| /* BEGIN_HEADER */ |
| #include <mbedtls/ssl.h> |
| #include <mbedtls/ssl_internal.h> |
| |
| /* |
| * Helper function setting up inverse record transformations |
| * using given cipher, hash, EtM mode, authentication tag length, |
| * and version. |
| */ |
| |
| #define CHK( x ) \ |
| do \ |
| { \ |
| if( !( x ) ) \ |
| { \ |
| ret = -1; \ |
| goto cleanup; \ |
| } \ |
| } while( 0 ) |
| |
| #if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX |
| #define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_IN_LEN_MAX |
| #else |
| #define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_OUT_LEN_MAX |
| #endif |
| |
| static int build_transforms( mbedtls_ssl_transform *t_in, |
| mbedtls_ssl_transform *t_out, |
| int cipher_type, int hash_id, |
| int etm, int tag_mode, int ver, |
| size_t cid0_len, |
| size_t cid1_len ) |
| { |
| mbedtls_cipher_info_t const *cipher_info; |
| int ret = 0; |
| |
| size_t keylen, maclen, ivlen; |
| unsigned char *key0 = NULL, *key1 = NULL; |
| unsigned char iv_enc[16], iv_dec[16]; |
| |
| #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
| unsigned char cid0[ SSL_CID_LEN_MIN ]; |
| unsigned char cid1[ SSL_CID_LEN_MIN ]; |
| |
| rnd_std_rand( NULL, cid0, sizeof( cid0 ) ); |
| rnd_std_rand( NULL, cid1, sizeof( cid1 ) ); |
| #else |
| ((void) cid0_len); |
| ((void) cid1_len); |
| #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
| |
| maclen = 0; |
| |
| /* Pick cipher */ |
| cipher_info = mbedtls_cipher_info_from_type( cipher_type ); |
| CHK( cipher_info != NULL ); |
| CHK( cipher_info->iv_size <= 16 ); |
| CHK( cipher_info->key_bitlen % 8 == 0 ); |
| |
| /* Pick keys */ |
| keylen = cipher_info->key_bitlen / 8; |
| /* Allocate `keylen + 1` bytes to ensure that we get |
| * a non-NULL pointers from `mbedtls_calloc` even if |
| * `keylen == 0` in the case of the NULL cipher. */ |
| CHK( ( key0 = mbedtls_calloc( 1, keylen + 1 ) ) != NULL ); |
| CHK( ( key1 = mbedtls_calloc( 1, keylen + 1 ) ) != NULL ); |
| memset( key0, 0x1, keylen ); |
| memset( key1, 0x2, keylen ); |
| |
| /* Setup cipher contexts */ |
| CHK( mbedtls_cipher_setup( &t_in->cipher_ctx_enc, cipher_info ) == 0 ); |
| CHK( mbedtls_cipher_setup( &t_in->cipher_ctx_dec, cipher_info ) == 0 ); |
| CHK( mbedtls_cipher_setup( &t_out->cipher_ctx_enc, cipher_info ) == 0 ); |
| CHK( mbedtls_cipher_setup( &t_out->cipher_ctx_dec, cipher_info ) == 0 ); |
| |
| #if defined(MBEDTLS_CIPHER_MODE_CBC) |
| if( cipher_info->mode == MBEDTLS_MODE_CBC ) |
| { |
| CHK( mbedtls_cipher_set_padding_mode( &t_in->cipher_ctx_enc, |
| MBEDTLS_PADDING_NONE ) == 0 ); |
| CHK( mbedtls_cipher_set_padding_mode( &t_in->cipher_ctx_dec, |
| MBEDTLS_PADDING_NONE ) == 0 ); |
| CHK( mbedtls_cipher_set_padding_mode( &t_out->cipher_ctx_enc, |
| MBEDTLS_PADDING_NONE ) == 0 ); |
| CHK( mbedtls_cipher_set_padding_mode( &t_out->cipher_ctx_dec, |
| MBEDTLS_PADDING_NONE ) == 0 ); |
| } |
| #endif /* MBEDTLS_CIPHER_MODE_CBC */ |
| |
| CHK( mbedtls_cipher_setkey( &t_in->cipher_ctx_enc, key0, |
| keylen << 3, MBEDTLS_ENCRYPT ) == 0 ); |
| CHK( mbedtls_cipher_setkey( &t_in->cipher_ctx_dec, key1, |
| keylen << 3, MBEDTLS_DECRYPT ) == 0 ); |
| CHK( mbedtls_cipher_setkey( &t_out->cipher_ctx_enc, key1, |
| keylen << 3, MBEDTLS_ENCRYPT ) == 0 ); |
| CHK( mbedtls_cipher_setkey( &t_out->cipher_ctx_dec, key0, |
| keylen << 3, MBEDTLS_DECRYPT ) == 0 ); |
| |
| /* Setup MAC contexts */ |
| #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) |
| if( cipher_info->mode == MBEDTLS_MODE_CBC || |
| cipher_info->mode == MBEDTLS_MODE_STREAM ) |
| { |
| mbedtls_md_info_t const *md_info; |
| unsigned char *md0, *md1; |
| |
| /* Pick hash */ |
| md_info = mbedtls_md_info_from_type( hash_id ); |
| CHK( md_info != NULL ); |
| |
| /* Pick hash keys */ |
