || !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), skeymat2,
4784 /* Different contexts should produce different results */
4785 || !TEST_mem_ne(ckeymat1, sizeof(ckeymat1), ckeymat2,
4792 SSL_SESSION_free(sess);
4793 SSL_SESSION_free(clientpsk);
4794 SSL_SESSION_free(serverpsk);
4795 clientpsk = serverpsk = NULL;
4796 SSL_free(serverssl);
4797 SSL_free(clientssl);
4804 #define NUM_KEY_UPDATE_MESSAGES 40
4808 static int test_key_update(void)
4810 SSL_CTX *cctx = NULL, *sctx = NULL;
4811 SSL *clientssl = NULL, *serverssl = NULL;
4812 int testresult = 0, i, j;
4814 static char *mess = "A test message";
4816 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
4817 TLS_client_method(),
4820 &sctx, &cctx, cert, privkey))
4821 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
4823 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4827 for (j = 0; j < 2; j++) {
4828 /* Send lots of KeyUpdate messages */
4829 for (i = 0; i < NUM_KEY_UPDATE_MESSAGES; i++) {
4830 if (!TEST_true(SSL_key_update(clientssl,
4832 ? SSL_KEY_UPDATE_NOT_REQUESTED
4833 : SSL_KEY_UPDATE_REQUESTED))
4834 || !TEST_true(SSL_do_handshake(clientssl)))
4838 /* Check that sending and receiving app data is ok */
4839 if (!TEST_int_eq(SSL_write(clientssl, mess, strlen(mess)), strlen(mess))
4840 || !TEST_int_eq(SSL_read(serverssl, buf, sizeof(buf)),
4844 if (!TEST_int_eq(SSL_write(serverssl, mess, strlen(mess)), strlen(mess))
4845 || !TEST_int_eq(SSL_read(clientssl, buf, sizeof(buf)),
4853 SSL_free(serverssl);
4854 SSL_free(clientssl);
4862 * Test we can handle a KeyUpdate (update requested) message while write data
4864 * Test 0: Client sends KeyUpdate while Server is writing
4865 * Test 1: Server sends KeyUpdate while Client is writing
4867 static int test_key_update_in_write(int tst)
4869 SSL_CTX *cctx = NULL, *sctx = NULL;
4870 SSL *clientssl = NULL, *serverssl = NULL;
4873 static char *mess = "A test message";
4874 BIO *bretry = BIO_new(bio_s_always_retry());
4876 SSL *peerupdate = NULL, *peerwrite = NULL;
4878 if (!TEST_ptr(bretry)
4879 || !TEST_true(create_ssl_ctx_pair(TLS_server_method(),
4880 TLS_client_method(),
4883 &sctx, &cctx, cert, privkey))
4884 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
4886 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4890 peerupdate = tst == 0 ? clientssl : serverssl;
4891 peerwrite = tst == 0 ? serverssl : clientssl;
4893 if (!TEST_true(SSL_key_update(peerupdate, SSL_KEY_UPDATE_REQUESTED))
4894 || !TEST_true(SSL_do_handshake(peerupdate)))
4897 /* Swap the writing endpoint's write BIO to force a retry */
4898 tmp = SSL_get_wbio(peerwrite);
4899 if (!TEST_ptr(tmp) || !TEST_true(BIO_up_ref(tmp))) {
4903 SSL_set0_wbio(peerwrite, bretry);
4906 /* Write data that we know will fail with SSL_ERROR_WANT_WRITE */
4907 if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), -1)
4908 || !TEST_int_eq(SSL_get_error(peerwrite, 0), SSL_ERROR_WANT_WRITE))
4911 /* Reinstate the original writing endpoint's write BIO */
4912 SSL_set0_wbio(peerwrite, tmp);
4915 /* Now read some data - we will read the key update */
4916 if (!TEST_int_eq(SSL_read(peerwrite, buf, sizeof(buf)), -1)
4917 || !TEST_int_eq(SSL_get_error(peerwrite, 0), SSL_ERROR_WANT_READ))
4921 * Complete the write we started previously and read it from the other
4924 if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), strlen(mess))
4925 || !TEST_int_eq(SSL_read(peerupdate, buf, sizeof(buf)), strlen(mess)))
4928 /* Write more data to ensure we send the KeyUpdate message back */
4929 if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), strlen(mess))
4930 || !TEST_int_eq(SSL_read(peerupdate, buf, sizeof(buf)), strlen(mess)))
4936 SSL_free(serverssl);
4937 SSL_free(clientssl);
4945 #endif /* OPENSSL_NO_TLS1_3 */
4947 static int test_ssl_clear(int idx)
4949 SSL_CTX *cctx = NULL, *sctx = NULL;
4950 SSL *clientssl = NULL, *serverssl = NULL;
4953 #ifdef OPENSSL_NO_TLS1_2
4958 /* Create an initial connection */
4959 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
4961 &sctx, &cctx, cert, privkey))
4963 && !TEST_true(SSL_CTX_set_max_proto_version(cctx,
4965 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
4966 &clientssl, NULL, NULL))
4967 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4971 SSL_shutdown(clientssl);
4972 SSL_shutdown(serverssl);
4973 SSL_free(serverssl);
4976 /* Clear clientssl - we're going to reuse the object */
4977 if (!TEST_true(SSL_clear(clientssl)))
4980 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
4982 || !TEST_true(create_ssl_connection(serverssl, clientssl,
4984 || !TEST_true(SSL_session_reused(clientssl)))
4987 SSL_shutdown(clientssl);
4988 SSL_shutdown(serverssl);
4993 SSL_free(serverssl);
4994 SSL_free(clientssl);
5001 /* Parse CH and retrieve any MFL extension value if present */
5002 static int get_MFL_from_client_hello(BIO *bio, int *mfl_codemfl_code)
5005 unsigned char *data;
5006 PACKET pkt, pkt2, pkt3;
5007 unsigned int MFL_code = 0, type = 0;
5009 if (!TEST_uint_gt( len = BIO_get_mem_data( bio, (char **) &data ), 0 ) )
5012 memset(&pkt, 0, sizeof(pkt));
5013 memset(&pkt2, 0, sizeof(pkt2));
5014 memset(&pkt3, 0, sizeof(pkt3));
5016 if (!TEST_true( PACKET_buf_init( &pkt, data, len ) )
5017 /* Skip the record header */
5018 || !PACKET_forward(&pkt, SSL3_RT_HEADER_LENGTH)
5019 /* Skip the handshake message header */
5020 || !TEST_true(PACKET_forward(&pkt, SSL3_HM_HEADER_LENGTH))
5021 /* Skip client version and random */
5022 || !TEST_true(PACKET_forward(&pkt, CLIENT_VERSION_LEN
5023 + SSL3_RANDOM_SIZE))
5024 /* Skip session id */
5025 || !TEST_true(PACKET_get_length_prefixed_1(&pkt, &pkt2))
5027 || !TEST_true(PACKET_get_length_prefixed_2(&pkt, &pkt2))
5028 /* Skip compression */
5029 || !TEST_true(PACKET_get_length_prefixed_1(&pkt, &pkt2))
5030 /* Extensions len */
5031 || !TEST_true(PACKET_as_length_prefixed_2(&pkt, &pkt2)))
5034 /* Loop through all extensions */
5035 while (PACKET_remaining(&pkt2)) {
5036 if (!TEST_true(PACKET_get_net_2(&pkt2, &type))
5037 || !TEST_true(PACKET_get_length_prefixed_2(&pkt2, &pkt3)))
5040 if (type == TLSEXT_TYPE_max_fragment_length) {
5041 if (!TEST_uint_ne(PACKET_remaining(&pkt3), 0)
5042 || !TEST_true(PACKET_get_1(&pkt3, &MFL_code)))
