2016-03-17 14:14:30 +00:00
|
|
|
/*
|
|
|
|
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
|
|
|
|
*
|
2016-05-17 18:20:24 +00:00
|
|
|
* Licensed under the OpenSSL license (the "License"). You may not use
|
|
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
|
|
* in the file LICENSE in the source distribution or at
|
2016-03-17 14:14:30 +00:00
|
|
|
* https://www.openssl.org/source/license.html
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Ideally, CONF should offer standard parsing methods and cover them
|
|
|
|
* in tests. But since we have no CONF tests, we use a custom test for now.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <stdio.h>
|
2016-07-04 18:16:14 +00:00
|
|
|
#include <string.h>
|
2016-03-17 14:14:30 +00:00
|
|
|
|
|
|
|
#include "e_os.h"
|
|
|
|
#include "ssl_test_ctx.h"
|
|
|
|
#include "testutil.h"
|
|
|
|
#include <openssl/e_os2.h>
|
|
|
|
#include <openssl/err.h>
|
|
|
|
#include <openssl/conf.h>
|
|
|
|
#include <openssl/ssl.h>
|
|
|
|
|
|
|
|
static CONF *conf = NULL;
|
|
|
|
|
|
|
|
typedef struct ssl_test_ctx_test_fixture {
|
|
|
|
const char *test_case_name;
|
|
|
|
const char *test_section;
|
|
|
|
/* Expected parsed configuration. */
|
|
|
|
SSL_TEST_CTX *expected_ctx;
|
|
|
|
} SSL_TEST_CTX_TEST_FIXTURE;
|
|
|
|
|
2016-07-21 14:29:48 +00:00
|
|
|
|
|
|
|
static int SSL_TEST_CLIENT_CONF_equal(SSL_TEST_CLIENT_CONF *client,
|
|
|
|
SSL_TEST_CLIENT_CONF *client2)
|
|
|
|
{
|
|
|
|
if (client->verify_callback != client2->verify_callback) {
|
|
|
|
fprintf(stderr, "ClientVerifyCallback mismatch: %s vs %s.\n",
|
|
|
|
ssl_verify_callback_name(client->verify_callback),
|
|
|
|
ssl_verify_callback_name(client2->verify_callback));
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (client->servername != client2->servername) {
|
|
|
|
fprintf(stderr, "ServerName mismatch: %s vs %s.\n",
|
|
|
|
ssl_servername_name(client->servername),
|
|
|
|
ssl_servername_name(client2->servername));
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (!strings_equal("Client NPNProtocols", client->npn_protocols,
|
|
|
|
client2->npn_protocols))
|
|
|
|
return 0;
|
|
|
|
if (!strings_equal("Client ALPNProtocols", client->alpn_protocols,
|
|
|
|
client2->alpn_protocols))
|
|
|
|
return 0;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int SSL_TEST_SERVER_CONF_equal(SSL_TEST_SERVER_CONF *server,
|
|
|
|
SSL_TEST_SERVER_CONF *server2)
|
|
|
|
{
|
|
|
|
if (server->servername_callback != server2->servername_callback) {
|
|
|
|
fprintf(stderr, "ServerNameCallback mismatch: %s vs %s.\n",
|
|
|
|
ssl_servername_callback_name(server->servername_callback),
|
|
|
|
ssl_servername_callback_name(server2->servername_callback));
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (!strings_equal("Server NPNProtocols", server->npn_protocols,
|
|
|
|
server2->npn_protocols))
|
|
|
|
return 0;
|
|
|
|
if (!strings_equal("Server ALPNProtocols", server->alpn_protocols,
|
|
|
|