| maclen = mbedtls_md_get_size( md_info ); |
| CHK( ( md0 = mbedtls_calloc( 1, maclen ) ) != NULL ); |
| CHK( ( md1 = mbedtls_calloc( 1, maclen ) ) != NULL ); |
| memset( md0, 0x5, maclen ); |
| memset( md1, 0x6, maclen ); |
| |
| CHK( mbedtls_md_setup( &t_out->md_ctx_enc, md_info, 1 ) == 0 ); |
| CHK( mbedtls_md_setup( &t_out->md_ctx_dec, md_info, 1 ) == 0 ); |
| CHK( mbedtls_md_setup( &t_in->md_ctx_enc, md_info, 1 ) == 0 ); |
| CHK( mbedtls_md_setup( &t_in->md_ctx_dec, md_info, 1 ) == 0 ); |
| |
| if( ver > MBEDTLS_SSL_MINOR_VERSION_0 ) |
| { |
| CHK( mbedtls_md_hmac_starts( &t_in->md_ctx_enc, |
| md0, maclen ) == 0 ); |
| CHK( mbedtls_md_hmac_starts( &t_in->md_ctx_dec, |
| md1, maclen ) == 0 ); |
| CHK( mbedtls_md_hmac_starts( &t_out->md_ctx_enc, |
| md1, maclen ) == 0 ); |
| CHK( mbedtls_md_hmac_starts( &t_out->md_ctx_dec, |
| md0, maclen ) == 0 ); |
| } |
| #if defined(MBEDTLS_SSL_PROTO_SSL3) |
| else |
| { |
| memcpy( &t_in->mac_enc, md0, maclen ); |
| memcpy( &t_in->mac_dec, md1, maclen ); |
| memcpy( &t_out->mac_enc, md1, maclen ); |
| memcpy( &t_out->mac_dec, md0, maclen ); |
| } |
| #endif |
| |
| mbedtls_free( md0 ); |
| mbedtls_free( md1 ); |
| } |
| #else |
| ((void) hash_id); |
| #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ |
| |
| |
| /* Pick IV's (regardless of whether they |
| * are being used by the transform). */ |
| ivlen = cipher_info->iv_size; |
| memset( iv_enc, 0x3, sizeof( iv_enc ) ); |
| memset( iv_dec, 0x4, sizeof( iv_dec ) ); |
| |
| /* |
| * Setup transforms |
| */ |
| |
| #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \ |
| defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) |
| t_out->encrypt_then_mac = etm; |
| t_in->encrypt_then_mac = etm; |
| #else |
| ((void) etm); |
| #endif |
| |
| t_out->minor_ver = ver; |
| t_in->minor_ver = ver; |
| t_out->ivlen = ivlen; |
| t_in->ivlen = ivlen; |
| |
| switch( cipher_info->mode ) |
| { |
| case MBEDTLS_MODE_GCM: |
| case MBEDTLS_MODE_CCM: |
| t_out->fixed_ivlen = 4; |
| t_in->fixed_ivlen = 4; |
| t_out->maclen = 0; |
| t_in->maclen = 0; |
| switch( tag_mode ) |
| { |
| case 0: /* Full tag */ |
| t_out->taglen = 16; |
| t_in->taglen = 16; |
| break; |
| case 1: /* Partial tag */ |
| t_out->taglen = 8; |
| t_in->taglen = 8; |
| break; |
| default: |
| return( 1 ); |
| } |
| break; |
| |
| case MBEDTLS_MODE_CHACHAPOLY: |
| t_out->fixed_ivlen = 12; |
| t_in->fixed_ivlen = 12; |
| t_out->maclen = 0; |
| t_in->maclen = 0; |
| switch( tag_mode ) |
| { |
| case 0: /* Full tag */ |
| t_out->taglen = 16; |
| t_in->taglen = 16; |
| break; |
| case 1: /* Partial tag */ |
| t_out->taglen = 8; |
| t_in->taglen = 8; |
| break; |
| default: |
| return( 1 ); |
| } |
| break; |
| |
| case MBEDTLS_MODE_STREAM: |
| case MBEDTLS_MODE_CBC: |
| t_out->fixed_ivlen = 0; /* redundant, must be 0 */ |
| t_in->fixed_ivlen = 0; /* redundant, must be 0 */ |
| t_out->taglen = 0; |
| t_in->taglen = 0; |
| switch( tag_mode ) |
| { |
| case 0: /* Full tag */ |
| t_out->maclen = maclen; |
| t_in->maclen = maclen; |
| break; |
| case 1: /* Partial tag */ |
| t_out->maclen = 10; |
| t_in->maclen = 10; |
| break; |
| default: |
| return( 1 ); |
| } |
| break; |
| default: |
| return( 1 ); |
| break; |
| } |
| |
| /* Setup IV's */ |
| |
| memcpy( &t_in->iv_dec, iv_dec, sizeof( iv_dec ) ); |
| memcpy( &t_in->iv_enc, iv_enc, sizeof( iv_enc ) ); |
| memcpy( &t_out->iv_dec, iv_enc, sizeof( iv_enc ) ); |
| memcpy( &t_out->iv_enc, iv_dec, sizeof( iv_dec ) ); |
| |
| #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
| /* Add CID */ |
| memcpy( &t_in->in_cid, cid0, cid0_len ); |
| memcpy( &t_in->out_cid, cid1, cid1_len ); |
| t_in->in_cid_len = cid0_len; |
| t_in->out_cid_len = cid1_len; |
| memcpy( &t_out->in_cid, cid1, cid1_len ); |