5045 *mfl_codemfl_code = MFL_code;
5054 /* Maximum-Fragment-Length TLS extension mode to test */
5055 static const unsigned char max_fragment_len_test[] = {
5056 TLSEXT_max_fragment_length_512,
5057 TLSEXT_max_fragment_length_1024,
5058 TLSEXT_max_fragment_length_2048,
5059 TLSEXT_max_fragment_length_4096
5062 static int test_max_fragment_len_ext(int idx_tst)
5066 int testresult = 0, MFL_mode = 0;
5069 ctx = SSL_CTX_new(TLS_method());
5073 if (!TEST_true(SSL_CTX_set_tlsext_max_fragment_length(
5074 ctx, max_fragment_len_test[idx_tst])))
5081 rbio = BIO_new(BIO_s_mem());
5082 wbio = BIO_new(BIO_s_mem());
5083 if (!TEST_ptr(rbio)|| !TEST_ptr(wbio)) {
5089 SSL_set_bio(con, rbio, wbio);
5090 SSL_set_connect_state(con);
5092 if (!TEST_int_le(SSL_connect(con), 0)) {
5093 /* This shouldn't succeed because we don't have a server! */
5097 if (!TEST_true(get_MFL_from_client_hello(wbio, &MFL_mode)))
5098 /* no MFL in client hello */
5100 if (!TEST_true(max_fragment_len_test[idx_tst] == MFL_mode))
5112 #ifndef OPENSSL_NO_TLS1_3
5113 static int test_pha_key_update(void)
5115 SSL_CTX *cctx = NULL, *sctx = NULL;
5116 SSL *clientssl = NULL, *serverssl = NULL;
5119 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
5121 &sctx, &cctx, cert, privkey)))
5124 if (!TEST_true(SSL_CTX_set_min_proto_version(sctx, TLS1_3_VERSION))
5125 || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_3_VERSION))
5126 || !TEST_true(SSL_CTX_set_min_proto_version(cctx, TLS1_3_VERSION))
5127 || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_3_VERSION)))
5130 SSL_CTX_set_post_handshake_auth(cctx, 1);
5132 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
5136 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
5140 SSL_set_verify(serverssl, SSL_VERIFY_PEER, NULL);
5141 if (!TEST_true(SSL_verify_client_post_handshake(serverssl)))
5144 if (!TEST_true(SSL_key_update(clientssl, SSL_KEY_UPDATE_NOT_REQUESTED)))
5147 /* Start handshake on the server */
5148 if (!TEST_int_eq(SSL_do_handshake(serverssl), 1))
5151 /* Starts with SSL_connect(), but it's really just SSL_do_handshake() */
5152 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
5156 SSL_shutdown(clientssl);
5157 SSL_shutdown(serverssl);
5162 SSL_free(serverssl);
5163 SSL_free(clientssl);
5170 #if !defined(OPENSSL_NO_SRP) && !defined(OPENSSL_NO_TLS1_2)
5172 static SRP_VBASE *vbase = NULL;
5174 static int ssl_srp_cb(SSL *s, int *ad, void *arg)
5176 int ret = SSL3_AL_FATAL;
5178 SRP_user_pwd *user = NULL;
5180 username = SSL_get_srp_username(s);
5181 if (username == NULL) {
5182 *ad = SSL_AD_INTERNAL_ERROR;
5186 user = SRP_VBASE_get1_by_user(vbase, username);
5188 *ad = SSL_AD_INTERNAL_ERROR;
5192 if (SSL_set_srp_server_param(s, user->N, user->g, user->s, user->v,
5194 *ad = SSL_AD_INTERNAL_ERROR;
5201 SRP_user_pwd_free(user);
5205 static int create_new_vfile(char *userid, char *password, const char *filename)
5208 OPENSSL_STRING *row = OPENSSL_zalloc(sizeof(row) * (DB_NUMBER + 1));
5211 BIO *out = NULL, *dummy = BIO_new_mem_buf("", 0);
5214 if (!TEST_ptr(dummy) || !TEST_ptr(row))
5217 gNid = SRP_create_verifier(userid, password, &row[DB_srpsalt],
5218 &row[DB_srpverifier], NULL, NULL);
5219 if (!TEST_ptr(gNid))
5223 * The only way to create an empty TXT_DB is to provide a BIO with no data
5226 db = TXT_DB_read(dummy, DB_NUMBER);
5230 out = BIO_new_file(filename, "w");
5234 row[DB_srpid] = OPENSSL_strdup(userid);
5235 row[DB_srptype] = OPENSSL_strdup("V");
5236 row[DB_srpgN] = OPENSSL_strdup(gNid);
5238 if (!TEST_ptr(row[DB_srpid])
5239 || !TEST_ptr(row[DB_srptype])
5240 || !TEST_ptr(row[DB_srpgN])
5241 || !TEST_true(TXT_DB_insert(db, row)))
5246 if (!TXT_DB_write(out, db))
5252 for (i = 0; i < DB_NUMBER; i++)
5253 OPENSSL_free(row[i]);
5263 static int create_new_vbase(char *userid, char *password)
5265 BIGNUM *verifier = NULL, *salt = NULL;
5266 const SRP_gN *lgN = NULL;
5267 SRP_user_pwd *user_pwd = NULL;
5270 lgN = SRP_get_default_gN(NULL);
5274 if (!TEST_true(SRP_create_verifier_BN(userid, password, &salt, &verifier,
5278 user_pwd = OPENSSL_zalloc(sizeof(*user_pwd));
5279 if (!TEST_ptr(user_pwd))
5282 user_pwd->N = lgN->N;
5283 user_pwd->g = lgN->g;
5284 user_pwd->id = OPENSSL_strdup(userid);
5285 if (!TEST_ptr(user_pwd->id))
5288 user_pwd->v = verifier;
5290 verifier = salt = NULL;
5292 if (sk_SRP_user_pwd_insert(vbase->users_pwd, user_pwd, 0) == 0)
5298 SRP_user_pwd_free(user_pwd);
5308 * Test 0: Simple successful SRP connection, new vbase
5309 * Test 1: Connection failure due to bad password, new vbase
5310 * Test 2: Simple successful SRP connection, vbase loaded from existing file
5311 * Test 3: Connection failure due to bad password, vbase loaded from existing
5313 * Test 4: Simple successful SRP connection, vbase loaded from new file
5314 * Test 5: Connection failure due to bad password, vbase loaded from new file
5316 static int test_srp(int tst)
5318 char *userid = "test", *password = "password", *tstsrpfile;
5319 SSL_CTX *cctx = NULL, *sctx = NULL;
5320 SSL *clientssl = NULL, *serverssl = NULL;
5321 int ret, testresult = 0;
5323 vbase = SRP_VBASE_new(NULL);
5324 if (!TEST_ptr(vbase))
5327 if (tst == 0 || tst == 1) {
5328 if (!TEST_true(create_new_vbase(userid, password)))
5331 if (tst == 4 || tst == 5) {
5332 if (!TEST_true(create_new_vfile(userid, password, tmpfilename)))
5334 tstsrpfile = tmpfilename;
5336 tstsrpfile = srpvfile;
5338 if (!TEST_int_eq(SRP_VBASE_init(vbase, tstsrpfile), SRP_NO_ERROR))
5342 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
5344 &sctx, &cctx, cert, privkey)))
5347 if (!TEST_int_gt(SSL_CTX_set_srp_username_callback(sctx, ssl_srp_cb), 0)
5348 || !TEST_true(SSL_CTX_set_cipher_list(cctx, "SRP-AES-128-CBC-SHA"))
5349 || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_2_VERSION))
5350 || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION))
5351 || !TEST_int_gt(SSL_CTX_set_srp_username(cctx, userid), 0))
5355 if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, "badpass"), 0))
5358 if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, password), 0))
5362 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
5366 ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
5368 if (!TEST_true(tst % 2 == 0))
