test_tortls.c 76 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814
  1. /* Copyright (c) 2010-2016, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #define TORTLS_PRIVATE
  4. #define LOG_PRIVATE
  5. #include "orconfig.h"
  6. #ifdef _WIN32
  7. #include <winsock2.h>
  8. #endif
  9. #include <math.h>
  10. #include "compat.h"
  11. /* Some versions of OpenSSL declare SSL_get_selected_srtp_profile twice in
  12. * srtp.h. Suppress the GCC warning so we can build with -Wredundant-decl. */
  13. DISABLE_GCC_WARNING(redundant-decls)
  14. #include <openssl/opensslv.h>
  15. #include <openssl/ssl.h>
  16. #include <openssl/ssl3.h>
  17. #include <openssl/err.h>
  18. #include <openssl/asn1t.h>
  19. #include <openssl/x509.h>
  20. #include <openssl/rsa.h>
  21. #include <openssl/evp.h>
  22. #include <openssl/bn.h>
  23. ENABLE_GCC_WARNING(redundant-decls)
  24. #include "or.h"
  25. #include "torlog.h"
  26. #include "config.h"
  27. #include "tortls.h"
  28. #include "test.h"
  29. #include "log_test_helpers.h"
  30. #define NS_MODULE tortls
  31. #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) \
  32. && !defined(LIBRESSL_VERSION_NUMBER)
  33. #define OPENSSL_OPAQUE
  34. #define SSL_STATE_STR "before SSL initialization"
  35. #else
  36. #define SSL_STATE_STR "before/accept initialization"
  37. #endif
  38. #ifndef OPENSSL_OPAQUE
  39. static SSL_METHOD *
  40. give_me_a_test_method(void)
  41. {
  42. SSL_METHOD *method = tor_malloc_zero(sizeof(SSL_METHOD));
  43. memcpy(method, TLSv1_method(), sizeof(SSL_METHOD));
  44. return method;
  45. }
  46. static int
  47. fake_num_ciphers(void)
  48. {
  49. return 0;
  50. }
  51. #endif
  52. static void
  53. test_tortls_errno_to_tls_error(void *data)
  54. {
  55. (void) data;
  56. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ECONNRESET)),OP_EQ,
  57. TOR_TLS_ERROR_CONNRESET);
  58. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ETIMEDOUT)),OP_EQ,
  59. TOR_TLS_ERROR_TIMEOUT);
  60. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(EHOSTUNREACH)),OP_EQ,
  61. TOR_TLS_ERROR_NO_ROUTE);
  62. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ENETUNREACH)),OP_EQ,
  63. TOR_TLS_ERROR_NO_ROUTE);
  64. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ECONNREFUSED)),OP_EQ,
  65. TOR_TLS_ERROR_CONNREFUSED);
  66. tt_int_op(tor_errno_to_tls_error(0),OP_EQ,TOR_TLS_ERROR_MISC);
  67. done:
  68. (void)1;
  69. }
  70. static void
  71. test_tortls_err_to_string(void *data)
  72. {
  73. (void) data;
  74. tt_str_op(tor_tls_err_to_string(1),OP_EQ,"[Not an error.]");
  75. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_MISC),OP_EQ,"misc error");
  76. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_IO),OP_EQ,"unexpected close");
  77. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_CONNREFUSED),OP_EQ,
  78. "connection refused");
  79. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_CONNRESET),OP_EQ,
  80. "connection reset");
  81. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_NO_ROUTE),OP_EQ,
  82. "host unreachable");
  83. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_TIMEOUT),OP_EQ,
  84. "connection timed out");
  85. tt_str_op(tor_tls_err_to_string(TOR_TLS_CLOSE),OP_EQ,"closed");
  86. tt_str_op(tor_tls_err_to_string(TOR_TLS_WANTREAD),OP_EQ,"want to read");
  87. tt_str_op(tor_tls_err_to_string(TOR_TLS_WANTWRITE),OP_EQ,"want to write");
  88. tt_str_op(tor_tls_err_to_string(-100),OP_EQ,"(unknown error code)");
  89. done:
  90. (void)1;
  91. }
  92. static int
  93. mock_tls_cert_matches_key(const tor_tls_t *tls, const tor_x509_cert_t *cert)
  94. {
  95. (void) tls;
  96. (void) cert; // XXXX look at this.
  97. return 1;
  98. }
  99. static void
  100. test_tortls_tor_tls_new(void *data)
  101. {
  102. (void) data;
  103. MOCK(tor_tls_cert_matches_key, mock_tls_cert_matches_key);
  104. crypto_pk_t *key1 = NULL, *key2 = NULL;
  105. SSL_METHOD *method = NULL;
  106. key1 = pk_generate(2);
  107. key2 = pk_generate(3);
  108. tor_tls_t *tls = NULL;
  109. tt_int_op(tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
  110. key1, key2, 86400), OP_EQ, 0);
  111. tls = tor_tls_new(-1, 0);
  112. tt_want(tls);
  113. tor_tls_free(tls); tls = NULL;
  114. SSL_CTX_free(client_tls_context->ctx);
  115. client_tls_context->ctx = NULL;
  116. tls = tor_tls_new(-1, 0);
  117. tt_assert(!tls);
  118. #ifndef OPENSSL_OPAQUE
  119. method = give_me_a_test_method();
  120. SSL_CTX *ctx = SSL_CTX_new(method);
  121. method->num_ciphers = fake_num_ciphers;
  122. client_tls_context->ctx = ctx;
  123. tls = tor_tls_new(-1, 0);
  124. tt_assert(!tls);
  125. #endif
  126. done:
  127. UNMOCK(tor_tls_cert_matches_key);
  128. crypto_pk_free(key1);
  129. crypto_pk_free(key2);
  130. tor_tls_free(tls);
  131. tor_free(method);
  132. tor_tls_free_all();
  133. }
  134. #define NS_MODULE tortls
  135. NS_DECL(void, logv, (int severity, log_domain_mask_t domain,
  136. const char *funcname, const char *suffix,
  137. const char *format, va_list ap));
  138. static void
  139. NS(logv)(int severity, log_domain_mask_t domain,
  140. const char *funcname, const char *suffix, const char *format,
  141. va_list ap)
  142. {
  143. (void) severity;
  144. (void) domain;
  145. (void) funcname;
  146. (void) suffix;
  147. (void) format;
  148. (void) ap; // XXXX look at this.