| memcpy( &t_out->out_cid, cid0, cid0_len ); |
| t_out->in_cid_len = cid1_len; |
| t_out->out_cid_len = cid0_len; |
| #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
| |
| cleanup: |
| |
| mbedtls_free( key0 ); |
| mbedtls_free( key1 ); |
| |
| return( ret ); |
| } |
| |
| /* |
| * Populate a session structure for serialization tests. |
| * Choose dummy values, mostly non-0 to distinguish from the init default. |
| */ |
| static int ssl_populate_session( mbedtls_ssl_session *session, |
| int ticket_len, |
| const char *crt_file ) |
| { |
| #if defined(MBEDTLS_HAVE_TIME) |
| session->start = mbedtls_time( NULL ) - 42; |
| #endif |
| session->ciphersuite = 0xabcd; |
| session->compression = 1; |
| session->id_len = sizeof( session->id ); |
| memset( session->id, 66, session->id_len ); |
| memset( session->master, 17, sizeof( session->master ) ); |
| |
| #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_FS_IO) |
| if( strlen( crt_file ) != 0 ) |
| { |
| mbedtls_x509_crt tmp_crt; |
| int ret; |
| |
| mbedtls_x509_crt_init( &tmp_crt ); |
| ret = mbedtls_x509_crt_parse_file( &tmp_crt, crt_file ); |
| if( ret != 0 ) |
| return( ret ); |
| |
| #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
| /* Move temporary CRT. */ |
| session->peer_cert = mbedtls_calloc( 1, sizeof( *session->peer_cert ) ); |
| if( session->peer_cert == NULL ) |
| return( -1 ); |
| *session->peer_cert = tmp_crt; |
| memset( &tmp_crt, 0, sizeof( tmp_crt ) ); |
| #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
| /* Calculate digest of temporary CRT. */ |
| session->peer_cert_digest = |
| mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ); |
| if( session->peer_cert_digest == NULL ) |
| return( -1 ); |
| ret = mbedtls_md( mbedtls_md_info_from_type( |
| MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ), |
| tmp_crt.raw.p, tmp_crt.raw.len, |
| session->peer_cert_digest ); |
| if( ret != 0 ) |
| return( ret ); |
| session->peer_cert_digest_type = |
| MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE; |
| session->peer_cert_digest_len = |
| MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN; |
| #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
| |
| mbedtls_x509_crt_free( &tmp_crt ); |
| } |
| #else /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_FS_IO */ |
| (void) crt_file; |
| #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_FS_IO */ |
| session->verify_result = 0xdeadbeef; |
| |
| #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) |
| if( ticket_len != 0 ) |
| { |
| session->ticket = mbedtls_calloc( 1, ticket_len ); |
| if( session->ticket == NULL ) |
| return( -1 ); |
| memset( session->ticket, 33, ticket_len ); |
| } |
| session->ticket_len = ticket_len; |
| session->ticket_lifetime = 86401; |
| #else |
| (void) ticket_len; |
| #endif |
| |
| #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
| session->mfl_code = 1; |
| #endif |
| #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
| session->trunc_hmac = 1; |
| #endif |
| #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| session->encrypt_then_mac = 1; |
| #endif |
| |
| return( 0 ); |
| } |
| |
| /* END_HEADER */ |
| |
| /* BEGIN_DEPENDENCIES |
| * depends_on:MBEDTLS_SSL_TLS_C |
| * END_DEPENDENCIES |
| */ |
| |
| /* BEGIN_CASE depends_on:MBEDTLS_SSL_DTLS_ANTI_REPLAY */ |
| void ssl_dtls_replay( data_t * prevs, data_t * new, int ret ) |
| { |
| uint32_t len = 0; |
| mbedtls_ssl_context ssl; |
| mbedtls_ssl_config conf; |
| |
| mbedtls_ssl_init( &ssl ); |
| mbedtls_ssl_config_init( &conf ); |
| |
| TEST_ASSERT( mbedtls_ssl_config_defaults( &conf, |
| MBEDTLS_SSL_IS_CLIENT, |
| MBEDTLS_SSL_TRANSPORT_DATAGRAM, |
| MBEDTLS_SSL_PRESET_DEFAULT ) == 0 ); |
| TEST_ASSERT( mbedtls_ssl_setup( &ssl, &conf ) == 0 ); |