5371 if (!TEST_true(tst % 2 == 1))
5378 SRP_VBASE_free(vbase);
5380 SSL_free(serverssl);
5381 SSL_free(clientssl);
5389 static int info_cb_failed = 0;
5390 static int info_cb_offset = 0;
5391 static int info_cb_this_state = -1;
5393 static struct info_cb_states_st {
5395 const char *statestr;
5396 } info_cb_states[][60] = {
5398 /* TLSv1.2 server followed by resumption */
5399 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
5400 {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
5401 {SSL_CB_LOOP, "TWSC"}, {SSL_CB_LOOP, "TWSKE"}, {SSL_CB_LOOP, "TWSD"},
5402 {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWSD"}, {SSL_CB_LOOP, "TRCKE"},
5403 {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWST"},
5404 {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
5405 {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
5406 {SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
5407 {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"},
5408 {SSL_CB_LOOP, "TWSH"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
5409 {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TRCCS"},
5410 {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
5411 {SSL_CB_EXIT, NULL}, {0, NULL},
5413 /* TLSv1.2 client followed by resumption */
5414 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
5415 {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
5416 {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TRSC"}, {SSL_CB_LOOP, "TRSKE"},
5417 {SSL_CB_LOOP, "TRSD"}, {SSL_CB_LOOP, "TWCKE"}, {SSL_CB_LOOP, "TWCCS"},
5418 {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWFIN"},
5419 {SSL_CB_LOOP, "TRST"}, {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"},
5420 {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {SSL_CB_ALERT, NULL},
5421 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
5422 {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
5423 {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"},
5424 {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
5425 {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {0, NULL},
5427 /* TLSv1.3 server followed by resumption */
5428 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
5429 {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
5430 {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWSC"},
5431 {SSL_CB_LOOP, "TRSCV"}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TED"},
5432 {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRFIN"},
5433 {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_LOOP, "TWST"},
5434 {SSL_CB_LOOP, "TWST"}, {SSL_CB_EXIT, NULL}, {SSL_CB_ALERT, NULL},
5435 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
5436 {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
5437 {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWFIN"},
5438 {SSL_CB_LOOP, "TED"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"},
5439 {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
5440 {SSL_CB_LOOP, "TWST"}, {SSL_CB_EXIT, NULL}, {0, NULL},
5442 /* TLSv1.3 client followed by resumption */
5443 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
5444 {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
5445 {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"}, {SSL_CB_LOOP, "TRSC"},
5446 {SSL_CB_LOOP, "TRSCV"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"},
5447 {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
5448 {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "SSLOK "},
5449 {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK "},
5450 {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL},
5451 {SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
5452 {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL},
5453 {SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
5454 {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
5455 {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
5456 {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "TRST"},
5457 {SSL_CB_EXIT, NULL}, {0, NULL},
5459 /* TLSv1.3 server, early_data */
5460 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
5461 {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
5462 {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWFIN"},
5463 {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
5464 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TED"},
5465 {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TWEOED"}, {SSL_CB_LOOP, "TRFIN"},
5466 {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_LOOP, "TWST"},
5467 {SSL_CB_EXIT, NULL}, {0, NULL},
5469 /* TLSv1.3 client, early_data */
5470 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
5471 {SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TWCCS"},
5472 {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
5473 {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TED"},
5474 {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
5475 {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TPEDE"}, {SSL_CB_LOOP, "TWEOED"},
5476 {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
5477 {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "SSLOK "},
5478 {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL}, {0, NULL},
5484 static void sslapi_info_callback(const SSL *s, int where, int ret)
5486 struct info_cb_states_st *state = info_cb_states[info_cb_offset];
5488 /* We do not ever expect a connection to fail in this test */
5489 if (!TEST_false(ret == 0)) {
5495 * Do some sanity checks. We never expect these things to happen in this
5498 if (!TEST_false((SSL_is_server(s) && (where & SSL_ST_CONNECT) != 0))
5499 || !TEST_false(!SSL_is_server(s) && (where & SSL_ST_ACCEPT) != 0)
5500 || !TEST_int_ne(state[++info_cb_this_state].where, 0)) {
5505 /* Now check we're in the right state */
5506 if (!TEST_true((where & state[info_cb_this_state].where) != 0)) {
5510 if ((where & SSL_CB_LOOP) != 0
5511 && !TEST_int_eq(strcmp(SSL_state_string(s),
5512 state[info_cb_this_state].statestr), 0)) {
5518 * Check that, if we've got SSL_CB_HANDSHAKE_DONE we are not in init
5520 if ((where & SSL_CB_HANDSHAKE_DONE)
5521 && SSL_in_init((SSL *)s) != 0) {
5528 * Test the info callback gets called when we expect it to.