  149. CALLED(logv)++;
  150. }
  151. static void
  152. test_tortls_tor_tls_get_error(void *data)
  153. {
  154. (void) data;
  155. MOCK(tor_tls_cert_matches_key, mock_tls_cert_matches_key);
  156. crypto_pk_t *key1 = NULL, *key2 = NULL;
  157. key1 = pk_generate(2);
  158. key2 = pk_generate(3);
  159. tor_tls_t *tls = NULL;
  160. tt_int_op(tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
  161. key1, key2, 86400), OP_EQ, 0);
  162. tls = tor_tls_new(-1, 0);
  163. NS_MOCK(logv);
  164. tt_int_op(CALLED(logv), OP_EQ, 0);
  165. tor_tls_get_error(tls, 0, 0,
  166. (const char *)"test", 0, 0);
  167. tt_int_op(CALLED(logv), OP_EQ, 1);
  168. done:
  169. UNMOCK(tor_tls_cert_matches_key);
  170. NS_UNMOCK(logv);
  171. crypto_pk_free(key1);
  172. crypto_pk_free(key2);
  173. tor_tls_free(tls);
  174. }
  175. static void
  176. test_tortls_get_state_description(void *ignored)
  177. {
  178. (void)ignored;
  179. tor_tls_t *tls;
  180. char *buf;
  181. SSL_CTX *ctx;
  182. SSL_library_init();
  183. SSL_load_error_strings();
  184. ctx = SSL_CTX_new(SSLv23_method());
  185. buf = tor_malloc_zero(1000);
  186. tls = tor_malloc_zero(sizeof(tor_tls_t));
  187. tor_tls_get_state_description(NULL, buf, 20);
  188. tt_str_op(buf, OP_EQ, "(No SSL object)");
  189. SSL_free(tls->ssl);
  190. tls->ssl = NULL;
  191. tor_tls_get_state_description(tls, buf, 20);
  192. tt_str_op(buf, OP_EQ, "(No SSL object)");
  193. tls->ssl = SSL_new(ctx);
  194. tor_tls_get_state_description(tls, buf, 200);
  195. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in HANDSHAKE");
  196. tls->state = TOR_TLS_ST_OPEN;
  197. tor_tls_get_state_description(tls, buf, 200);
  198. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in OPEN");
  199. tls->state = TOR_TLS_ST_GOTCLOSE;
  200. tor_tls_get_state_description(tls, buf, 200);
  201. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in GOTCLOSE");
  202. tls->state = TOR_TLS_ST_SENTCLOSE;
  203. tor_tls_get_state_description(tls, buf, 200);
  204. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in SENTCLOSE");
  205. tls->state = TOR_TLS_ST_CLOSED;
  206. tor_tls_get_state_description(tls, buf, 200);
  207. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in CLOSED");
  208. tls->state = TOR_TLS_ST_RENEGOTIATE;
  209. tor_tls_get_state_description(tls, buf, 200);
  210. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in RENEGOTIATE");
  211. tls->state = TOR_TLS_ST_BUFFEREVENT;
  212. tor_tls_get_state_description(tls, buf, 200);
  213. tt_str_op(buf, OP_EQ, SSL_STATE_STR);
  214. tls->state = 7;
  215. tor_tls_get_state_description(tls, buf, 200);
  216. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in unknown TLS state");
  217. done:
  218. SSL_CTX_free(ctx);
  219. SSL_free(tls->ssl);
  220. tor_free(buf);
  221. tor_free(tls);
  222. }
  223. static void
  224. test_tortls_get_by_ssl(void *ignored)
  225. {
  226. (void)ignored;
  227. tor_tls_t *tls;
  228. tor_tls_t *res;
  229. SSL_CTX *ctx;
  230. SSL *ssl;
  231. SSL_library_init();
  232. SSL_load_error_strings();
  233. tor_tls_allocate_tor_tls_object_ex_data_index();
  234. ctx = SSL_CTX_new(SSLv23_method());
  235. tls = tor_malloc_zero(sizeof(tor_tls_t));
  236. tls->magic = TOR_TLS_MAGIC;
  237. ssl = SSL_new(ctx);
  238. res = tor_tls_get_by_ssl(ssl);
  239. tt_assert(!res);
  240. SSL_set_ex_data(ssl, tor_tls_object_ex_data_index, tls);
  241. res = tor_tls_get_by_ssl(ssl);
  242. tt_assert(res == tls);
  243. done:
  244. SSL_free(ssl);
  245. SSL_CTX_free(ctx);
  246. tor_free(tls);
  247. }
  248. static void
  249. test_tortls_allocate_tor_tls_object_ex_data_index(void *ignored)
  250. {
  251. (void)ignored;
  252. int first;
  253. tor_tls_allocate_tor_tls_object_ex_data_index();
  254. first = tor_tls_object_ex_data_index;
  255. tor_tls_allocate_tor_tls_object_ex_data_index();
  256. tt_int_op(first, OP_EQ, tor_tls_object_ex_data_index);
  257. done:
  258. (void)0;
  259. }
  260. static void
  261. test_tortls_log_one_error(void *ignored)
  262. {
  263. (void)ignored;
  264. tor_tls_t *tls;
  265. SSL_CTX *ctx;
  266. SSL *ssl = NULL;
  267. SSL_library_init();
  268. SSL_load_error_strings();
  269. ctx = SSL_CTX_new(SSLv23_method());
  270. tls = tor_malloc_zero(sizeof(tor_tls_t));
  271. int previous_log = setup_capture_of_logs(LOG_INFO);
  272. tor_tls_log_one_error(NULL, 0, LOG_WARN, 0, "something");
  273. expect_log_msg("TLS error while something: "
  274. "(null) (in (null):(null):---)\n");
  275. mock_clean_saved_logs();
  276. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  277. expect_log_msg("TLS error: (null) "
  278. "(in (null):(null):---)\n");
  279. mock_clean_saved_logs();
  280. tls->address = tor_strdup("127.hello");
  281. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  282. expect_log_msg("TLS error with 127.hello: "
  283. "(null) (in (null):(null):---)\n");
  284. tor_free(tls->address);
  285. mock_clean_saved_logs();
  286. tls->address = tor_strdup("127.hello");
  287. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, "blarg");
  288. expect_log_msg("TLS error while blarg with "
  289. "127.hello: (null) (in (null):(null):---)\n");
  290. mock_clean_saved_logs();
  291. tor_tls_log_one_error(tls, ERR_PACK(1, 2, 3), LOG_WARN, 0, NULL);
  292. expect_log_msg("TLS error with 127.hello: "
  293. "BN lib (in unknown library:(null):---)\n");
  294. mock_clean_saved_logs();
  295. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_HTTP_REQUEST),
  296. LOG_WARN, 0, NULL);
  297. expect_log_severity(LOG_INFO);
  298. mock_clean_saved_logs();
  299. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_HTTPS_PROXY_REQUEST),
  300. LOG_WARN, 0, NULL);
  301. expect_log_severity(LOG_INFO);
  302. mock_clean_saved_logs();
  303. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_RECORD_LENGTH_MISMATCH),
  304. LOG_WARN, 0, NULL);
  305. expect_log_severity(LOG_INFO);
  306. #ifndef OPENSSL_1_1_API
  307. mock_clean_saved_logs();