| |
| /* Read previous record numbers */ |
| for( len = 0; len < prevs->len; len += 6 ) |
| { |
| memcpy( ssl.in_ctr + 2, prevs->x + len, 6 ); |
| mbedtls_ssl_dtls_replay_update( &ssl ); |
| } |
| |
| /* Check new number */ |
| memcpy( ssl.in_ctr + 2, new->x, 6 ); |
| TEST_ASSERT( mbedtls_ssl_dtls_replay_check( &ssl ) == ret ); |
| |
| mbedtls_ssl_free( &ssl ); |
| mbedtls_ssl_config_free( &conf ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */ |
| void ssl_set_hostname_twice( char *hostname0, char *hostname1 ) |
| { |
| mbedtls_ssl_context ssl; |
| mbedtls_ssl_init( &ssl ); |
| |
| TEST_ASSERT( mbedtls_ssl_set_hostname( &ssl, hostname0 ) == 0 ); |
| TEST_ASSERT( mbedtls_ssl_set_hostname( &ssl, hostname1 ) == 0 ); |
| |
| mbedtls_ssl_free( &ssl ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE */ |
| void ssl_crypt_record( int cipher_type, int hash_id, |
| int etm, int tag_mode, int ver, |
| int cid0_len, int cid1_len ) |
| { |
| /* |
| * Test several record encryptions and decryptions |
| * with plenty of space before and after the data |
| * within the record buffer. |
| */ |
| |
| int ret; |
| int num_records = 16; |
| mbedtls_ssl_context ssl; /* ONLY for debugging */ |
| |
| mbedtls_ssl_transform t0, t1; |
| unsigned char *buf = NULL; |
| size_t const buflen = 512; |
| mbedtls_record rec, rec_backup; |
| |
| mbedtls_ssl_init( &ssl ); |
| mbedtls_ssl_transform_init( &t0 ); |
| mbedtls_ssl_transform_init( &t1 ); |
| TEST_ASSERT( build_transforms( &t0, &t1, cipher_type, hash_id, |
| etm, tag_mode, ver, |
| (size_t) cid0_len, |
| (size_t) cid1_len ) == 0 ); |
| |
| TEST_ASSERT( ( buf = mbedtls_calloc( 1, buflen ) ) != NULL ); |
| |
| while( num_records-- > 0 ) |
| { |
| mbedtls_ssl_transform *t_dec, *t_enc; |
| /* Take turns in who's sending and who's receiving. */ |
| if( num_records % 3 == 0 ) |
| { |
| t_dec = &t0; |
| t_enc = &t1; |
| } |
| else |
| { |
| t_dec = &t1; |
| t_enc = &t0; |
| } |
| |
| /* |
| * The record header affects the transformation in two ways: |
| * 1) It determines the AEAD additional data |
| * 2) The record counter sometimes determines the IV. |
| * |
| * Apart from that, the fields don't have influence. |
| * In particular, it is currently not the responsibility |
| * of ssl_encrypt/decrypt_buf to check if the transform |
| * version matches the record version, or that the |
| * type is sensible. |
| */ |
| |
| memset( rec.ctr, num_records, sizeof( rec.ctr ) ); |
| rec.type = 42; |
| rec.ver[0] = num_records; |
| rec.ver[1] = num_records; |
| #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
| rec.cid_len = 0; |
| #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
| |
| rec.buf = buf; |
| rec.buf_len = buflen; |
| rec.data_offset = 16; |
| /* Make sure to vary the length to exercise different |
| * paddings. */ |
| rec.data_len = 1 + num_records; |
| |
| memset( rec.buf + rec.data_offset, 42, rec.data_len ); |
| |
| /* Make a copy for later comparison */ |
| rec_backup = rec; |
| |
| /* Encrypt record */ |
| ret = mbedtls_ssl_encrypt_buf( &ssl, t_enc, &rec, |
| rnd_std_rand, NULL ); |
| TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
| if( ret != 0 ) |
| { |
| continue; |
| } |
| |
| /* Decrypt record with t_dec */ |
| ret = mbedtls_ssl_decrypt_buf( &ssl, t_dec, &rec ); |
| TEST_ASSERT( ret == 0 ); |
| |
| /* Compare results */ |
| TEST_ASSERT( rec.type == rec_backup.type ); |
| TEST_ASSERT( memcmp( rec.ctr, rec_backup.ctr, 8 ) == 0 ); |
| TEST_ASSERT( rec.ver[0] == rec_backup.ver[0] ); |
| TEST_ASSERT( rec.ver[1] == rec_backup.ver[1] ); |
| TEST_ASSERT( rec.data_len == rec_backup.data_len ); |
| TEST_ASSERT( rec.data_offset == rec_backup.data_offset ); |
| TEST_ASSERT( memcmp( rec.buf + rec.data_offset, |