server2->alpn_protocols))
|
|
|
|
return 0;
|
|
|
|
if (server->broken_session_ticket != server2->broken_session_ticket) {
|
|
|
|
fprintf(stderr, "Broken session ticket mismatch: %d vs %d.\n",
|
|
|
|
server->broken_session_ticket, server2->broken_session_ticket);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int SSL_TEST_EXTRA_CONF_equal(SSL_TEST_EXTRA_CONF *extra,
|
|
|
|
SSL_TEST_EXTRA_CONF *extra2)
|
|
|
|
{
|
|
|
|
return SSL_TEST_CLIENT_CONF_equal(&extra->client, &extra2->client)
|
|
|
|
&& SSL_TEST_SERVER_CONF_equal(&extra->server, &extra2->server)
|
|
|
|
&& SSL_TEST_SERVER_CONF_equal(&extra->server2, &extra2->server2);
|
|
|
|
}
|
|
|
|
|
2016-03-17 14:14:30 +00:00
|
|
|
/* Returns 1 if the contexts are equal, 0 otherwise. */
|
|
|
|
static int SSL_TEST_CTX_equal(SSL_TEST_CTX *ctx, SSL_TEST_CTX *ctx2)
|
|
|
|
{
|
2016-07-21 14:29:48 +00:00
|
|
|
if (ctx->method != ctx2->method) {
|
|
|
|
fprintf(stderr, "Method mismatch: %s vs %s.\n",
|
|
|
|
ssl_test_method_name(ctx->method),
|
|
|
|
ssl_test_method_name(ctx2->method));
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (ctx->handshake_mode != ctx2->handshake_mode) {
|
|
|
|
fprintf(stderr, "HandshakeMode mismatch: %s vs %s.\n",
|
|
|
|
ssl_handshake_mode_name(ctx->handshake_mode),
|
|
|
|
ssl_handshake_mode_name(ctx2->handshake_mode));
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!SSL_TEST_EXTRA_CONF_equal(&ctx->extra, &ctx2->extra)) {
|
|
|
|
fprintf(stderr, "Extra conf mismatch.\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (!SSL_TEST_EXTRA_CONF_equal(&ctx->resume_extra, &ctx2->resume_extra)) {
|
|
|
|
fprintf(stderr, "Resume extra conf mismatch.\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-03-17 14:14:30 +00:00
|
|
|
if (ctx->expected_result != ctx2->expected_result) {
|
|
|
|
fprintf(stderr, "ExpectedResult mismatch: %s vs %s.\n",
|
2016-04-07 17:07:50 +00:00
|
|
|
ssl_test_result_name(ctx->expected_result),
|
|
|
|
ssl_test_result_name(ctx2->expected_result));
|
2016-03-17 14:14:30 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2016-07-21 14:29:48 +00:00
|
|
|
if (ctx->expected_client_alert != ctx2->expected_client_alert) {
|
2016-03-17 14:14:30 +00:00
|
|
|
fprintf(stderr, "ClientAlert mismatch: %s vs %s.\n",
|
2016-07-21 14:29:48 +00:00
|
|
|
ssl_alert_name(ctx->expected_client_alert),
|
|
|
|
ssl_alert_name(ctx2->expected_client_alert));
|
2016-03-17 14:14:30 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2016-07-21 14:29:48 +00:00
|
|
|
if (ctx->expected_server_alert != ctx2->expected_server_alert) {
|
2016-03-17 14:14:30 +00:00
|
|
|
fprintf(stderr, "ServerAlert mismatch: %s vs %s.\n",
|
2016-07-21 14:29:48 +00:00
|
|
|
ssl_alert_name(ctx->expected_server_alert),
|
|
|
|
ssl_alert_name(ctx2->expected_server_alert));
|
2016-03-17 14:14:30 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2016-07-21 14:29:48 +00:00
|
|
|
if (ctx->expected_protocol != ctx2->expected_protocol) {
|
2016-03-17 14:14:30 +00:00