  308. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_RECORD_TOO_LARGE),
  309. LOG_WARN, 0, NULL);
  310. expect_log_severity(LOG_INFO);
  311. #endif
  312. mock_clean_saved_logs();
  313. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_UNKNOWN_PROTOCOL),
  314. LOG_WARN, 0, NULL);
  315. expect_log_severity(LOG_INFO);
  316. mock_clean_saved_logs();
  317. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_UNSUPPORTED_PROTOCOL),
  318. LOG_WARN, 0, NULL);
  319. expect_log_severity(LOG_INFO);
  320. tls->ssl = SSL_new(ctx);
  321. mock_clean_saved_logs();
  322. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  323. expect_log_msg("TLS error with 127.hello: (null)"
  324. " (in (null):(null):" SSL_STATE_STR ")\n");
  325. done:
  326. teardown_capture_of_logs(previous_log);
  327. SSL_free(ssl);
  328. SSL_CTX_free(ctx);
  329. if (tls && tls->ssl)
  330. SSL_free(tls->ssl);
  331. if (tls)
  332. tor_free(tls->address);
  333. tor_free(tls);
  334. }
  335. #ifndef OPENSSL_OPAQUE
  336. static void
  337. test_tortls_get_error(void *ignored)
  338. {
  339. (void)ignored;
  340. tor_tls_t *tls;
  341. int ret;
  342. SSL_CTX *ctx;
  343. SSL_library_init();
  344. SSL_load_error_strings();
  345. ctx = SSL_CTX_new(SSLv23_method());
  346. int previous_log = setup_capture_of_logs(LOG_INFO);
  347. tls = tor_malloc_zero(sizeof(tor_tls_t));
  348. tls->ssl = SSL_new(ctx);
  349. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  350. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  351. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_IO);
  352. expect_log_msg("TLS error: unexpected close while"
  353. " something (before/accept initialization)\n");
  354. mock_clean_saved_logs();
  355. ret = tor_tls_get_error(tls, 2, 0, "something", LOG_WARN, 0);
  356. tt_int_op(ret, OP_EQ, 0);
  357. expect_no_log_entry();
  358. mock_clean_saved_logs();
  359. ret = tor_tls_get_error(tls, 0, 1, "something", LOG_WARN, 0);
  360. tt_int_op(ret, OP_EQ, -11);
  361. expect_no_log_entry();
  362. mock_clean_saved_logs();
  363. ERR_clear_error();
  364. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  365. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  366. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  367. expect_log_msg("TLS error while something: (null)"
  368. " (in bignum routines:(null):before/accept initialization)\n");
  369. mock_clean_saved_logs();
  370. ERR_clear_error();
  371. tls->ssl->rwstate = SSL_READING;
  372. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_READ;
  373. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  374. tt_int_op(ret, OP_EQ, TOR_TLS_WANTREAD);
  375. expect_no_log_entry();
  376. mock_clean_saved_logs();
  377. ERR_clear_error();
  378. tls->ssl->rwstate = SSL_READING;
  379. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_WRITE;
  380. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  381. tt_int_op(ret, OP_EQ, TOR_TLS_WANTWRITE);
  382. expect_no_log_entry();
  383. mock_clean_saved_logs();
  384. ERR_clear_error();
  385. tls->ssl->rwstate = 0;
  386. tls->ssl->shutdown = SSL_RECEIVED_SHUTDOWN;
  387. tls->ssl->s3->warn_alert =SSL_AD_CLOSE_NOTIFY;
  388. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  389. tt_int_op(ret, OP_EQ, TOR_TLS_CLOSE);
  390. expect_log_entry();
  391. mock_clean_saved_logs();
  392. ret = tor_tls_get_error(tls, 0, 2, "something", LOG_WARN, 0);
  393. tt_int_op(ret, OP_EQ, -10);
  394. expect_no_log_entry();
  395. mock_clean_saved_logs();
  396. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  397. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  398. tt_int_op(ret, OP_EQ, -9);
  399. expect_log_msg("TLS error while something: (null) (in system library:"
  400. "connect:before/accept initialization)\n");
  401. done:
  402. teardown_capture_of_logs(previous_log);
  403. SSL_free(tls->ssl);
  404. tor_free(tls);
  405. SSL_CTX_free(ctx);
  406. }
  407. #endif
  408. static void
  409. test_tortls_always_accept_verify_cb(void *ignored)
  410. {
  411. (void)ignored;
  412. int ret;
  413. ret = always_accept_verify_cb(0, NULL);
  414. tt_int_op(ret, OP_EQ, 1);
  415. done:
  416. (void)0;
  417. }
  418. #ifndef OPENSSL_OPAQUE
  419. static void
  420. test_tortls_x509_cert_free(void *ignored)
  421. {
  422. (void)ignored;
  423. tor_x509_cert_t *cert;
  424. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  425. tor_x509_cert_free(cert);
  426. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  427. cert->cert = tor_malloc_zero(sizeof(X509));
  428. cert->encoded = tor_malloc_zero(1);
  429. tor_x509_cert_free(cert);
  430. }
  431. #endif
  432. static void
  433. test_tortls_x509_cert_get_id_digests(void *ignored)
  434. {
  435. (void)ignored;
  436. tor_x509_cert_t *cert;
  437. common_digests_t *d;
  438. const common_digests_t *res;
  439. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  440. d = tor_malloc_zero(sizeof(common_digests_t));
  441. d->d[0][0] = 42;
  442. res = tor_x509_cert_get_id_digests(cert);
  443. tt_assert(!res);
  444. cert->pkey_digests_set = 1;
  445. cert->pkey_digests = *d;
  446. res = tor_x509_cert_get_id_digests(cert);
  447. tt_int_op(res->d[0][0], OP_EQ, 42);
  448. done:
  449. tor_free(cert);
  450. tor_free(d);
  451. }
  452. #ifndef OPENSSL_OPAQUE
  453. static int
  454. fixed_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  455. {
  456. (void) a; (void) b;
  457. return 1;
  458. }
  459. static void
  460. fake_x509_free(X509 *cert)
  461. {
  462. if (cert) {
  463. if (cert->cert_info) {
  464. if (cert->cert_info->key) {
  465. if (cert->cert_info->key->pkey) {
  466. tor_free(cert->cert_info->key->pkey);
  467. }
  468. tor_free(cert->cert_info->key);
  469. }
  470. tor_free(cert->cert_info);
  471. }
  472. tor_free(cert);
  473. }
  474. }
  475. static void
  476. test_tortls_cert_matches_key(void *ignored)
  477. {
  478. (void)ignored;
  479. int res;
  480. tor_tls_t *tls;
  481. tor_x509_cert_t *cert;
  482. X509 *one = NULL, *two = NULL;