| rec_backup.buf + rec_backup.data_offset, |
| rec.data_len ) == 0 ); |
| } |
| |
| exit: |
| |
| /* Cleanup */ |
| mbedtls_ssl_free( &ssl ); |
| mbedtls_ssl_transform_free( &t0 ); |
| mbedtls_ssl_transform_free( &t1 ); |
| |
| mbedtls_free( buf ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE */ |
| void ssl_crypt_record_small( int cipher_type, int hash_id, |
| int etm, int tag_mode, int ver, |
| int cid0_len, int cid1_len ) |
| { |
| /* |
| * Test pairs of encryption and decryption with an increasing |
| * amount of space in the record buffer - in more detail: |
| * 1) Try to encrypt with 0, 1, 2, ... bytes available |
| * in front of the plaintext, and expect the encryption |
| * to succeed starting from some offset. Always keep |
| * enough space in the end of the buffer. |
| * 2) Try to encrypt with 0, 1, 2, ... bytes available |
| * at the end of the plaintext, and expect the encryption |
| * to succeed starting from some offset. Always keep |
| * enough space at the beginning of the buffer. |
| * 3) Try to encrypt with 0, 1, 2, ... bytes available |
| * both at the front and end of the plaintext, |
| * and expect the encryption to succeed starting from |
| * some offset. |
| * |
| * If encryption succeeds, check that decryption succeeds |
| * and yields the original record. |
| */ |
| |
| mbedtls_ssl_context ssl; /* ONLY for debugging */ |
| |
| mbedtls_ssl_transform t0, t1; |
| unsigned char *buf = NULL; |
| size_t const buflen = 256; |
| mbedtls_record rec, rec_backup; |
| |
| int ret; |
| int mode; /* Mode 1, 2 or 3 as explained above */ |
| size_t offset; /* Available space at beginning/end/both */ |
| size_t threshold = 96; /* Maximum offset to test against */ |
| |
| size_t default_pre_padding = 64; /* Pre-padding to use in mode 2 */ |
| size_t default_post_padding = 128; /* Post-padding to use in mode 1 */ |
| |
| int seen_success; /* Indicates if in the current mode we've |
| * already seen a successful test. */ |
| |
| mbedtls_ssl_init( &ssl ); |
| mbedtls_ssl_transform_init( &t0 ); |
| mbedtls_ssl_transform_init( &t1 ); |
| TEST_ASSERT( build_transforms( &t0, &t1, cipher_type, hash_id, |
| etm, tag_mode, ver, |
| (size_t) cid0_len, |
| (size_t) cid1_len ) == 0 ); |
| |
| TEST_ASSERT( ( buf = mbedtls_calloc( 1, buflen ) ) != NULL ); |
| |
| for( mode=1; mode <= 3; mode++ ) |
| { |
| seen_success = 0; |
| for( offset=0; offset <= threshold; offset++ ) |
| { |
| mbedtls_ssl_transform *t_dec, *t_enc; |
| t_dec = &t0; |
| t_enc = &t1; |
| |
| memset( rec.ctr, offset, sizeof( rec.ctr ) ); |
| rec.type = 42; |
| rec.ver[0] = offset; |
| rec.ver[1] = offset; |
| rec.buf = buf; |
| rec.buf_len = buflen; |
| #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
| rec.cid_len = 0; |
| #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
| |
| switch( mode ) |
| { |
| case 1: /* Space in the beginning */ |
| rec.data_offset = offset; |
| rec.data_len = buflen - offset - default_post_padding; |
| break; |
| |
| case 2: /* Space in the end */ |
| rec.data_offset = default_pre_padding; |
| rec.data_len = buflen - default_pre_padding - offset; |
| break; |
| |
| case 3: /* Space in the beginning and end */ |
| rec.data_offset = offset; |
| rec.data_len = buflen - 2 * offset; |
| break; |
| |
| default: |
| TEST_ASSERT( 0 ); |
| break; |
| } |
| |
| memset( rec.buf + rec.data_offset, 42, rec.data_len ); |
| |
| /* Make a copy for later comparison */ |
| rec_backup = rec; |
| |
| /* Encrypt record */ |
| ret = mbedtls_ssl_encrypt_buf( &ssl, t_enc, &rec, rnd_std_rand, NULL ); |
| |
| if( ( mode == 1 || mode == 2 ) && seen_success ) |
| { |
| TEST_ASSERT( ret == 0 ); |
| } |
| else |
| { |
| TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
| if( ret == 0 ) |
| seen_success = 1; |
| } |
| |