|
|
|
fprintf(stderr, "ClientAlert mismatch: %s vs %s.\n",
|
2016-07-21 14:29:48 +00:00
|
|
|
ssl_protocol_name(ctx->expected_protocol),
|
|
|
|
ssl_protocol_name(ctx2->expected_protocol));
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-12 22:16:52 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2016-06-20 15:20:25 +00:00
|
|
|
if (ctx->expected_servername != ctx2->expected_servername) {
|
|
|
|
fprintf(stderr, "ExpectedServerName mismatch: %s vs %s.\n",
|
|
|
|
ssl_servername_name(ctx->expected_servername),
|
|
|
|
ssl_servername_name(ctx2->expected_servername));
|
|
|
|
return 0;
|
|
|
|
}
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-12 22:16:52 +00:00
|
|
|
if (ctx->session_ticket_expected != ctx2->session_ticket_expected) {
|
|
|
|
fprintf(stderr, "SessionTicketExpected mismatch: %s vs %s.\n",
|
2016-06-09 22:39:22 +00:00
|
|
|
ssl_session_ticket_name(ctx->session_ticket_expected),
|
|
|
|
ssl_session_ticket_name(ctx2->session_ticket_expected));
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-12 22:16:52 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2016-07-04 18:16:14 +00:00
|
|
|
if (!strings_equal("ExpectedNPNProtocol", ctx->expected_npn_protocol,
|
|
|
|
ctx2->expected_npn_protocol))
|
|
|
|
return 0;
|
|
|
|
if (!strings_equal("ExpectedALPNProtocol", ctx->expected_alpn_protocol,
|
|
|
|
ctx2->expected_alpn_protocol))
|
|
|
|
return 0;
|
2016-07-05 17:06:23 +00:00
|
|
|
if (ctx->resumption_expected != ctx2->resumption_expected) {
|
|
|
|
fprintf(stderr, "ResumptionExpected mismatch: %d vs %d.\n",
|
|
|
|
ctx->resumption_expected, ctx2->resumption_expected);
|
|
|
|
return 0;
|
|
|
|
}
|
2016-03-17 14:14:30 +00:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static SSL_TEST_CTX_TEST_FIXTURE set_up(const char *const test_case_name)
|
|
|
|
{
|
|
|
|
SSL_TEST_CTX_TEST_FIXTURE fixture;
|
|
|
|
fixture.test_case_name = test_case_name;
|
|
|
|
fixture.expected_ctx = SSL_TEST_CTX_new();
|
|
|
|
OPENSSL_assert(fixture.expected_ctx != NULL);
|
|
|
|
return fixture;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int execute_test(SSL_TEST_CTX_TEST_FIXTURE fixture)
|
|
|
|
{
|
2016-04-05 12:29:06 +00:00
|
|
|
int success = 0;
|
2016-03-17 14:14:30 +00:00
|
|
|
|
|
|
|
SSL_TEST_CTX *ctx = SSL_TEST_CTX_create(conf, fixture.test_section);
|
|
|
|
|
|
|
|
if (ctx == NULL) {
|
|
|
|
fprintf(stderr, "Failed to parse good configuration %s.\n",
|
|
|
|
fixture.test_section);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!SSL_TEST_CTX_equal(ctx, fixture.expected_ctx))
|
|
|
|
goto err;
|
|
|
|
|
2016-04-05 12:29:06 +00:00
|
|
|
success = 1;
|
2016-03-17 14:14:30 +00:00
|
|
|
err:
|
|
|
|
SSL_TEST_CTX_free(ctx);
|
2016-04-05 12:29:06 +00:00
|
|
|
return success;
|
2016-03-17 14:14:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int execute_failure_test(SSL_TEST_CTX_TEST_FIXTURE fixture)
|
|
|
|
{
|
|
|
|
SSL_TEST_CTX *ctx = SSL_TEST_CTX_create(conf, fixture.test_section);