5530 * Test 0: TLSv1.2, server
5531 * Test 1: TLSv1.2, client
5532 * Test 2: TLSv1.3, server
5533 * Test 3: TLSv1.3, client
5534 * Test 4: TLSv1.3, server, early_data
5535 * Test 5: TLSv1.3, client, early_data
5537 static int test_info_callback(int tst)
5539 SSL_CTX *cctx = NULL, *sctx = NULL;
5540 SSL *clientssl = NULL, *serverssl = NULL;
5541 SSL_SESSION *clntsess = NULL;
5546 /* We need either ECDHE or DHE for the TLSv1.2 test to work */
5547 #if !defined(OPENSSL_NO_TLS1_2) && (!defined(OPENSSL_NO_EC) \
5548 || !defined(OPENSSL_NO_DH))
5549 tlsvers = TLS1_2_VERSION;
5554 #ifndef OPENSSL_NO_TLS1_3
5555 tlsvers = TLS1_3_VERSION;
5563 info_cb_this_state = -1;
5564 info_cb_offset = tst;
5566 #ifndef OPENSSL_NO_TLS1_3
5568 SSL_SESSION *sess = NULL;
5569 size_t written, readbytes;
5570 unsigned char buf[80];
5572 /* early_data tests */
5573 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
5574 &serverssl, &sess, 0)))
5577 /* We don't actually need this reference */
5578 SSL_SESSION_free(sess);
5580 SSL_set_info_callback((tst % 2) == 0 ? serverssl : clientssl,
5581 sslapi_info_callback);
5583 /* Write and read some early data and then complete the connection */
5584 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
5586 || !TEST_size_t_eq(written, strlen(MSG1))
5587 || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
5588 sizeof(buf), &readbytes),
5589 SSL_READ_EARLY_DATA_SUCCESS)
5590 || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
5591 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
5592 SSL_EARLY_DATA_ACCEPTED)
5593 || !TEST_true(create_ssl_connection(serverssl, clientssl,
5595 || !TEST_false(info_cb_failed))
5603 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
5604 TLS_client_method(),
5605 tlsvers, tlsvers, &sctx, &cctx, cert,
5610 * For even numbered tests we check the server callbacks. For odd numbers we
5613 SSL_CTX_set_info_callback((tst % 2) == 0 ? sctx : cctx,
5614 sslapi_info_callback);
5616 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
5617 &clientssl, NULL, NULL))
5618 || !TEST_true(create_ssl_connection(serverssl, clientssl,
5620 || !TEST_false(info_cb_failed))
5625 clntsess = SSL_get1_session(clientssl);
5626 SSL_shutdown(clientssl);
5627 SSL_shutdown(serverssl);
5628 SSL_free(serverssl);
5629 SSL_free(clientssl);
5630 serverssl = clientssl = NULL;
5632 /* Now do a resumption */
5633 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
5635 || !TEST_true(SSL_set_session(clientssl, clntsess))
5636 || !TEST_true(create_ssl_connection(serverssl, clientssl,
5638 || !TEST_true(SSL_session_reused(clientssl))
5639 || !TEST_false(info_cb_failed))
5645 SSL_free(serverssl);
5646 SSL_free(clientssl);
5647 SSL_SESSION_free(clntsess);
5653 static int test_ssl_pending(int tst)
5655 SSL_CTX *cctx = NULL, *sctx = NULL;
5656 SSL *clientssl = NULL, *serverssl = NULL;
5658 char msg[] = "A test message";
5660 size_t written, readbytes;
5663 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
5664 TLS_client_method(),
5666 &sctx, &cctx, cert, privkey)))
5669 #ifndef OPENSSL_NO_DTLS
5670 if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(),
5671 DTLS_client_method(),
5673 &sctx, &cctx, cert, privkey)))
5680 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
5682 || !TEST_true(create_ssl_connection(serverssl, clientssl,
5686 if (!TEST_int_eq(SSL_pending(clientssl), 0)
5687 || !TEST_false(SSL_has_pending(clientssl))
5688 || !TEST_int_eq(SSL_pending(serverssl), 0)
5689 || !TEST_false(SSL_has_pending(serverssl))
5690 || !TEST_true(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
5691 || !TEST_size_t_eq(written, sizeof(msg))
5692 || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
5693 || !TEST_size_t_eq(readbytes, sizeof(buf))
5694 || !TEST_int_eq(SSL_pending(clientssl), (int)(written - readbytes))
5695 || !TEST_true(SSL_has_pending(clientssl)))
5701 SSL_free(serverssl);
5702 SSL_free(clientssl);
5710 unsigned int maxprot;
5711 const char *clntciphers;
5712 const char *clnttls13ciphers;
5713 const char *srvrciphers;
5714 const char *srvrtls13ciphers;
5716 } shared_ciphers_data[] = {
5718 * We can't establish a connection (even in TLSv1.1) with these ciphersuites if
5719 * TLSv1.3 is enabled but TLSv1.2 is disabled.
5721 #if defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
5724 "AES128-SHA:AES256-SHA",
5726 "AES256-SHA:DHE-RSA-AES128-SHA",
5732 "AES128-SHA:DHE-RSA-AES128-SHA:AES256-SHA",
5734 "AES128-SHA:DHE-RSA-AES256-SHA:AES256-SHA",
5736 "AES128-SHA:AES256-SHA"
5740 "AES128-SHA:AES256-SHA",
5742 "AES128-SHA:DHE-RSA-AES128-SHA",
5748 * This test combines TLSv1.3 and TLSv1.2 ciphersuites so they must both be
5751 #if !defined(OPENSSL_NO_TLS1_3) && !defined(OPENSSL_NO_TLS1_2) \
5752 && !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
5755 "AES128-SHA:AES256-SHA",
5757 "AES256-SHA:AES128-SHA256",
5759 "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:"
5760 "TLS_AES_128_GCM_SHA256:AES256-SHA"
5763 #ifndef OPENSSL_NO_TLS1_3
5767 "TLS_AES_256_GCM_SHA384",
5769 "TLS_AES_256_GCM_SHA384",
5770 "TLS_AES_256_GCM_SHA384"
5775 static int test_ssl_get_shared_ciphers(int tst)
5777 SSL_CTX *cctx = NULL, *sctx = NULL;
5778 SSL *clientssl = NULL, *serverssl = NULL;
5782 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
5783 TLS_client_method(),
5785 shared_ciphers_data[tst].maxprot,
5786 &sctx, &cctx, cert, privkey)))