  483. EVP_PKEY_ASN1_METHOD *meth = EVP_PKEY_asn1_new(999, 0, NULL, NULL);
  484. EVP_PKEY_asn1_set_public(meth, NULL, NULL, fixed_pub_cmp, NULL, NULL, NULL);
  485. tls = tor_malloc_zero(sizeof(tor_tls_t));
  486. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  487. one = tor_malloc_zero(sizeof(X509));
  488. one->references = 1;
  489. two = tor_malloc_zero(sizeof(X509));
  490. two->references = 1;
  491. res = tor_tls_cert_matches_key(tls, cert);
  492. tt_int_op(res, OP_EQ, 0);
  493. tls->ssl = tor_malloc_zero(sizeof(SSL));
  494. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  495. tls->ssl->session->peer = one;
  496. res = tor_tls_cert_matches_key(tls, cert);
  497. tt_int_op(res, OP_EQ, 0);
  498. cert->cert = two;
  499. res = tor_tls_cert_matches_key(tls, cert);
  500. tt_int_op(res, OP_EQ, 0);
  501. one->cert_info = tor_malloc_zero(sizeof(X509_CINF));
  502. one->cert_info->key = tor_malloc_zero(sizeof(X509_PUBKEY));
  503. one->cert_info->key->pkey = tor_malloc_zero(sizeof(EVP_PKEY));
  504. one->cert_info->key->pkey->references = 1;
  505. one->cert_info->key->pkey->ameth = meth;
  506. one->cert_info->key->pkey->type = 1;
  507. two->cert_info = tor_malloc_zero(sizeof(X509_CINF));
  508. two->cert_info->key = tor_malloc_zero(sizeof(X509_PUBKEY));
  509. two->cert_info->key->pkey = tor_malloc_zero(sizeof(EVP_PKEY));
  510. two->cert_info->key->pkey->references = 1;
  511. two->cert_info->key->pkey->ameth = meth;
  512. two->cert_info->key->pkey->type = 2;
  513. res = tor_tls_cert_matches_key(tls, cert);
  514. tt_int_op(res, OP_EQ, 0);
  515. one->cert_info->key->pkey->type = 1;
  516. two->cert_info->key->pkey->type = 1;
  517. res = tor_tls_cert_matches_key(tls, cert);
  518. tt_int_op(res, OP_EQ, 1);
  519. done:
  520. EVP_PKEY_asn1_free(meth);
  521. tor_free(tls->ssl->session);
  522. tor_free(tls->ssl);
  523. tor_free(tls);
  524. tor_free(cert);
  525. fake_x509_free(one);
  526. fake_x509_free(two);
  527. }
  528. static void
  529. test_tortls_cert_get_key(void *ignored)
  530. {
  531. (void)ignored;
  532. tor_x509_cert_t *cert = NULL;
  533. crypto_pk_t *res = NULL;
  534. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  535. X509 *key = NULL;
  536. key = tor_malloc_zero(sizeof(X509));
  537. key->references = 1;
  538. res = tor_tls_cert_get_key(cert);
  539. tt_assert(!res);
  540. cert->cert = key;
  541. key->cert_info = tor_malloc_zero(sizeof(X509_CINF));
  542. key->cert_info->key = tor_malloc_zero(sizeof(X509_PUBKEY));
  543. key->cert_info->key->pkey = tor_malloc_zero(sizeof(EVP_PKEY));
  544. key->cert_info->key->pkey->references = 1;
  545. key->cert_info->key->pkey->type = 2;
  546. res = tor_tls_cert_get_key(cert);
  547. tt_assert(!res);
  548. done:
  549. fake_x509_free(key);
  550. tor_free(cert);
  551. crypto_pk_free(res);
  552. }
  553. #endif
  554. static void
  555. test_tortls_get_my_client_auth_key(void *ignored)
  556. {
  557. (void)ignored;
  558. crypto_pk_t *ret;
  559. crypto_pk_t *expected;
  560. tor_tls_context_t *ctx;
  561. RSA *k = RSA_new();
  562. ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
  563. expected = crypto_new_pk_from_rsa_(k);
  564. ctx->auth_key = expected;
  565. client_tls_context = NULL;
  566. ret = tor_tls_get_my_client_auth_key();
  567. tt_assert(!ret);
  568. client_tls_context = ctx;
  569. ret = tor_tls_get_my_client_auth_key();
  570. tt_assert(ret == expected);
  571. done:
  572. RSA_free(k);
  573. tor_free(expected);
  574. tor_free(ctx);
  575. }
  576. static void
  577. test_tortls_get_my_certs(void *ignored)
  578. {
  579. (void)ignored;
  580. int ret;
  581. tor_tls_context_t *ctx;
  582. const tor_x509_cert_t *link_cert_out = NULL;
  583. const tor_x509_cert_t *id_cert_out = NULL;
  584. ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
  585. client_tls_context = NULL;
  586. ret = tor_tls_get_my_certs(0, NULL, NULL);
  587. tt_int_op(ret, OP_EQ, -1);
  588. server_tls_context = NULL;
  589. ret = tor_tls_get_my_certs(1, NULL, NULL);
  590. tt_int_op(ret, OP_EQ, -1);
  591. client_tls_context = ctx;
  592. ret = tor_tls_get_my_certs(0, NULL, NULL);
  593. tt_int_op(ret, OP_EQ, 0);
  594. client_tls_context = ctx;
  595. ret = tor_tls_get_my_certs(0, &link_cert_out, &id_cert_out);
  596. tt_int_op(ret, OP_EQ, 0);
  597. server_tls_context = ctx;
  598. ret = tor_tls_get_my_certs(1, &link_cert_out, &id_cert_out);
  599. tt_int_op(ret, OP_EQ, 0);
  600. done:
  601. (void)1;
  602. }
  603. #ifndef OPENSSL_OPAQUE
  604. static void
  605. test_tortls_get_ciphersuite_name(void *ignored)
  606. {
  607. (void)ignored;
  608. const char *ret;
  609. tor_tls_t *ctx;
  610. ctx = tor_malloc_zero(sizeof(tor_tls_t));
  611. ctx->ssl = tor_malloc_zero(sizeof(SSL));
  612. ret = tor_tls_get_ciphersuite_name(ctx);
  613. tt_str_op(ret, OP_EQ, "(NONE)");
  614. done:
  615. tor_free(ctx->ssl);
  616. tor_free(ctx);
  617. }
  618. static SSL_CIPHER *
  619. get_cipher_by_name(const char *name)
  620. {
  621. int i;
  622. const SSL_METHOD *method = SSLv23_method();
  623. int num = method->num_ciphers();
  624. for (i = 0; i < num; ++i) {
  625. const SSL_CIPHER *cipher = method->get_cipher(i);
  626. const char *ciphername = SSL_CIPHER_get_name(cipher);
  627. if (!strcmp(ciphername, name)) {
  628. return (SSL_CIPHER *)cipher;
  629. }
  630. }
  631. return NULL;
  632. }
  633. static SSL_CIPHER *
  634. get_cipher_by_id(uint16_t id)
  635. {
  636. int i;
  637. const SSL_METHOD *method = SSLv23_method();
  638. int num = method->num_ciphers();
  639. for (i = 0; i < num; ++i) {
  640. const SSL_CIPHER *cipher = method->get_cipher(i);
  641. if (id == (SSL_CIPHER_get_id(cipher) & 0xffff)) {
  642. return (SSL_CIPHER *)cipher;
  643. }
  644. }
  645. return NULL;
  646. }
  647. static void
  648. test_tortls_classify_client_ciphers(void *ignored)
  649. {
  650. (void)ignored;
  651. int i;
  652. int ret;
  653. SSL_CTX *ctx;
  654. SSL *ssl;
  655. tor_tls_t *tls;