| if( ret != 0 ) |
| continue; |
| |
| /* Decrypt record with t_dec */ |
| TEST_ASSERT( mbedtls_ssl_decrypt_buf( &ssl, t_dec, &rec ) == 0 ); |
| |
| /* Compare results */ |
| TEST_ASSERT( rec.type == rec_backup.type ); |
| TEST_ASSERT( memcmp( rec.ctr, rec_backup.ctr, 8 ) == 0 ); |
| TEST_ASSERT( rec.ver[0] == rec_backup.ver[0] ); |
| TEST_ASSERT( rec.ver[1] == rec_backup.ver[1] ); |
| TEST_ASSERT( rec.data_len == rec_backup.data_len ); |
| TEST_ASSERT( rec.data_offset == rec_backup.data_offset ); |
| TEST_ASSERT( memcmp( rec.buf + rec.data_offset, |
| rec_backup.buf + rec_backup.data_offset, |
| rec.data_len ) == 0 ); |
| } |
| |
| TEST_ASSERT( seen_success == 1 ); |
| } |
| |
| exit: |
| |
| /* Cleanup */ |
| mbedtls_ssl_free( &ssl ); |
| mbedtls_ssl_transform_free( &t0 ); |
| mbedtls_ssl_transform_free( &t1 ); |
| |
| mbedtls_free( buf ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE */ |
| void ssl_tls_prf( int type, data_t * secret, data_t * random, |
| char *label, data_t *result_hex_str, int exp_ret ) |
| { |
| unsigned char *output; |
| |
| output = mbedtls_calloc( 1, result_hex_str->len ); |
| if( output == NULL ) |
| goto exit; |
| |
| #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| TEST_ASSERT( psa_crypto_init() == 0 ); |
| #endif |
| |
| TEST_ASSERT( mbedtls_ssl_tls_prf( type, secret->x, secret->len, |
| label, random->x, random->len, |
| output, result_hex_str->len ) == exp_ret ); |
| |
| if( exp_ret == 0 ) |
| { |
| TEST_ASSERT( hexcmp( output, result_hex_str->x, |
| result_hex_str->len, result_hex_str->len ) == 0 ); |
| } |
| exit: |
| |
| mbedtls_free( output ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE */ |
| void ssl_serialize_session_save_load( int ticket_len, char *crt_file ) |
| { |
| mbedtls_ssl_session original, restored; |
| unsigned char *buf = NULL; |
| size_t len; |
| |
| /* |
| * Test that a save-load pair is the identity |
| */ |
| |
| mbedtls_ssl_session_init( &original ); |
| mbedtls_ssl_session_init( &restored ); |
| |
| /* Prepare a dummy session to work on */ |
| TEST_ASSERT( ssl_populate_session( &original, ticket_len, crt_file ) == 0 ); |
| |
| /* Serialize it */ |
| TEST_ASSERT( mbedtls_ssl_session_save( &original, NULL, 0, &len ) |
| == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
| TEST_ASSERT( ( buf = mbedtls_calloc( 1, len ) ) != NULL ); |
| TEST_ASSERT( mbedtls_ssl_session_save( &original, buf, len, &len ) |
| == 0 ); |
| |
| /* Restore session from serialized data */ |
| TEST_ASSERT( mbedtls_ssl_session_load( &restored, buf, len) == 0 ); |
| |
| /* |
| * Make sure both session structures are identical |
| */ |
| #if defined(MBEDTLS_HAVE_TIME) |
| TEST_ASSERT( original.start == restored.start ); |
| #endif |
| TEST_ASSERT( original.ciphersuite == restored.ciphersuite ); |
| TEST_ASSERT( original.compression == restored.compression ); |
| TEST_ASSERT( original.id_len == restored.id_len ); |
| TEST_ASSERT( memcmp( original.id, |
| restored.id, sizeof( original.id ) ) == 0 ); |
| TEST_ASSERT( memcmp( original.master, |
| restored.master, sizeof( original.master ) ) == 0 ); |
| |
| #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
| TEST_ASSERT( ( original.peer_cert == NULL ) == |
| ( restored.peer_cert == NULL ) ); |
| if( original.peer_cert != NULL ) |
| { |
| TEST_ASSERT( original.peer_cert->raw.len == |
| restored.peer_cert->raw.len ); |
| TEST_ASSERT( memcmp( original.peer_cert->raw.p, |
| restored.peer_cert->raw.p, |
| original.peer_cert->raw.len ) == 0 ); |
| } |
| #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
| TEST_ASSERT( original.peer_cert_digest_type == |
| restored.peer_cert_digest_type ); |
| TEST_ASSERT( original.peer_cert_digest_len == |
| restored.peer_cert_digest_len ); |