5789 if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
5790 shared_ciphers_data[tst].clntciphers))
5791 || (shared_ciphers_data[tst].clnttls13ciphers != NULL
5792 && !TEST_true(SSL_CTX_set_ciphersuites(cctx,
5793 shared_ciphers_data[tst].clnttls13ciphers)))
5794 || !TEST_true(SSL_CTX_set_cipher_list(sctx,
5795 shared_ciphers_data[tst].srvrciphers))
5796 || (shared_ciphers_data[tst].srvrtls13ciphers != NULL
5797 && !TEST_true(SSL_CTX_set_ciphersuites(sctx,
5798 shared_ciphers_data[tst].srvrtls13ciphers))))
5802 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
5804 || !TEST_true(create_ssl_connection(serverssl, clientssl,
5808 if (!TEST_ptr(SSL_get_shared_ciphers(serverssl, buf, sizeof(buf)))
5809 || !TEST_int_eq(strcmp(buf, shared_ciphers_data[tst].shared), 0)) {
5810 TEST_info("Shared ciphers are: %s\n", buf);
5817 SSL_free(serverssl);
5818 SSL_free(clientssl);
5825 static const char *appdata = "Hello World";
5826 static int gen_tick_called, dec_tick_called, tick_key_cb_called;
5827 static int tick_key_renew = 0;
5828 static SSL_TICKET_RETURN tick_dec_ret = SSL_TICKET_RETURN_ABORT;
5830 static int gen_tick_cb(SSL *s, void *arg)
5832 gen_tick_called = 1;
5834 return SSL_SESSION_set1_ticket_appdata(SSL_get_session(s), appdata,
5838 static SSL_TICKET_RETURN dec_tick_cb(SSL *s, SSL_SESSION *ss,
5839 const unsigned char *keyname,
5840 size_t keyname_length,
5841 SSL_TICKET_STATUS status,
5847 dec_tick_called = 1;
5849 if (status == SSL_TICKET_EMPTY)
5850 return SSL_TICKET_RETURN_IGNORE_RENEW;
5852 if (!TEST_true(status == SSL_TICKET_SUCCESS
5853 || status == SSL_TICKET_SUCCESS_RENEW))
5854 return SSL_TICKET_RETURN_ABORT;
5856 if (!TEST_true(SSL_SESSION_get0_ticket_appdata(ss, &tickdata,
5858 || !TEST_size_t_eq(tickdlen, strlen(appdata))
5859 || !TEST_int_eq(memcmp(tickdata, appdata, tickdlen), 0))
5860 return SSL_TICKET_RETURN_ABORT;
5862 if (tick_key_cb_called) {
5863 /* Don't change what the ticket key callback wanted to do */
5865 case SSL_TICKET_NO_DECRYPT:
5866 return SSL_TICKET_RETURN_IGNORE_RENEW;
5868 case SSL_TICKET_SUCCESS:
5869 return SSL_TICKET_RETURN_USE;
5871 case SSL_TICKET_SUCCESS_RENEW:
5872 return SSL_TICKET_RETURN_USE_RENEW;
5875 return SSL_TICKET_RETURN_ABORT;
5878 return tick_dec_ret;
5882 static int tick_key_cb(SSL *s, unsigned char key_name[16],
5883 unsigned char iv[EVP_MAX_IV_LENGTH], EVP_CIPHER_CTX *ctx,
5884 HMAC_CTX *hctx, int enc)
5886 const unsigned char tick_aes_key[16] = "0123456789abcdef";
5887 const unsigned char tick_hmac_key[16] = "0123456789abcdef";
5889 tick_key_cb_called = 1;
5890 memset(iv, 0, AES_BLOCK_SIZE);
5891 memset(key_name, 0, 16);
5892 if (!EVP_CipherInit_ex(ctx, EVP_aes_128_cbc(), NULL, tick_aes_key, iv, enc)
5893 || !HMAC_Init_ex(hctx, tick_hmac_key, sizeof(tick_hmac_key),
5894 EVP_sha256(), NULL))
5897 return tick_key_renew ? 2 : 1;
5901 * Test the various ticket callbacks
5902 * Test 0: TLSv1.2, no ticket key callback, no ticket, no renewal
5903 * Test 1: TLSv1.3, no ticket key callback, no ticket, no renewal
5904 * Test 2: TLSv1.2, no ticket key callback, no ticket, renewal
5905 * Test 3: TLSv1.3, no ticket key callback, no ticket, renewal
5906 * Test 4: TLSv1.2, no ticket key callback, ticket, no renewal
5907 * Test 5: TLSv1.3, no ticket key callback, ticket, no renewal
5908 * Test 6: TLSv1.2, no ticket key callback, ticket, renewal
5909 * Test 7: TLSv1.3, no ticket key callback, ticket, renewal
5910 * Test 8: TLSv1.2, ticket key callback, ticket, no renewal
5911 * Test 9: TLSv1.3, ticket key callback, ticket, no renewal
5912 * Test 10: TLSv1.2, ticket key callback, ticket, renewal
5913 * Test 11: TLSv1.3, ticket key callback, ticket, renewal
5915 static int test_ticket_callbacks(int tst)
5917 SSL_CTX *cctx = NULL, *sctx = NULL;
5918 SSL *clientssl = NULL, *serverssl = NULL;
5919 SSL_SESSION *clntsess = NULL;
5922 #ifdef OPENSSL_NO_TLS1_2
5926 #ifdef OPENSSL_NO_TLS1_3
5931 gen_tick_called = dec_tick_called = tick_key_cb_called = 0;
5933 /* Which tests the ticket key callback should request renewal for */
5934 if (tst == 10 || tst == 11)
5939 /* Which tests the decrypt ticket callback should request renewal for */
5943 tick_dec_ret = SSL_TICKET_RETURN_IGNORE;
5948 tick_dec_ret = SSL_TICKET_RETURN_IGNORE_RENEW;
5953 tick_dec_ret = SSL_TICKET_RETURN_USE;
5958 tick_dec_ret = SSL_TICKET_RETURN_USE_RENEW;
5962 tick_dec_ret = SSL_TICKET_RETURN_ABORT;
5965 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
5966 TLS_client_method(),
5968 ((tst % 2) == 0) ? TLS1_2_VERSION
5970 &sctx, &cctx, cert, privkey)))
5974 * We only want sessions to resume from tickets - not the session cache. So
5975 * switch the cache off.
5977 if (!TEST_true(SSL_CTX_set_session_cache_mode(sctx, SSL_SESS_CACHE_OFF)))
5980 if (!TEST_true(SSL_CTX_set_session_ticket_cb(sctx, gen_tick_cb, dec_tick_cb,
5985 && !TEST_true(SSL_CTX_set_tlsext_ticket_key_cb(sctx, tick_key_cb)))
5988 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
5990 || !TEST_true(create_ssl_connection(serverssl, clientssl,
5995 * The decrypt ticket key callback in TLSv1.2 should be called even though
5996 * we have no ticket yet, because it gets called with a status of
5997 * SSL_TICKET_EMPTY (the client indicates support for tickets but does not
5998 * actually send any ticket data). This does not happen in TLSv1.3 because
5999 * it is not valid to send empty ticket data in TLSv1.3.
