From e0fc7961c4fbd27577fb519d9aea2dc788742715 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Wed, 23 Jul 2014 13:18:06 +0100 Subject: [PATCH] Add conditional unit testing interface. Don't call internal functions directly call them through SSL_test_functions(). This also makes unit testing work on Windows and platforms that don't export internal functions from shared libraries. By default unit testing is not enabled: it requires the compile time option "enable-unit-test". Reviewed-by: Geoff Thorpe --- Configure | 1 + ssl/Makefile | 4 +-- ssl/heartbeat_test.c | 4 ++- ssl/ssl.h | 4 +++ ssl/ssl_locl.h | 17 +++++++++++ ssl/ssl_utst.c | 73 ++++++++++++++++++++++++++++++++++++++++++++ util/mk1mf.pl | 1 + util/mkdef.pl | 7 ++++- util/ssleay.num | 1 + 9 files changed, 108 insertions(+), 4 deletions(-) create mode 100644 ssl/ssl_utst.c diff --git a/Configure b/Configure index 7a4730f087..0910b6acd5 100755 --- a/Configure +++ b/Configure @@ -736,6 +736,7 @@ my %disabled = ( # "what" => "comment" [or special keyword "experimental "shared" => "default", "ssl-trace" => "default", "store" => "experimental", + "unit-test" => "default", "zlib" => "default", "zlib-dynamic" => "default" ); diff --git a/ssl/Makefile b/ssl/Makefile index 9b7e174da1..71d7feaf2b 100644 --- a/ssl/Makefile +++ b/ssl/Makefile @@ -30,7 +30,7 @@ LIBSRC= \ ssl_lib.c ssl_err2.c ssl_cert.c ssl_sess.c \ ssl_ciph.c ssl_stat.c ssl_rsa.c \ ssl_asn1.c ssl_txt.c ssl_algs.c ssl_conf.c \ - bio_ssl.c ssl_err.c kssl.c t1_reneg.c tls_srp.c t1_trce.c + bio_ssl.c ssl_err.c kssl.c t1_reneg.c tls_srp.c t1_trce.c ssl_utst.c LIBOBJ= \ s2_meth.o s2_srvr.o s2_clnt.o s2_lib.o s2_enc.o s2_pkt.o \ s3_meth.o s3_srvr.o s3_clnt.o s3_lib.o s3_enc.o s3_pkt.o s3_both.o s3_cbc.o \ @@ -41,7 +41,7 @@ LIBOBJ= \ ssl_lib.o ssl_err2.o ssl_cert.o ssl_sess.o \ ssl_ciph.o ssl_stat.o ssl_rsa.o \ ssl_asn1.o ssl_txt.o ssl_algs.o ssl_conf.o \ - bio_ssl.o ssl_err.o kssl.o t1_reneg.o tls_srp.o t1_trce.o + bio_ssl.o ssl_err.o kssl.o t1_reneg.o tls_srp.o t1_trce.o ssl_utst.o SRC= $(LIBSRC) diff --git a/ssl/heartbeat_test.c b/ssl/heartbeat_test.c index 4030034d8b..fc19259b43 100644 --- a/ssl/heartbeat_test.c +++ b/ssl/heartbeat_test.c @@ -38,6 +38,8 @@ * http://mike-bland.com/tags/heartbleed.html */ +#define OPENSSL_UNIT_TEST + #include "../ssl/ssl_locl.h" #include "testutil.h" @@ -46,7 +48,7 @@ #include #include -#if !defined(OPENSSL_NO_HEARTBEATS) && !defined(OPENSSL_SYS_WINDOWS) +#if !defined(OPENSSL_NO_HEARTBEATS) && !defined(OPENSSL_NO_UNIT_TEST) /* As per https://tools.ietf.org/html/rfc6520#section-4 */ #define MIN_PADDING_SIZE 16 diff --git a/ssl/ssl.h b/ssl/ssl.h index d44a9d5e97..0a5e621554 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -2570,6 +2570,10 @@ int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx))(SSL *s, SSL_CTX *ctx, i void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex); void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx); +#ifndef OPENSSL_NO_UNIT_TEST +const struct openssl_ssl_test_functions *SSL_test_functions(void); +#endif + /* BEGIN ERROR CODES */ /* The following lines are auto generated by the script mkerr.pl. Any changes * made after this point may be overwritten when the script is next run. diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 651b837f54..07c13fce5d 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -971,6 +971,16 @@ const SSL_METHOD *func_name(void) \ return &func_name##_data; \ } +struct openssl_ssl_test_functions + { + int (*p_ssl_init_wbio_buffer)(SSL *s, int push); + int (*p_ssl3_setup_buffers)(SSL *s); + int (*p_tls1_process_heartbeat)(SSL *s); + int (*p_dtls1_process_heartbeat)(SSL *s); + }; + +#ifndef OPENSSL_UNIT_TEST + void ssl_clear_cipher_ctx(SSL *s); int ssl_clear_bad_session(SSL *s); CERT *ssl_cert_new(void); @@ -1380,5 +1390,12 @@ void ssl3_cbc_digest_record( void tls_fips_digest_extra( const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx, const unsigned char *data, size_t data_len, size_t orig_len); +#else + +#define ssl_init_wbio_buffer SSL_test_functions()->p_ssl_init_wbio_buffer +#define ssl3_setup_buffers SSL_test_functions()->p_ssl3_setup_buffers +#define tls1_process_heartbeat SSL_test_functions()->p_tls1_process_heartbeat +#define dtls1_process_heartbeat SSL_test_functions()->p_dtls1_process_heartbeat #endif +#endif diff --git a/ssl/ssl_utst.c b/ssl/ssl_utst.c new file mode 100644 index 0000000000..3679bc3c23 --- /dev/null +++ b/ssl/ssl_utst.c @@ -0,0 +1,73 @@ +/* ssl_utst.c */ +/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL + * project. + */ +/* ==================================================================== + * Copyright (c) 2014 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + */ + +#include "ssl_locl.h" + +#ifndef OPENSSL_NO_UNIT_TEST + + +static const struct openssl_ssl_test_functions ssl_test_functions = + { + ssl_init_wbio_buffer, + ssl3_setup_buffers, + tls1_process_heartbeat, + dtls1_process_heartbeat + }; + +const struct openssl_ssl_test_functions *SSL_test_functions(void) + { + return &ssl_test_functions; + } + +#endif diff --git a/util/mk1mf.pl b/util/mk1mf.pl index a550523b62..66ff994852 100755 --- a/util/mk1mf.pl +++ b/util/mk1mf.pl @@ -1465,6 +1465,7 @@ sub read_options "no-zlib" => 0, "no-zlib-dynamic" => 0, "no-ssl-trace" => 0, + "no-unit-test" => 0, "fips" => \$fips, "fipscanisterbuild" => [\$fips, \$fipscanisterbuild], "fipscanisteronly" => [\$fips, \$fipscanisterbuild, \$fipscanisteronly], diff --git a/util/mkdef.pl b/util/mkdef.pl index 12e1594bbe..1b0181149d 100755 --- a/util/mkdef.pl +++ b/util/mkdef.pl @@ -119,7 +119,9 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF", # SCTP "SCTP", # SSL TRACE - "SSL_TRACE"); + "SSL_TRACE", + # Unit testing + "UNIT_TEST"); my $options=""; open(IN,"