blob: 3e76aef851b7eb2fa22b854b0c9332adcf881804 [file] [log] [blame]
// Copyright 2021 The Pigweed Authors
//
// Licensed under the Apache License, Version 2.0 (the "License"); you may not
// use this file except in compliance with the License. You may obtain a copy of
// the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
// License for the specific language governing permissions and limitations under
// the License.
#include "pw_tls_client/test/test_server.h"
#include <string>
#include "gtest/gtest.h"
#include "pw_span/span.h"
// The following header contains a set of test certificates and keys.
// It is generated by
// third_party/boringssl/py/boringssl/generate_test_data.py.
#include "test_certs_and_keys.h"
#define ASSERT_OK(expr) ASSERT_EQ(pw::OkStatus(), expr)
namespace pw::tls_client::test {
namespace {
int TestClientBioRead(BIO* bio, char* out, int outl) {
auto read_writer = static_cast<stream::ReaderWriter*>(bio->ptr);
auto res = read_writer->Read(out, outl);
if (!res.ok()) {
return -1;
}
if (res.value().empty()) {
BIO_set_retry_read(bio);
return -1;
}
return res.value().size();
}
int TestClientBioWrite(BIO* bio, const char* in, int inl) {
auto read_writer = static_cast<stream::ReaderWriter*>(bio->ptr);
auto res = read_writer->Write(in, inl);
if (!res.ok()) {
return -1;
}
return inl;
}
int TestClientBioNew(BIO* bio) {
bio->init = 1;
return 1;
}
long TestClientBioCtrl(BIO*, int, long, void*) { return 1; }
int TestClientBioFree(BIO*) { return 1; }
const BIO_METHOD bio_method = {
BIO_TYPE_MEM,
"bio test server test",
TestClientBioWrite,
TestClientBioRead,
nullptr,
nullptr,
TestClientBioCtrl,
TestClientBioNew,
TestClientBioFree,
nullptr,
};
// Server needs to send certificate. Thus the send buffer needs to be bigger.
std::array<std::byte, 4096> server_send_buffer;
std::array<std::byte, 512> server_receive_buffer;
// Create a raw BoringSSL client and load test trust anchors.
void CreateSSLClient(bssl::UniquePtr<SSL_CTX>* ctx,
bssl::UniquePtr<SSL>* client,
stream::ReaderWriter* read_writer) {
*ctx = bssl::UniquePtr<SSL_CTX>(SSL_CTX_new(TLS_method()));
ASSERT_NE(*ctx, nullptr);
*client = bssl::UniquePtr<SSL>(SSL_new(ctx->get()));
ASSERT_NE(*client, nullptr);
BIO* bio = BIO_new(&bio_method);
ASSERT_NE(bio, nullptr);
// Load trust anchors to client
auto store = SSL_CTX_get_cert_store(ctx->get());
X509_VERIFY_PARAM_clear_flags(store->param, X509_V_FLAG_USE_CHECK_TIME);
const pw::ConstByteSpan kTrustAnchors[] = {kRootACert, kRootBCert};
for (auto cert : kTrustAnchors) {
auto res = ParseDerCertificate(cert);
ASSERT_OK(res.status());
ASSERT_EQ(X509_STORE_add_cert(store, res.value()), 1);
X509_free(res.value());
}
bio->ptr = read_writer;
SSL_set_bio(client->get(), bio, bio);
}
} // namespace
TEST(InMemoryTestServer, NormalConnectionSucceed) {
InMemoryTestServer server(server_receive_buffer, server_send_buffer);
const ConstByteSpan kIntermediates[] = {kSubCACert};
ASSERT_OK(server.Initialize(kServerKey, kServerCert, kIntermediates));
// Create a raw BoringSSL client
bssl::UniquePtr<SSL_CTX> client_ctx;
bssl::UniquePtr<SSL> ssl_client;
CreateSSLClient(&client_ctx, &ssl_client, &server);
// Handshake should be OK
ASSERT_EQ(SSL_connect(ssl_client.get()), 1);
ASSERT_TRUE(server.SessionEstablished());
// Client should pass certificate verification.
ASSERT_EQ(SSL_get_verify_result(ssl_client.get()), 0);
// Send some data to server
const char send_expected[] = "hello";
int send_len =
SSL_write(ssl_client.get(), send_expected, sizeof(send_expected));
ASSERT_EQ(static_cast<size_t>(send_len), sizeof(send_expected));
char receive_actual[sizeof(send_expected) + 1] = {0};
int read_ret =
SSL_read(ssl_client.get(), receive_actual, sizeof(receive_actual));
ASSERT_EQ(static_cast<size_t>(read_ret), sizeof(send_expected));
ASSERT_STREQ(send_expected, receive_actual);
// Shutdown
EXPECT_FALSE(server.ClientShutdownReceived());
ASSERT_NE(SSL_shutdown(ssl_client.get()), -1);
ASSERT_TRUE(server.ClientShutdownReceived());
}
TEST(InMemoryTestServer, BufferTooSmallErrorsOut) {
std::array<std::byte, 1> insufficient_buffer;
InMemoryTestServer server(server_receive_buffer, insufficient_buffer);
const ConstByteSpan kIntermediates[] = {kSubCACert};
ASSERT_OK(server.Initialize(kServerKey, kServerCert, kIntermediates));
// Create a raw BoringSSL client
bssl::UniquePtr<SSL_CTX> client_ctx;
bssl::UniquePtr<SSL> ssl_client;
CreateSSLClient(&client_ctx, &ssl_client, &server);
// Handshake should fail as server shouldn't have enough buffer
ASSERT_NE(SSL_connect(ssl_client.get()), 1);
ASSERT_EQ(server.GetLastBioStatus(), Status::ResourceExhausted());
}
} // namespace pw::tls_client::test