6001 if (!TEST_int_eq(gen_tick_called, 1)
6002 || !TEST_int_eq(dec_tick_called, ((tst % 2) == 0) ? 1 : 0))
6005 gen_tick_called = dec_tick_called = 0;
6007 clntsess = SSL_get1_session(clientssl);
6008 SSL_shutdown(clientssl);
6009 SSL_shutdown(serverssl);
6010 SSL_free(serverssl);
6011 SSL_free(clientssl);
6012 serverssl = clientssl = NULL;
6014 /* Now do a resumption */
6015 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
6017 || !TEST_true(SSL_set_session(clientssl, clntsess))
6018 || !TEST_true(create_ssl_connection(serverssl, clientssl,
6022 if (tick_dec_ret == SSL_TICKET_RETURN_IGNORE
6023 || tick_dec_ret == SSL_TICKET_RETURN_IGNORE_RENEW) {
6024 if (!TEST_false(SSL_session_reused(clientssl)))
6027 if (!TEST_true(SSL_session_reused(clientssl)))
6031 if (!TEST_int_eq(gen_tick_called,
6033 || tick_dec_ret == SSL_TICKET_RETURN_IGNORE_RENEW
6034 || tick_dec_ret == SSL_TICKET_RETURN_USE_RENEW)
6036 || !TEST_int_eq(dec_tick_called, 1))
6042 SSL_SESSION_free(clntsess);
6043 SSL_free(serverssl);
6044 SSL_free(clientssl);
6052 * Test bi-directional shutdown.
6054 * Test 1: TLSv1.2, server continues to read/write after client shutdown
6055 * Test 2: TLSv1.3, no pending NewSessionTicket messages
6056 * Test 3: TLSv1.3, pending NewSessionTicket messages
6057 * Test 4: TLSv1.3, server continues to read/write after client shutdown, server
6058 * sends key update, client reads it
6059 * Test 5: TLSv1.3, server continues to read/write after client shutdown, server
6060 * sends CertificateRequest, client reads and ignores it
6061 * Test 6: TLSv1.3, server continues to read/write after client shutdown, client
6064 static int test_shutdown(int tst)
6066 SSL_CTX *cctx = NULL, *sctx = NULL;
6067 SSL *clientssl = NULL, *serverssl = NULL;
6069 char msg[] = "A test message";
6071 size_t written, readbytes;
6074 #ifdef OPENSSL_NO_TLS1_2
6078 #ifdef OPENSSL_NO_TLS1_3
6083 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
6084 TLS_client_method(),
6086 (tst <= 1) ? TLS1_2_VERSION
6088 &sctx, &cctx, cert, privkey)))
6092 SSL_CTX_set_post_handshake_auth(cctx, 1);
6094 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
6099 if (!TEST_true(create_bare_ssl_connection(serverssl, clientssl,
6101 || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
6102 || !TEST_false(SSL_SESSION_is_resumable(sess)))
6104 } else if (!TEST_true(create_ssl_connection(serverssl, clientssl,
6106 || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
6107 || !TEST_true(SSL_SESSION_is_resumable(sess))) {
6111 if (!TEST_int_eq(SSL_shutdown(clientssl), 0))
6116 * Reading on the server after the client has sent close_notify should
6117 * fail and provide SSL_ERROR_ZERO_RETURN
6119 if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
6120 || !TEST_int_eq(SSL_get_error(serverssl, 0),
6121 SSL_ERROR_ZERO_RETURN)
6122 || !TEST_int_eq(SSL_get_shutdown(serverssl),
6123 SSL_RECEIVED_SHUTDOWN)
6125 * Even though we're shutdown on receive we should still be
6128 || !TEST_true(SSL_write(serverssl, msg, sizeof(msg))))
6131 && !TEST_true(SSL_key_update(serverssl,
6132 SSL_KEY_UPDATE_REQUESTED)))
6135 SSL_set_verify(serverssl, SSL_VERIFY_PEER, NULL);
6136 if (!TEST_true(SSL_verify_client_post_handshake(serverssl)))
6139 if ((tst == 4 || tst == 5)
6140 && !TEST_true(SSL_write(serverssl, msg, sizeof(msg))))
6142 if (!TEST_int_eq(SSL_shutdown(serverssl), 1))
6144 if (tst == 4 || tst == 5) {
6145 /* Should still be able to read data from server */
6146 if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf),
6148 || !TEST_size_t_eq(readbytes, sizeof(msg))
6149 || !TEST_int_eq(memcmp(msg, buf, readbytes), 0)
6150 || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf),
6152 || !TEST_size_t_eq(readbytes, sizeof(msg))
6153 || !TEST_int_eq(memcmp(msg, buf, readbytes), 0))
6158 /* Writing on the client after sending close_notify shouldn't be possible */
6159 if (!TEST_false(SSL_write_ex(clientssl, msg, sizeof(msg), &written)))
6164 * For these tests the client has sent close_notify but it has not yet
6165 * been received by the server. The server has not sent close_notify
6168 if (!TEST_int_eq(SSL_shutdown(serverssl), 0)
6170 * Writing on the server after sending close_notify shouldn't
6173 || !TEST_false(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
6174 || !TEST_int_eq(SSL_shutdown(clientssl), 1)
6175 || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
6176 || !TEST_true(SSL_SESSION_is_resumable(sess))
6177 || !TEST_int_eq(SSL_shutdown(serverssl), 1))
6179 } else if (tst == 4 || tst == 5) {
6181 * In this test the client has sent close_notify and it has been
6182 * received by the server which has responded with a close_notify. The
6183 * client needs to read the close_notify sent by the server.
6185 if (!TEST_int_eq(SSL_shutdown(clientssl), 1)
6186 || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
6187 || !TEST_true(SSL_SESSION_is_resumable(sess)))
6193 * The client has sent close_notify and is expecting a close_notify
6194 * back, but instead there is application data first. The shutdown
6195 * should fail with a fatal error.
6197 if (!TEST_int_eq(SSL_shutdown(clientssl), -1)
6198 || !TEST_int_eq(SSL_get_error(clientssl, -1), SSL_ERROR_SSL))
6205 SSL_free(serverssl);
6206 SSL_free(clientssl);
6213 #if !defined(OPENSSL_NO_TLS1_2) || !defined(OPENSSL_NO_TLS1_3)
6214 static int cert_cb_cnt;
6216 static int cert_cb(SSL *s, void *arg)
6218 SSL_CTX *ctx = (SSL_CTX *)arg;
6220 if (cert_cb_cnt == 0) {
6221 /* Suspend the handshake */
6224 } else if (cert_cb_cnt == 1) {
6226 * Update the SSL_CTX, set the certificate and private key and then
6227 * continue the handshake normally.
6229 if (ctx != NULL && !TEST_ptr(SSL_set_SSL_CTX(s, ctx)))
6232 if (!TEST_true(SSL_use_certificate_file(s, cert, SSL_FILETYPE_PEM))
6233 || !TEST_true(SSL_use_PrivateKey_file(s, privkey,
6235 || !TEST_true(SSL_check_private_key(s)))
6241 /* Abort the handshake */
6246 * Test the certificate callback.