  656. STACK_OF(SSL_CIPHER) *ciphers;
  657. SSL_CIPHER *tmp_cipher;
  658. SSL_library_init();
  659. SSL_load_error_strings();
  660. tor_tls_allocate_tor_tls_object_ex_data_index();
  661. tls = tor_malloc_zero(sizeof(tor_tls_t));
  662. tls->magic = TOR_TLS_MAGIC;
  663. ctx = SSL_CTX_new(TLSv1_method());
  664. ssl = SSL_new(ctx);
  665. tls->ssl = ssl;
  666. ciphers = sk_SSL_CIPHER_new_null();
  667. ret = tor_tls_classify_client_ciphers(ssl, NULL);
  668. tt_int_op(ret, OP_EQ, -1);
  669. SSL_set_ex_data(ssl, tor_tls_object_ex_data_index, tls);
  670. tls->client_cipher_list_type = 42;
  671. ret = tor_tls_classify_client_ciphers(ssl, NULL);
  672. tt_int_op(ret, OP_EQ, 42);
  673. tls->client_cipher_list_type = 0;
  674. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  675. tt_int_op(ret, OP_EQ, 1);
  676. tt_int_op(tls->client_cipher_list_type, OP_EQ, 1);
  677. tls->client_cipher_list_type = 0;
  678. ret = tor_tls_classify_client_ciphers(ssl, SSL_get_ciphers(ssl));
  679. tt_int_op(ret, OP_EQ, 3);
  680. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  681. SSL_CIPHER *one = get_cipher_by_name(TLS1_TXT_DHE_RSA_WITH_AES_128_SHA),
  682. *two = get_cipher_by_name(TLS1_TXT_DHE_RSA_WITH_AES_256_SHA),
  683. *three = get_cipher_by_name(SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA),
  684. *four = NULL;
  685. sk_SSL_CIPHER_push(ciphers, one);
  686. sk_SSL_CIPHER_push(ciphers, two);
  687. sk_SSL_CIPHER_push(ciphers, three);
  688. sk_SSL_CIPHER_push(ciphers, four);
  689. tls->client_cipher_list_type = 0;
  690. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  691. tt_int_op(ret, OP_EQ, 1);
  692. tt_int_op(tls->client_cipher_list_type, OP_EQ, 1);
  693. sk_SSL_CIPHER_zero(ciphers);
  694. one = get_cipher_by_name("ECDH-RSA-AES256-GCM-SHA384");
  695. one->id = 0x00ff;
  696. two = get_cipher_by_name("ECDH-RSA-AES128-GCM-SHA256");
  697. two->id = 0x0000;
  698. sk_SSL_CIPHER_push(ciphers, one);
  699. tls->client_cipher_list_type = 0;
  700. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  701. tt_int_op(ret, OP_EQ, 3);
  702. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  703. sk_SSL_CIPHER_push(ciphers, two);
  704. tls->client_cipher_list_type = 0;
  705. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  706. tt_int_op(ret, OP_EQ, 3);
  707. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  708. one->id = 0xC00A;
  709. tls->client_cipher_list_type = 0;
  710. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  711. tt_int_op(ret, OP_EQ, 3);
  712. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  713. sk_SSL_CIPHER_zero(ciphers);
  714. for (i=0; v2_cipher_list[i]; i++) {
  715. tmp_cipher = get_cipher_by_id(v2_cipher_list[i]);
  716. tt_assert(tmp_cipher);
  717. sk_SSL_CIPHER_push(ciphers, tmp_cipher);
  718. }
  719. tls->client_cipher_list_type = 0;
  720. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  721. tt_int_op(ret, OP_EQ, 2);
  722. tt_int_op(tls->client_cipher_list_type, OP_EQ, 2);
  723. done:
  724. sk_SSL_CIPHER_free(ciphers);
  725. SSL_free(tls->ssl);
  726. tor_free(tls);
  727. SSL_CTX_free(ctx);
  728. }
  729. #endif
  730. static void
  731. test_tortls_client_is_using_v2_ciphers(void *ignored)
  732. {
  733. (void)ignored;
  734. #ifdef HAVE_SSL_GET_CLIENT_CIPHERS
  735. tt_skip();
  736. done:
  737. (void)1;
  738. #else
  739. int ret;
  740. SSL_CTX *ctx;
  741. SSL *ssl;
  742. SSL_SESSION *sess;
  743. STACK_OF(SSL_CIPHER) *ciphers;
  744. SSL_library_init();
  745. SSL_load_error_strings();
  746. ctx = SSL_CTX_new(TLSv1_method());
  747. ssl = SSL_new(ctx);
  748. sess = SSL_SESSION_new();
  749. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  750. tt_int_op(ret, OP_EQ, -1);
  751. ssl->session = sess;
  752. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  753. tt_int_op(ret, OP_EQ, 0);
  754. ciphers = sk_SSL_CIPHER_new_null();
  755. SSL_CIPHER *one = get_cipher_by_name("ECDH-RSA-AES256-GCM-SHA384");
  756. one->id = 0x00ff;
  757. sk_SSL_CIPHER_push(ciphers, one);
  758. sess->ciphers = ciphers;
  759. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  760. tt_int_op(ret, OP_EQ, 1);
  761. done:
  762. SSL_free(ssl);
  763. SSL_CTX_free(ctx);
  764. #endif
  765. }
  766. #ifndef OPENSSL_OPAQUE
  767. static X509 *fixed_try_to_extract_certs_from_tls_cert_out_result = NULL;
  768. static X509 *fixed_try_to_extract_certs_from_tls_id_cert_out_result = NULL;
  769. static void
  770. fixed_try_to_extract_certs_from_tls(int severity, tor_tls_t *tls,
  771. X509 **cert_out, X509 **id_cert_out)
  772. {
  773. (void) severity;
  774. (void) tls;
  775. *cert_out = fixed_try_to_extract_certs_from_tls_cert_out_result;
  776. *id_cert_out = fixed_try_to_extract_certs_from_tls_id_cert_out_result;
  777. }
  778. #endif
  779. #ifndef OPENSSL_OPAQUE
  780. static const char* notCompletelyValidCertString =
  781. "-----BEGIN CERTIFICATE-----\n"
  782. "MIICVjCCAb8CAg37MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\n"
  783. "A1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\n"
  784. "MRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\n"
  785. "YiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\n"
  786. "ODIyMDUyNzIzWhcNMTcwODIxMDUyNzIzWjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\n"
  787. "CAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\n"
  788. "ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMYBBrx5PlP0WNI/ZdzD\n"
  789. "+6Pktmurn+F2kQYbtc7XQh8/LTBvCo+P6iZoLEmUA9e7EXLRxgU1CVqeAi7QcAn9\n"
  790. "MwBlc8ksFJHB0rtf9pmf8Oza9E0Bynlq/4/Kb1x+d+AyhL7oK9tQwB24uHOueHi1\n"
  791. "C/iVv8CSWKiYe6hzN1txYe8rAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAASPdjigJ\n"
  792. "kXCqKWpnZ/Oc75EUcMi6HztaW8abUMlYXPIgkV2F7YanHOB7K4f7OOLjiz8DTPFf\n"
  793. "jC9UeuErhaA/zzWi8ewMTFZW/WshOrm3fNvcMrMLKtH534JKvcdMg6qIdjTFINIr\n"
  794. "evnAhf0cwULaebn+lMs8Pdl7y37+sfluVok=\n"
  795. "-----END CERTIFICATE-----\n";
  796. #endif
  797. static const char* validCertString = "-----BEGIN CERTIFICATE-----\n"