| TEST_ASSERT( ( original.peer_cert_digest == NULL ) == |
| ( restored.peer_cert_digest == NULL ) ); |
| if( original.peer_cert_digest != NULL ) |
| { |
| TEST_ASSERT( memcmp( original.peer_cert_digest, |
| restored.peer_cert_digest, |
| original.peer_cert_digest_len ) == 0 ); |
| } |
| #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
| #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
| TEST_ASSERT( original.verify_result == restored.verify_result ); |
| |
| #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) |
| TEST_ASSERT( original.ticket_len == restored.ticket_len ); |
| if( original.ticket_len != 0 ) |
| { |
| TEST_ASSERT( original.ticket != NULL ); |
| TEST_ASSERT( restored.ticket != NULL ); |
| TEST_ASSERT( memcmp( original.ticket, |
| restored.ticket, original.ticket_len ) == 0 ); |
| } |
| TEST_ASSERT( original.ticket_lifetime == restored.ticket_lifetime ); |
| #endif |
| |
| #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
| TEST_ASSERT( original.mfl_code == restored.mfl_code ); |
| #endif |
| |
| #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
| TEST_ASSERT( original.trunc_hmac == restored.trunc_hmac ); |
| #endif |
| |
| #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| TEST_ASSERT( original.encrypt_then_mac == restored.encrypt_then_mac ); |
| #endif |
| |
| exit: |
| mbedtls_ssl_session_free( &original ); |
| mbedtls_ssl_session_free( &restored ); |
| mbedtls_free( buf ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE */ |
| void ssl_serialize_session_load_save( int ticket_len, char *crt_file ) |
| { |
| mbedtls_ssl_session session; |
| unsigned char *buf1 = NULL, *buf2 = NULL; |
| size_t len0, len1, len2; |
| |
| /* |
| * Test that a load-save pair is the identity |
| */ |
| |
| mbedtls_ssl_session_init( &session ); |
| |
| /* Prepare a dummy session to work on */ |
| TEST_ASSERT( ssl_populate_session( &session, ticket_len, crt_file ) == 0 ); |
| |
| /* Get desired buffer size for serializing */ |
| TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &len0 ) |
| == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
| |
| /* Allocate first buffer */ |
| buf1 = mbedtls_calloc( 1, len0 ); |
| TEST_ASSERT( buf1 != NULL ); |
| |
| /* Serialize to buffer and free live session */ |
| TEST_ASSERT( mbedtls_ssl_session_save( &session, buf1, len0, &len1 ) |
| == 0 ); |
| TEST_ASSERT( len0 == len1 ); |
| mbedtls_ssl_session_free( &session ); |
| |
| /* Restore session from serialized data */ |
| TEST_ASSERT( mbedtls_ssl_session_load( &session, buf1, len1 ) == 0 ); |
| |
| /* Allocate second buffer and serialize to it */ |
| buf2 = mbedtls_calloc( 1, len0 ); |
| TEST_ASSERT( buf2 != NULL ); |
| TEST_ASSERT( mbedtls_ssl_session_save( &session, buf2, len0, &len2 ) |
| == 0 ); |
| |
| /* Make sure both serialized versions are identical */ |
| TEST_ASSERT( len1 == len2 ); |
| TEST_ASSERT( memcmp( buf1, buf2, len1 ) == 0 ); |
| |
| exit: |
| mbedtls_ssl_session_free( &session ); |
| mbedtls_free( buf1 ); |
| mbedtls_free( buf2 ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE */ |
| void ssl_serialize_session_save_buf_size( int ticket_len, char *crt_file ) |
| { |
| mbedtls_ssl_session session; |
| unsigned char *buf = NULL; |
| size_t good_len, bad_len, test_len; |
| |
| /* |
| * Test that session_save() fails cleanly on small buffers |
| */ |
| |
| mbedtls_ssl_session_init( &session ); |
| |
| /* Prepare dummy session and get serialized size */ |
| TEST_ASSERT( ssl_populate_session( &session, ticket_len, crt_file ) == 0 ); |
| TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &good_len ) |
| == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
| |
| /* Try all possible bad lengths */ |
| for( bad_len = 1; bad_len < good_len; bad_len++ ) |
| { |