6247 * Test 0: Callback fails
6248 * Test 1: Success - no SSL_set_SSL_CTX() in the callback
6249 * Test 2: Success - SSL_set_SSL_CTX() in the callback
6251 static int test_cert_cb_int(int prot, int tst)
6253 SSL_CTX *cctx = NULL, *sctx = NULL, *snictx = NULL;
6254 SSL *clientssl = NULL, *serverssl = NULL;
6255 int testresult = 0, ret;
6257 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
6258 TLS_client_method(),
6261 &sctx, &cctx, NULL, NULL)))
6269 snictx = SSL_CTX_new(TLS_server_method());
6270 SSL_CTX_set_cert_cb(sctx, cert_cb, snictx);
6272 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
6276 ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
6277 if (!TEST_true(tst == 0 ? !ret : ret)
6278 || (tst > 0 && !TEST_int_eq(cert_cb_cnt, 2))) {
6285 SSL_free(serverssl);
6286 SSL_free(clientssl);
6289 SSL_CTX_free(snictx);
6295 static int test_cert_cb(int tst)
6299 #ifndef OPENSSL_NO_TLS1_2
6300 testresult &= test_cert_cb_int(TLS1_2_VERSION, tst);
6302 #ifndef OPENSSL_NO_TLS1_3
6303 testresult &= test_cert_cb_int(TLS1_3_VERSION, tst);
6309 static int client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
6315 /* Check that SSL_get_peer_certificate() returns something sensible */
6316 peer = SSL_get_peer_certificate(ssl);
6317 if (!TEST_ptr(peer))
6321 in = BIO_new_file(cert, "r");
6325 xcert = PEM_read_bio_X509(in, NULL, NULL, NULL);
6327 if (!TEST_ptr(xcert))
6330 in = BIO_new_file(privkey, "r");
6331 if (!TEST_ptr(in)) {
6336 privpkey = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL);
6338 if (!TEST_ptr(privpkey)) {
6349 static int verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
6354 static int test_client_cert_cb(int tst)
6356 SSL_CTX *cctx = NULL, *sctx = NULL;
6357 SSL *clientssl = NULL, *serverssl = NULL;
6360 #ifdef OPENSSL_NO_TLS1_2
6364 #ifdef OPENSSL_NO_TLS1_3
6369 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
6370 TLS_client_method(),
6372 tst == 0 ? TLS1_2_VERSION
6374 &sctx, &cctx, cert, privkey)))
6378 * Test that setting a client_cert_cb results in a client certificate being
6381 SSL_CTX_set_client_cert_cb(cctx, client_cert_cb);
6382 SSL_CTX_set_verify(sctx,
6383 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
6386 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
6388 || !TEST_true(create_ssl_connection(serverssl, clientssl,
6395 SSL_free(serverssl);
6396 SSL_free(clientssl);
6403 #if !defined(OPENSSL_NO_TLS1_2) || !defined(OPENSSL_NO_TLS1_3)
6405 * Test setting certificate authorities on both client and server.
6407 * Test 0: SSL_CTX_set0_CA_list() only
6408 * Test 1: Both SSL_CTX_set0_CA_list() and SSL_CTX_set_client_CA_list()
6409 * Test 2: Only SSL_CTX_set_client_CA_list()
6411 static int test_ca_names_int(int prot, int tst)
6413 SSL_CTX *cctx = NULL, *sctx = NULL;
6414 SSL *clientssl = NULL, *serverssl = NULL;
6417 X509_NAME *name[] = { NULL, NULL, NULL, NULL };
6418 char *strnames[] = { "Jack", "Jill", "John", "Joanne" };
6419 STACK_OF(X509_NAME) *sk1 = NULL, *sk2 = NULL;
6420 const STACK_OF(X509_NAME) *sktmp = NULL;
6422 for (i = 0; i < OSSL_NELEM(name); i++) {
6423 name[i] = X509_NAME_new();
6424 if (!TEST_ptr(name[i])
6425 || !TEST_true(X509_NAME_add_entry_by_txt(name[i], "CN",
6433 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
6434 TLS_client_method(),
6437 &sctx, &cctx, cert, privkey)))
6440 SSL_CTX_set_verify(sctx, SSL_VERIFY_PEER, NULL);
6442 if (tst == 0 || tst == 1) {
6443 if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
6444 || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[0])))
6445 || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[1])))
6446 || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
6447 || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[0])))
6448 || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[1]))))
6451 SSL_CTX_set0_CA_list(sctx, sk1);
6452 SSL_CTX_set0_CA_list(cctx, sk2);
6455 if (tst == 1 || tst == 2) {
6456 if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
6457 || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[2])))
6458 || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[3])))
6459 || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
6460 || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[2])))
6461 || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[3]))))
6464 SSL_CTX_set_client_CA_list(sctx, sk1);
6465 SSL_CTX_set_client_CA_list(cctx, sk2);
6469 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
6471 || !TEST_true(create_ssl_connection(serverssl, clientssl,
6476 * We only expect certificate authorities to have been sent to the server
6477 * if we are using TLSv1.3 and SSL_set0_CA_list() was used
6479 sktmp = SSL_get0_peer_CA_list(serverssl);
6480 if (prot == TLS1_3_VERSION
6481 && (tst == 0 || tst == 1)) {
6482 if (!TEST_ptr(sktmp)
6483 || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
6484 || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
6486 || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
6489 } else if (!TEST_ptr_null(sktmp)) {
6494 * In all tests we expect certificate authorities to have been sent to the
6495 * client. However, SSL_set_client_CA_list() should override
6496 * SSL_set0_CA_list()
6498 sktmp = SSL_get0_peer_CA_list(clientssl);
6499 if (!TEST_ptr(sktmp)
6500 || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