  798. "MIIDpTCCAY0CAg3+MA0GCSqGSIb3DQEBBQUAMF4xCzAJBgNVBAYTAlVTMREwDwYD\n"
  799. "VQQIDAhJbGxpbm9pczEQMA4GA1UEBwwHQ2hpY2FnbzEUMBIGA1UECgwLVG9yIFRl\n"
  800. "c3RpbmcxFDASBgNVBAMMC1RvciBUZXN0aW5nMB4XDTE1MDkwNjEzMzk1OVoXDTQz\n"
  801. "MDEyMjEzMzk1OVowVjELMAkGA1UEBhMCVVMxEDAOBgNVBAcMB0NoaWNhZ28xFDAS\n"
  802. "BgNVBAoMC1RvciBUZXN0aW5nMR8wHQYDVQQDDBZ0ZXN0aW5nLnRvcnByb2plY3Qu\n"
  803. "b3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoT6uyVVhWyOF3wkHjjYbd\n"
  804. "nKaykyRv4JVtKQdZ4OpEErmX1zw4MmyzpQNV6iR4bQnWiyLfzyVJMZDIC/WILBfX\n"
  805. "w2Pza/yuLgUvDc3twMuhOACzOQVO8PrEF/aVv2+hbCCy2udXvKhnYn+CCXl3ozc8\n"
  806. "XcKYvujTXDyvGWY3xwAjlQIDAQABMA0GCSqGSIb3DQEBBQUAA4ICAQCUvnhzQWuQ\n"
  807. "MrN+pERkE+zcTI/9dGS90rUMMLgu8VDNqTa0TUQh8uO0EQ6uDvI8Js6e8tgwS0BR\n"
  808. "UBahqb7ZHv+rejGCBr5OudqD+x4STiiuPNJVs86JTLN8SpM9CHjIBH5WCCN2KOy3\n"
  809. "mevNoRcRRyYJzSFULCunIK6FGulszigMYGscrO4oiTkZiHPh9KvWT40IMiHfL+Lw\n"
  810. "EtEWiLex6064LcA2YQ1AMuSZyCexks63lcfaFmQbkYOKqXa1oLkIRuDsOaSVjTfe\n"
  811. "vec+X6jvf12cFTKS5WIeqkKF2Irt+dJoiHEGTe5RscUMN/f+gqHPzfFz5dR23sxo\n"
  812. "g+HC6MZHlFkLAOx3wW6epPS8A/m1mw3zMPoTnb2U2YYt8T0dJMMlUn/7Y1sEAa+a\n"
  813. "dSTMaeUf6VnJ//11m454EZl1to9Z7oJOgqmFffSrdD4BGIWe8f7hhW6L1Enmqe/J\n"
  814. "BKL3wbzZh80O1W0bndAwhnEEhlzneFY84cbBo9pmVxpODHkUcStpr5Z7pBDrcL21\n"
  815. "Ss/aB/1YrsVXhdvJdOGxl3Mnl9dUY57CympLGlT8f0pPS6GAKOelECOhFMHmJd8L\n"
  816. "dj3XQSmKtYHevZ6IvuMXSlB/fJvSjSlkCuLo5+kJoaqPuRu+i/S1qxeRy3CBwmnE\n"
  817. "LdSNdcX4N79GQJ996PA8+mUCQG7YRtK+WA==\n"
  818. "-----END CERTIFICATE-----\n";
  819. static const char* caCertString = "-----BEGIN CERTIFICATE-----\n"
  820. "MIIFjzCCA3egAwIBAgIJAKd5WgyfPMYRMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV\n"
  821. "BAYTAlVTMREwDwYDVQQIDAhJbGxpbm9pczEQMA4GA1UEBwwHQ2hpY2FnbzEUMBIG\n"
  822. "A1UECgwLVG9yIFRlc3RpbmcxFDASBgNVBAMMC1RvciBUZXN0aW5nMB4XDTE1MDkw\n"
  823. "NjEzMzc0MVoXDTQzMDEyMjEzMzc0MVowXjELMAkGA1UEBhMCVVMxETAPBgNVBAgM\n"
  824. "CElsbGlub2lzMRAwDgYDVQQHDAdDaGljYWdvMRQwEgYDVQQKDAtUb3IgVGVzdGlu\n"
  825. "ZzEUMBIGA1UEAwwLVG9yIFRlc3RpbmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw\n"
  826. "ggIKAoICAQCpLMUEiLW5leUgBZoEJms2V7lZRhIAjnJBhVMHD0e3UubNknmaQoxf\n"
  827. "ARz3rvqOaRd0JlV+qM9qE0DjiYcCVP1cAfqAo9d83uS1vwY3YMVJzADlaIiHfyVW\n"
  828. "uEgBy0vvkeUBqaua24dYlcwsemOiXYLu41yM1wkcGHW1AhBNHppY6cznb8TyLgNM\n"
  829. "2x3SGUdzc5XMyAFx51faKGBA3wjs+Hg1PLY7d30nmCgEOBavpm5I1disM/0k+Mcy\n"
  830. "YmAKEo/iHJX/rQzO4b9znP69juLlR8PDBUJEVIG/CYb6+uw8MjjUyiWXYoqfVmN2\n"
  831. "hm/lH8b6rXw1a2Aa3VTeD0DxaWeacMYHY/i01fd5n7hCoDTRNdSw5KJ0L3Z0SKTu\n"
  832. "0lzffKzDaIfyZGlpW5qdouACkWYzsaitQOePVE01PIdO30vUfzNTFDfy42ccx3Di\n"
  833. "59UCu+IXB+eMtrBfsok0Qc63vtF1linJgjHW1z/8ujk8F7/qkOfODhk4l7wngc2A\n"
  834. "EmwWFIFoGaiTEZHB9qteXr4unbXZ0AHpM02uGGwZEGohjFyebEb73M+J57WKKAFb\n"
  835. "PqbLcGUksL1SHNBNAJcVLttX55sO4nbidOS/kA3m+F1R04MBTyQF9qA6YDDHqdI3\n"
  836. "h/3pw0Z4fxVouTYT4/NfRnX4JTP4u+7Mpcoof28VME0qWqD1LnRhFQIDAQABo1Aw\n"
  837. "TjAdBgNVHQ4EFgQUMoAgIXH7pZ3QMRwTjT+DM9Yo/v0wHwYDVR0jBBgwFoAUMoAg\n"
  838. "IXH7pZ3QMRwTjT+DM9Yo/v0wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n"
  839. "AgEAUJxacjXR9sT+Xs6ISFiUsyd0T6WVKMnV46xrYJHirGfx+krWHrjxMY+ZtxYD\n"
  840. "DBDGlo11Qc4v6QrclNf5QUBfIiGQsP9Cm6hHcQ+Tpg9HHCgSqG1YNPwCPReCR4br\n"
  841. "BLvLfrfkcBL2IWM0PdQdCze+59DBfipsULD2mEn9fjYRXQEwb2QWtQ9qRc20Yb/x\n"
  842. "Q4b/+CvUodLkaq7B8MHz0BV8HHcBoph6DYaRmO/N+hPauIuSp6XyaGYcEefGKVKj\n"
  843. "G2+fcsdyXsoijNdL8vNKwm4j2gVwCBnw16J00yfFoV46YcbfqEdJB2je0XSvwXqt\n"
  844. "14AOTngxso2h9k9HLtrfpO1ZG/B5AcCMs1lzbZ2fp5DPHtjvvmvA2RJqgo3yjw4W\n"
  845. "4DHAuTglYFlC3mDHNfNtcGP20JvepcQNzNP2UzwcpOc94hfKikOFw+gf9Vf1qd0y\n"
  846. "h/Sk6OZHn2+JVUPiWHIQV98Vtoh4RmUZDJD+b55ia3fQGTGzt4z1XFzQYSva5sfs\n"
  847. "wocS/papthqWldQU7x+3wofNd5CNU1x6WKXG/yw30IT/4F8ADJD6GeygNT8QJYvt\n"
  848. "u/8lAkbOy6B9xGmSvr0Kk1oq9P2NshA6kalxp1Oz/DTNDdL4AeBXV3JmM6WWCjGn\n"
  849. "Yy1RT69d0rwYc5u/vnqODz1IjvT90smsrkBumGt791FAFeg=\n"
  850. "-----END CERTIFICATE-----\n";
  851. static X509 *
  852. read_cert_from(const char *str)
  853. {
  854. BIO *bio = BIO_new(BIO_s_mem());
  855. BIO_write(bio, str, (int) strlen(str));
  856. X509 *res = PEM_read_bio_X509(bio, NULL, NULL, NULL);
  857. BIO_free(bio);
  858. return res;
  859. }
  860. #ifndef OPENSSL_OPAQUE
  861. static void
  862. test_tortls_verify(void *ignored)
  863. {
  864. (void)ignored;
  865. int ret;
  866. tor_tls_t *tls;
  867. crypto_pk_t *k = NULL;
  868. X509 *cert1 = NULL, *cert2 = NULL, *invalidCert = NULL,
  869. *validCert = NULL, *caCert = NULL;
  870. cert1 = tor_malloc_zero(sizeof(X509));
  871. cert1->references = 10;
  872. cert2 = tor_malloc_zero(sizeof(X509));
  873. cert2->references = 10;
  874. validCert = read_cert_from(validCertString);
  875. caCert = read_cert_from(caCertString);
  876. invalidCert = read_cert_from(notCompletelyValidCertString);
  877. tls = tor_malloc_zero(sizeof(tor_tls_t));
  878. ret = tor_tls_verify(LOG_WARN, tls, &k);
  879. tt_int_op(ret, OP_EQ, -1);
  880. MOCK(try_to_extract_certs_from_tls, fixed_try_to_extract_certs_from_tls);
  881. fixed_try_to_extract_certs_from_tls_cert_out_result = cert1;
  882. ret = tor_tls_verify(LOG_WARN, tls, &k);
  883. tt_int_op(ret, OP_EQ, -1);
  884. fixed_try_to_extract_certs_from_tls_id_cert_out_result = cert2;
  885. ret = tor_tls_verify(LOG_WARN, tls, &k);
  886. tt_int_op(ret, OP_EQ, -1);
  887. fixed_try_to_extract_certs_from_tls_cert_out_result = invalidCert;
  888. fixed_try_to_extract_certs_from_tls_id_cert_out_result = invalidCert;
  889. ret = tor_tls_verify(LOG_WARN, tls, &k);
  890. tt_int_op(ret, OP_EQ, -1);
  891. fixed_try_to_extract_certs_from_tls_cert_out_result = validCert;
  892. fixed_try_to_extract_certs_from_tls_id_cert_out_result = caCert;
  893. ret = tor_tls_verify(LOG_WARN, tls, &k);
  894. tt_int_op(ret, OP_EQ, 0);
  895. tt_assert(k);
  896. done:
  897. UNMOCK(try_to_extract_certs_from_tls);
  898. tor_free(cert1);
  899. tor_free(cert2);
  900. tor_free(tls);
  901. tor_free(k);
  902. }