| /* Allocate exact size so that asan/valgrind can detect any overwrite */ |
| mbedtls_free( buf ); |
| TEST_ASSERT( ( buf = mbedtls_calloc( 1, bad_len ) ) != NULL ); |
| TEST_ASSERT( mbedtls_ssl_session_save( &session, buf, bad_len, |
| &test_len ) |
| == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
| TEST_ASSERT( test_len == good_len ); |
| } |
| |
| exit: |
| mbedtls_ssl_session_free( &session ); |
| mbedtls_free( buf ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE */ |
| void ssl_serialize_session_load_buf_size( int ticket_len, char *crt_file ) |
| { |
| mbedtls_ssl_session session; |
| unsigned char *good_buf = NULL, *bad_buf = NULL; |
| size_t good_len, bad_len; |
| |
| /* |
| * Test that session_load() fails cleanly on small buffers |
| */ |
| |
| mbedtls_ssl_session_init( &session ); |
| |
| /* Prepare serialized session data */ |
| TEST_ASSERT( ssl_populate_session( &session, ticket_len, crt_file ) == 0 ); |
| TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &good_len ) |
| == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
| TEST_ASSERT( ( good_buf = mbedtls_calloc( 1, good_len ) ) != NULL ); |
| TEST_ASSERT( mbedtls_ssl_session_save( &session, good_buf, good_len, |
| &good_len ) == 0 ); |
| mbedtls_ssl_session_free( &session ); |
| |
| /* Try all possible bad lengths */ |
| for( bad_len = 0; bad_len < good_len; bad_len++ ) |
| { |
| /* Allocate exact size so that asan/valgrind can detect any overread */ |
| mbedtls_free( bad_buf ); |
| bad_buf = mbedtls_calloc( 1, bad_len ? bad_len : 1 ); |
| TEST_ASSERT( bad_buf != NULL ); |
| memcpy( bad_buf, good_buf, bad_len ); |
| |
| TEST_ASSERT( mbedtls_ssl_session_load( &session, bad_buf, bad_len ) |
| == MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
| } |
| |
| exit: |
| mbedtls_ssl_session_free( &session ); |
| mbedtls_free( good_buf ); |
| mbedtls_free( bad_buf ); |
| } |
| /* END_CASE */ |
| |
| /* BEGIN_CASE */ |
| void ssl_session_serialize_version_check( int corrupt_major, |
| int corrupt_minor, |
| int corrupt_patch, |
| int corrupt_config ) |
| { |
| unsigned char serialized_session[ 2048 ]; |
| size_t serialized_session_len; |
| unsigned cur_byte; |
| mbedtls_ssl_session session; |
| uint8_t should_corrupt_byte[] = { corrupt_major == 1, |
| corrupt_minor == 1, |
| corrupt_patch == 1, |
| corrupt_config == 1, |
| corrupt_config == 1 }; |
| |
| mbedtls_ssl_session_init( &session ); |
| |
| /* Infer length of serialized session. */ |
| TEST_ASSERT( mbedtls_ssl_session_save( &session, |
| serialized_session, |
| sizeof( serialized_session ), |
| &serialized_session_len ) == 0 ); |
| |
| mbedtls_ssl_session_free( &session ); |
| |
| /* Without any modification, we should be able to successfully |
| * de-serialize the session - double-check that. */ |
| TEST_ASSERT( mbedtls_ssl_session_load( &session, |
| serialized_session, |
| serialized_session_len ) == 0 ); |
| mbedtls_ssl_session_free( &session ); |
| |
| /* Go through the bytes in the serialized session header and |
| * corrupt them bit-by-bit. */ |
| for( cur_byte = 0; cur_byte < sizeof( should_corrupt_byte ); cur_byte++ ) |
| { |
| int cur_bit; |
| unsigned char * const byte = &serialized_session[ cur_byte ]; |
| |
| if( should_corrupt_byte[ cur_byte ] == 0 ) |
| continue; |
| |
| for( cur_bit = 0; cur_bit < CHAR_BIT; cur_bit++ ) |
| { |
| unsigned char const corrupted_bit = 0x1u << cur_bit; |
| /* Modify a single bit in the serialized session. */ |
| *byte ^= corrupted_bit; |
| |
| /* Attempt to deserialize */ |
| TEST_ASSERT( mbedtls_ssl_session_load( &session, |
| serialized_session, |
| serialized_session_len ) == |
| MBEDTLS_ERR_SSL_VERSION_MISMATCH ); |
| |
| /* Undo the change */ |
| *byte ^= corrupted_bit; |
| } |
| } |
| |
| } |
| /* END_CASE */ |