6501 || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
6502 name[tst == 0 ? 0 : 2]), 0)
6503 || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
6504 name[tst == 0 ? 1 : 3]), 0))
6510 SSL_free(serverssl);
6511 SSL_free(clientssl);
6514 for (i = 0; i < OSSL_NELEM(name); i++)
6515 X509_NAME_free(name[i]);
6516 sk_X509_NAME_pop_free(sk1, X509_NAME_free);
6517 sk_X509_NAME_pop_free(sk2, X509_NAME_free);
6523 static int test_ca_names(int tst)
6527 #ifndef OPENSSL_NO_TLS1_2
6528 testresult &= test_ca_names_int(TLS1_2_VERSION, tst);
6530 #ifndef OPENSSL_NO_TLS1_3
6531 testresult &= test_ca_names_int(TLS1_3_VERSION, tst);
6538 OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile\n")
6540 int setup_tests(void)
6542 if (!TEST_ptr(cert = test_get_argument(0))
6543 || !TEST_ptr(privkey = test_get_argument(1))
6544 || !TEST_ptr(srpvfile = test_get_argument(2))
6545 || !TEST_ptr(tmpfilename = test_get_argument(3)))
6548 if (getenv("OPENSSL_TEST_GETCOUNTS") != NULL) {
6549 #ifdef OPENSSL_NO_CRYPTO_MDEBUG
6550 TEST_error("not supported in this build");
6553 int i, mcount, rcount, fcount;
6555 for (i = 0; i < 4; i++)
6556 test_export_key_mat(i);
6557 CRYPTO_get_alloc_counts(&mcount, &rcount, &fcount);
6558 test_printf_stdout("malloc %d realloc %d free %d\n",
6559 mcount, rcount, fcount);
6564 #if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_KTLS) \
6565 && !defined(OPENSSL_NO_SOCK)
6566 ADD_TEST(test_ktls_no_txrx_client_no_txrx_server);
6567 ADD_TEST(test_ktls_no_rx_client_no_txrx_server);
6568 ADD_TEST(test_ktls_no_tx_client_no_txrx_server);
6569 ADD_TEST(test_ktls_client_no_txrx_server);
6570 ADD_TEST(test_ktls_no_txrx_client_no_rx_server);
6571 ADD_TEST(test_ktls_no_rx_client_no_rx_server);
6572 ADD_TEST(test_ktls_no_tx_client_no_rx_server);
6573 ADD_TEST(test_ktls_client_no_rx_server);
6574 ADD_TEST(test_ktls_no_txrx_client_no_tx_server);
6575 ADD_TEST(test_ktls_no_rx_client_no_tx_server);
6576 ADD_TEST(test_ktls_no_tx_client_no_tx_server);
6577 ADD_TEST(test_ktls_client_no_tx_server);
6578 ADD_TEST(test_ktls_no_txrx_client_server);
6579 ADD_TEST(test_ktls_no_rx_client_server);
6580 ADD_TEST(test_ktls_no_tx_client_server);
6581 ADD_TEST(test_ktls_client_server);
6582 ADD_TEST(test_ktls_sendfile);
6584 ADD_TEST(test_large_message_tls);
6585 ADD_TEST(test_large_message_tls_read_ahead);
6586 #ifndef OPENSSL_NO_DTLS
6587 ADD_TEST(test_large_message_dtls);
6589 #ifndef OPENSSL_NO_OCSP
6590 ADD_TEST(test_tlsext_status_type);
6592 ADD_TEST(test_session_with_only_int_cache);
6593 ADD_TEST(test_session_with_only_ext_cache);
6594 ADD_TEST(test_session_with_both_cache);
6595 #ifndef OPENSSL_NO_TLS1_3
6596 ADD_ALL_TESTS(test_stateful_tickets, 3);
6597 ADD_ALL_TESTS(test_stateless_tickets, 3);
6598 ADD_TEST(test_psk_tickets);
6600 ADD_ALL_TESTS(test_ssl_set_bio, TOTAL_SSL_SET_BIO_TESTS);
6601 ADD_TEST(test_ssl_bio_pop_next_bio);
6602 ADD_TEST(test_ssl_bio_pop_ssl_bio);
6603 ADD_TEST(test_ssl_bio_change_rbio);
6604 ADD_TEST(test_ssl_bio_change_wbio);
6605 #if !defined(OPENSSL_NO_TLS1_2) || defined(OPENSSL_NO_TLS1_3)
6606 ADD_ALL_TESTS(test_set_sigalgs, OSSL_NELEM(testsigalgs) * 2);
6607 ADD_TEST(test_keylog);
6609 #ifndef OPENSSL_NO_TLS1_3
6610 ADD_TEST(test_keylog_no_master_key);
6612 #ifndef OPENSSL_NO_TLS1_2
6613 ADD_TEST(test_client_hello_cb);
6614 ADD_TEST(test_no_ems);
6616 #ifndef OPENSSL_NO_TLS1_3
6617 ADD_ALL_TESTS(test_early_data_read_write, 3);
6619 * We don't do replay tests for external PSK. Replay protection isn't used
6622 ADD_ALL_TESTS(test_early_data_replay, 2);
6623 ADD_ALL_TESTS(test_early_data_skip, 3);
6624 ADD_ALL_TESTS(test_early_data_skip_hrr, 3);
6625 ADD_ALL_TESTS(test_early_data_skip_hrr_fail, 3);
6626 ADD_ALL_TESTS(test_early_data_skip_abort, 3);
6627 ADD_ALL_TESTS(test_early_data_not_sent, 3);
6628 ADD_ALL_TESTS(test_early_data_psk, 8);
6629 ADD_ALL_TESTS(test_early_data_not_expected, 3);
6630 # ifndef OPENSSL_NO_TLS1_2
6631 ADD_ALL_TESTS(test_early_data_tls1_2, 3);
6634 #ifndef OPENSSL_NO_TLS1_3
6635 ADD_ALL_TESTS(test_set_ciphersuite, 10);
6636 ADD_TEST(test_ciphersuite_change);
6637 #ifdef OPENSSL_NO_PSK
6638 ADD_ALL_TESTS(test_tls13_psk, 1);
6640 ADD_ALL_TESTS(test_tls13_psk, 4);
6641 #endif /* OPENSSL_NO_PSK */
6642 ADD_ALL_TESTS(test_tls13_key_exchange, 4);
6643 ADD_ALL_TESTS(test_custom_exts, 5);
6644 ADD_TEST(test_stateless);
6645 ADD_TEST(test_pha_key_update);
6647 ADD_ALL_TESTS(test_custom_exts, 3);
6649 ADD_ALL_TESTS(test_serverinfo, 8);
6650 ADD_ALL_TESTS(test_export_key_mat, 6);
6651 #ifndef OPENSSL_NO_TLS1_3
6652 ADD_ALL_TESTS(test_export_key_mat_early, 3);
6653 ADD_TEST(test_key_update);
6654 ADD_ALL_TESTS(test_key_update_in_write, 2);
6656 ADD_ALL_TESTS(test_ssl_clear, 2);
6657 ADD_ALL_TESTS(test_max_fragment_len_ext, OSSL_NELEM(max_fragment_len_test));
6658 #if !defined(OPENSSL_NO_SRP) && !defined(OPENSSL_NO_TLS1_2)
6659 ADD_ALL_TESTS(test_srp, 6);
6661 ADD_ALL_TESTS(test_info_callback, 6);
6662 ADD_ALL_TESTS(test_ssl_pending, 2);
6663 ADD_ALL_TESTS(test_ssl_get_shared_ciphers, OSSL_NELEM(shared_ciphers_data));
6664 ADD_ALL_TESTS(test_ticket_callbacks, 12);
6665 ADD_ALL_TESTS(test_shutdown, 7);
6666 ADD_ALL_TESTS(test_cert_cb, 3);
6667 ADD_ALL_TESTS(test_client_cert_cb, 2);
6668 ADD_ALL_TESTS(test_ca_names, 3);
6672 void cleanup_tests(void)
6674 bio_s_mempacket_test_free();
6675 bio_s_always_retry_free();