  903. #endif
  904. #ifndef OPENSSL_OPAQUE
  905. static void
  906. test_tortls_check_lifetime(void *ignored)
  907. {
  908. (void)ignored;
  909. int ret;
  910. tor_tls_t *tls;
  911. X509 *validCert = read_cert_from(validCertString);
  912. time_t now = time(NULL);
  913. tls = tor_malloc_zero(sizeof(tor_tls_t));
  914. ret = tor_tls_check_lifetime(LOG_WARN, tls, 0, 0);
  915. tt_int_op(ret, OP_EQ, -1);
  916. tls->ssl = tor_malloc_zero(sizeof(SSL));
  917. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  918. tls->ssl->session->peer = validCert;
  919. ret = tor_tls_check_lifetime(LOG_WARN, tls, 0, 0);
  920. tt_int_op(ret, OP_EQ, 0);
  921. ASN1_STRING_free(validCert->cert_info->validity->notBefore);
  922. validCert->cert_info->validity->notBefore = ASN1_TIME_set(NULL, now-10);
  923. ASN1_STRING_free(validCert->cert_info->validity->notAfter);
  924. validCert->cert_info->validity->notAfter = ASN1_TIME_set(NULL, now+60);
  925. ret = tor_tls_check_lifetime(LOG_WARN, tls, 0, -1000);
  926. tt_int_op(ret, OP_EQ, -1);
  927. ret = tor_tls_check_lifetime(LOG_WARN, tls, -1000, 0);
  928. tt_int_op(ret, OP_EQ, -1);
  929. done:
  930. tor_free(tls->ssl->session);
  931. tor_free(tls->ssl);
  932. tor_free(tls);
  933. X509_free(validCert);
  934. }
  935. #endif
  936. #ifndef OPENSSL_OPAQUE
  937. static int fixed_ssl_pending_result = 0;
  938. static int
  939. fixed_ssl_pending(const SSL *ignored)
  940. {
  941. (void)ignored;
  942. return fixed_ssl_pending_result;
  943. }
  944. static void
  945. test_tortls_get_pending_bytes(void *ignored)
  946. {
  947. (void)ignored;
  948. int ret;
  949. tor_tls_t *tls;
  950. SSL_METHOD *method;
  951. tls = tor_malloc_zero(sizeof(tor_tls_t));
  952. tls->ssl = tor_malloc_zero(sizeof(SSL));
  953. method = tor_malloc_zero(sizeof(SSL_METHOD));
  954. method->ssl_pending = fixed_ssl_pending;
  955. tls->ssl->method = method;
  956. fixed_ssl_pending_result = 42;
  957. ret = tor_tls_get_pending_bytes(tls);
  958. tt_int_op(ret, OP_EQ, 42);
  959. done:
  960. tor_free(method);
  961. tor_free(tls->ssl);
  962. tor_free(tls);
  963. }
  964. #endif
  965. static void
  966. test_tortls_get_forced_write_size(void *ignored)
  967. {
  968. (void)ignored;
  969. long ret;
  970. tor_tls_t *tls;
  971. tls = tor_malloc_zero(sizeof(tor_tls_t));
  972. tls->wantwrite_n = 43;
  973. ret = tor_tls_get_forced_write_size(tls);
  974. tt_int_op(ret, OP_EQ, 43);
  975. done:
  976. tor_free(tls);
  977. }
  978. static void
  979. test_tortls_get_write_overhead_ratio(void *ignored)
  980. {
  981. (void)ignored;
  982. double ret;
  983. total_bytes_written_over_tls = 0;
  984. ret = tls_get_write_overhead_ratio();
  985. tt_double_op(fabs(ret - 1.0), OP_LT, 1E-12);
  986. total_bytes_written_by_tls = 10;
  987. total_bytes_written_over_tls = 1;
  988. ret = tls_get_write_overhead_ratio();
  989. tt_double_op(fabs(ret - 10.0), OP_LT, 1E-12);
  990. total_bytes_written_by_tls = 10;
  991. total_bytes_written_over_tls = 2;
  992. ret = tls_get_write_overhead_ratio();
  993. tt_double_op(fabs(ret - 5.0), OP_LT, 1E-12);
  994. done:
  995. (void)0;
  996. }
  997. static void
  998. test_tortls_used_v1_handshake(void *ignored)
  999. {
  1000. (void)ignored;
  1001. int ret;
  1002. tor_tls_t *tls;
  1003. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1004. // These tests assume both V2 handshake server and client are enabled
  1005. tls->wasV2Handshake = 0;
  1006. ret = tor_tls_used_v1_handshake(tls);
  1007. tt_int_op(ret, OP_EQ, 1);
  1008. tls->wasV2Handshake = 1;
  1009. ret = tor_tls_used_v1_handshake(tls);
  1010. tt_int_op(ret, OP_EQ, 0);
  1011. done:
  1012. tor_free(tls);
  1013. }
  1014. static void
  1015. test_tortls_get_num_server_handshakes(void *ignored)
  1016. {
  1017. (void)ignored;
  1018. int ret;
  1019. tor_tls_t *tls;
  1020. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1021. tls->server_handshake_count = 3;
  1022. ret = tor_tls_get_num_server_handshakes(tls);
  1023. tt_int_op(ret, OP_EQ, 3);
  1024. done:
  1025. tor_free(tls);
  1026. }
  1027. static void
  1028. test_tortls_server_got_renegotiate(void *ignored)
  1029. {
  1030. (void)ignored;
  1031. int ret;
  1032. tor_tls_t *tls;
  1033. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1034. tls->got_renegotiate = 1;
  1035. ret = tor_tls_server_got_renegotiate(tls);
  1036. tt_int_op(ret, OP_EQ, 1);
  1037. done:
  1038. tor_free(tls);
  1039. }
  1040. #ifndef OPENSSL_OPAQUE
  1041. static void
  1042. test_tortls_SSL_SESSION_get_master_key(void *ignored)
  1043. {
  1044. (void)ignored;
  1045. size_t ret;
  1046. tor_tls_t *tls;
  1047. uint8_t *out;
  1048. out = tor_malloc_zero(1);
  1049. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1050. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1051. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1052. tls->ssl->session->master_key_length = 1;
  1053. #ifndef HAVE_SSL_SESSION_GET_MASTER_KEY
  1054. tls->ssl->session->master_key[0] = 43;
  1055. ret = SSL_SESSION_get_master_key(tls->ssl->session, out, 0);
  1056. tt_int_op(ret, OP_EQ, 1);
  1057. tt_int_op(out[0], OP_EQ, 0);
  1058. ret = SSL_SESSION_get_master_key(tls->ssl->session, out, 1);
  1059. tt_int_op(ret, OP_EQ, 1);
  1060. tt_int_op(out[0], OP_EQ, 43);
  1061. done:
  1062. #endif
  1063. tor_free(tls->ssl->session);
  1064. tor_free(tls->ssl);
  1065. tor_free(tls);
  1066. tor_free(out);
  1067. }
  1068. #endif
  1069. #ifndef OPENSSL_OPAQUE
  1070. static void
  1071. test_tortls_get_tlssecrets(void *ignored)
  1072. {
  1073. (void)ignored;
  1074. int ret;
  1075. uint8_t *secret_out = tor_malloc_zero(DIGEST256_LEN);;
  1076. tor_tls_t *tls;
  1077. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1078. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1079. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1080. tls->ssl->session->master_key_length = 1;
  1081. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  1082. ret = tor_tls_get_tlssecrets(tls, secret_out);