|
|
|
|
|
|
|
|
if (ctx != NULL) {
|
|
|
|
fprintf(stderr, "Parsing bad configuration %s succeeded.\n",
|
|
|
|
fixture.test_section);
|
|
|
|
SSL_TEST_CTX_free(ctx);
|
2016-04-05 12:29:06 +00:00
|
|
|
return 0;
|
2016-03-17 14:14:30 +00:00
|
|
|
}
|
|
|
|
|
2016-04-05 12:29:06 +00:00
|
|
|
return 1;
|
2016-03-17 14:14:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void tear_down(SSL_TEST_CTX_TEST_FIXTURE fixture)
|
|
|
|
{
|
|
|
|
SSL_TEST_CTX_free(fixture.expected_ctx);
|
|
|
|
ERR_print_errors_fp(stderr);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define SETUP_SSL_TEST_CTX_TEST_FIXTURE() \
|
|
|
|
SETUP_TEST_FIXTURE(SSL_TEST_CTX_TEST_FIXTURE, set_up)
|
|
|
|
#define EXECUTE_SSL_TEST_CTX_TEST() \
|
|
|
|
EXECUTE_TEST(execute_test, tear_down)
|
|
|
|
#define EXECUTE_SSL_TEST_CTX_FAILURE_TEST() \
|
|
|
|
EXECUTE_TEST(execute_failure_test, tear_down)
|
|
|
|
|
|
|
|
static int test_empty_configuration()
|
|
|
|
{
|
|
|
|
SETUP_SSL_TEST_CTX_TEST_FIXTURE();
|
|
|
|
fixture.test_section = "ssltest_default";
|
|
|
|
fixture.expected_ctx->expected_result = SSL_TEST_SUCCESS;
|
|
|
|
EXECUTE_SSL_TEST_CTX_TEST();
|
|
|
|
}
|
|
|
|
|
|
|
|
static int test_good_configuration()
|
|
|
|
{
|
|
|
|
SETUP_SSL_TEST_CTX_TEST_FIXTURE();
|
|
|
|
fixture.test_section = "ssltest_good";
|
2016-07-21 14:29:48 +00:00
|
|
|
fixture.expected_ctx->method = SSL_TEST_METHOD_DTLS;
|
|
|
|
fixture.expected_ctx->handshake_mode = SSL_TEST_HANDSHAKE_RESUME;
|
|
|
|
|
2016-03-17 14:14:30 +00:00
|
|
|
fixture.expected_ctx->expected_result = SSL_TEST_SERVER_FAIL;
|
2016-07-21 14:29:48 +00:00
|
|
|
fixture.expected_ctx->expected_client_alert = SSL_AD_UNKNOWN_CA;
|
|
|
|
fixture.expected_ctx->expected_server_alert = 0; /* No alert. */
|
|
|
|
fixture.expected_ctx->expected_protocol = TLS1_1_VERSION;
|
2016-06-20 15:20:25 +00:00
|
|
|
fixture.expected_ctx->expected_servername = SSL_TEST_SERVERNAME_SERVER2;
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-12 22:16:52 +00:00
|
|
|
fixture.expected_ctx->session_ticket_expected = SSL_TEST_SESSION_TICKET_YES;
|
2016-07-05 17:06:23 +00:00
|
|
|
fixture.expected_ctx->resumption_expected = 1;
|
2016-07-21 14:29:48 +00:00
|
|
|
|
|
|
|
fixture.expected_ctx->extra.client.verify_callback =
|
|
|
|
SSL_TEST_VERIFY_REJECT_ALL;
|
|
|
|
fixture.expected_ctx->extra.client.servername = SSL_TEST_SERVERNAME_SERVER2;
|
|
|
|
fixture.expected_ctx->extra.client.npn_protocols =
|
|
|
|
OPENSSL_strdup("foo,bar");
|
|
|
|
OPENSSL_assert(fixture.expected_ctx->extra.client.npn_protocols != NULL);
|
|
|
|
|
|
|
|
fixture.expected_ctx->extra.server.servername_callback =
|
|
|
|
SSL_TEST_SERVERNAME_IGNORE_MISMATCH;
|
|
|
|
fixture.expected_ctx->extra.server.broken_session_ticket = 1;
|
|
|
|
|
|
|
|
fixture.expected_ctx->resume_extra.server2.alpn_protocols =
|
|
|
|
OPENSSL_strdup("baz");
|
|
|
|
OPENSSL_assert(
|
|
|
|
fixture.expected_ctx->resume_extra.server2.alpn_protocols != NULL);
|
|
|
|
|
2016-03-17 14:14:30 +00:00
|
|
|
EXECUTE_SSL_TEST_CTX_TEST();
|
|
|
|
}
|
|
|
|
|
|
|
|
static const char *bad_configurations[] = {
|
|
|
|
"ssltest_unknown_option",
|
|
|
|
"ssltest_unknown_expected_result",
|
|
|
|
"ssltest_unknown_alert",
|
|
|
|
"ssltest_unknown_protocol",
|
2016-04-07 17:07:50 +00:00
|
|
|
"ssltest_unknown_verify_callback",
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-12 22:16:52 +00:00
|
|
|
"ssltest_unknown_servername",
|
2016-06-20 15:20:25 +00:00
|
|
|
"ssltest_unknown_servername_callback",
|
Fix session ticket and SNI
When session tickets are used, it's possible that SNI might swtich the
SSL_CTX on an SSL. Normally, this is not a problem, because the
initial_ctx/session_ctx are used for all session ticket/id processes.
However, when the SNI callback occurs, it's possible that the callback
may update the options in the SSL from the SSL_CTX, and this could
cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things
can happen:
1. The session ticket TLSEXT may not be written when the ticket expected
flag is set. The state machine transistions to writing the ticket, and
the client responds with an error as its not expecting a ticket.
2. When creating the session ticket, if the ticket key cb returns 0
the crypto/hmac contexts are not initialized, and the code crashes when
trying to encrypt the session ticket.
To fix 1, if the ticket TLSEXT is not written out, clear the expected
ticket flag.
To fix 2, consider a return of 0 from the ticket key cb a recoverable
error, and write a 0 length ticket and continue. The client-side code
can explicitly handle this case.
Fix these two cases, and add unit test code to validate ticket behavior.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-12 22:16:52 +00:00
|
|
|
"ssltest_unknown_session_ticket_expected",
|
2016-06-03 15:49:04 +00:00
|
|
|
"ssltest_unknown_method",
|
2016-07-05 17:06:23 +00:00
|
|
|
"ssltest_unknown_handshake_mode",
|
|
|
|
"ssltest_unknown_resumption_expected",
|
2016-03-17 14:14:30 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
static int test_bad_configuration(int idx)
|
|
|
|
{
|
|
|
|
SETUP_SSL_TEST_CTX_TEST_FIXTURE();
|
|
|
|
fixture.test_section = bad_configurations[idx];
|
|
|
|
EXECUTE_SSL_TEST_CTX_FAILURE_TEST();
|
|
|
|
}
|
|
|
|
|
|
|
|
int main(int argc, char **argv)
|
|
|
|
{
|
|
|
|
int result = 0;
|
|
|
|
|
|
|
|
if (argc != 2)
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
conf = NCONF_new(NULL);
|
|
|
|
OPENSSL_assert(conf != NULL);
|
|
|
|
|
|
|
|
/* argv[1] should point to test/ssl_test_ctx_test.conf */
|
|
|
|
OPENSSL_assert(NCONF_load(conf, argv[1], NULL) > 0);
|
|
|
|
|
|
|
|
|
|
|
|
ADD_TEST(test_empty_configuration);
|
|
|
|
ADD_TEST(test_good_configuration);
|
|
|
|
ADD_ALL_TESTS(test_bad_configuration, OSSL_NELEM(bad_configurations));
|
|
|
|
|
|
|
|
result = run_tests(argv[0]);
|
|
|
|
|
|
|
|
NCONF_free(conf);
|
|
|
|
|
|
|
|
return result;
|
|
|
|
}
|