  1083. tt_int_op(ret, OP_EQ, 0);
  1084. done:
  1085. tor_free(secret_out);
  1086. tor_free(tls->ssl->s3);
  1087. tor_free(tls->ssl->session);
  1088. tor_free(tls->ssl);
  1089. tor_free(tls);
  1090. }
  1091. #endif
  1092. #ifndef OPENSSL_OPAQUE
  1093. static void
  1094. test_tortls_get_buffer_sizes(void *ignored)
  1095. {
  1096. (void)ignored;
  1097. int ret;
  1098. tor_tls_t *tls;
  1099. size_t rbuf_c=-1, rbuf_b=-1, wbuf_c=-1, wbuf_b=-1;
  1100. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1101. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1102. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  1103. tls->ssl->s3->rbuf.buf = NULL;
  1104. tls->ssl->s3->rbuf.len = 1;
  1105. tls->ssl->s3->rbuf.offset = 0;
  1106. tls->ssl->s3->rbuf.left = 42;
  1107. tls->ssl->s3->wbuf.buf = NULL;
  1108. tls->ssl->s3->wbuf.len = 2;
  1109. tls->ssl->s3->wbuf.offset = 0;
  1110. tls->ssl->s3->wbuf.left = 43;
  1111. ret = tor_tls_get_buffer_sizes(tls, &rbuf_c, &rbuf_b, &wbuf_c, &wbuf_b);
  1112. #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0)
  1113. tt_int_op(ret, OP_EQ, -1);
  1114. #else
  1115. tt_int_op(ret, OP_EQ, 0);
  1116. tt_int_op(rbuf_c, OP_EQ, 0);
  1117. tt_int_op(wbuf_c, OP_EQ, 0);
  1118. tt_int_op(rbuf_b, OP_EQ, 42);
  1119. tt_int_op(wbuf_b, OP_EQ, 43);
  1120. tls->ssl->s3->rbuf.buf = tor_malloc_zero(1);
  1121. tls->ssl->s3->wbuf.buf = tor_malloc_zero(1);
  1122. ret = tor_tls_get_buffer_sizes(tls, &rbuf_c, &rbuf_b, &wbuf_c, &wbuf_b);
  1123. tt_int_op(ret, OP_EQ, 0);
  1124. tt_int_op(rbuf_c, OP_EQ, 1);
  1125. tt_int_op(wbuf_c, OP_EQ, 2);
  1126. #endif
  1127. done:
  1128. tor_free(tls->ssl->s3->rbuf.buf);
  1129. tor_free(tls->ssl->s3->wbuf.buf);
  1130. tor_free(tls->ssl->s3);
  1131. tor_free(tls->ssl);
  1132. tor_free(tls);
  1133. }
  1134. #endif
  1135. static void
  1136. test_tortls_evaluate_ecgroup_for_tls(void *ignored)
  1137. {
  1138. (void)ignored;
  1139. int ret;
  1140. ret = evaluate_ecgroup_for_tls(NULL);
  1141. tt_int_op(ret, OP_EQ, 1);
  1142. ret = evaluate_ecgroup_for_tls("foobar");
  1143. tt_int_op(ret, OP_EQ, 0);
  1144. ret = evaluate_ecgroup_for_tls("P256");
  1145. tt_int_op(ret, OP_EQ, 1);
  1146. ret = evaluate_ecgroup_for_tls("P224");
  1147. // tt_int_op(ret, OP_EQ, 1); This varies between machines
  1148. done:
  1149. (void)0;
  1150. }
  1151. #ifndef OPENSSL_OPAQUE
  1152. typedef struct cert_pkey_st_local
  1153. {
  1154. X509 *x509;
  1155. EVP_PKEY *privatekey;
  1156. const EVP_MD *digest;
  1157. } CERT_PKEY_local;
  1158. typedef struct sess_cert_st_local
  1159. {
  1160. STACK_OF(X509) *cert_chain;
  1161. int peer_cert_type;
  1162. CERT_PKEY_local *peer_key;
  1163. CERT_PKEY_local peer_pkeys[8];
  1164. int references;
  1165. } SESS_CERT_local;
  1166. static void
  1167. test_tortls_try_to_extract_certs_from_tls(void *ignored)
  1168. {
  1169. (void)ignored;
  1170. tor_tls_t *tls;
  1171. X509 *cert = NULL, *id_cert = NULL, *c1 = NULL, *c2 = NULL;
  1172. SESS_CERT_local *sess = NULL;
  1173. c1 = read_cert_from(validCertString);
  1174. c2 = read_cert_from(caCertString);
  1175. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1176. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1177. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1178. sess = tor_malloc_zero(sizeof(SESS_CERT_local));
  1179. tls->ssl->session->sess_cert = (void *)sess;
  1180. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  1181. tt_assert(!cert);
  1182. tt_assert(!id_cert);
  1183. tls->ssl->session->peer = c1;
  1184. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  1185. tt_assert(cert == c1);
  1186. tt_assert(!id_cert);
  1187. X509_free(cert); /* decrease refcnt */
  1188. sess->cert_chain = sk_X509_new_null();
  1189. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  1190. tt_assert(cert == c1);
  1191. tt_assert(!id_cert);
  1192. X509_free(cert); /* decrease refcnt */
  1193. sk_X509_push(sess->cert_chain, c1);
  1194. sk_X509_push(sess->cert_chain, c2);
  1195. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  1196. tt_assert(cert == c1);
  1197. tt_assert(id_cert);
  1198. X509_free(cert); /* decrease refcnt */
  1199. done:
  1200. sk_X509_free(sess->cert_chain);
  1201. tor_free(sess);
  1202. tor_free(tls->ssl->session);
  1203. tor_free(tls->ssl);
  1204. tor_free(tls);
  1205. X509_free(c1);
  1206. X509_free(c2);
  1207. }
  1208. #endif
  1209. #ifndef OPENSSL_OPAQUE
  1210. static void
  1211. test_tortls_get_peer_cert(void *ignored)
  1212. {
  1213. (void)ignored;
  1214. tor_x509_cert_t *ret;
  1215. tor_tls_t *tls;
  1216. X509 *cert = NULL;
  1217. cert = read_cert_from(validCertString);
  1218. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1219. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1220. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1221. ret = tor_tls_get_peer_cert(tls);
  1222. tt_assert(!ret);
  1223. tls->ssl->session->peer = cert;
  1224. ret = tor_tls_get_peer_cert(tls);
  1225. tt_assert(ret);
  1226. tt_assert(ret->cert == cert);
  1227. done:
  1228. tor_x509_cert_free(ret);
  1229. tor_free(tls->ssl->session);
  1230. tor_free(tls->ssl);
  1231. tor_free(tls);
  1232. X509_free(cert);
  1233. }
  1234. #endif
  1235. #ifndef OPENSSL_OPAQUE
  1236. static void
  1237. test_tortls_peer_has_cert(void *ignored)
  1238. {
  1239. (void)ignored;
  1240. int ret;
  1241. tor_tls_t *tls;
  1242. X509 *cert = NULL;
  1243. cert = read_cert_from(validCertString);
  1244. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1245. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1246. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1247. ret = tor_tls_peer_has_cert(tls);
  1248. tt_assert(!ret);
  1249. tls->ssl->session->peer = cert;
  1250. ret = tor_tls_peer_has_cert(tls);
  1251. tt_assert(ret);
  1252. done:
  1253. tor_free(tls->ssl->session);
  1254. tor_free(tls->ssl);
  1255. tor_free(tls);
  1256. X509_free(cert);
  1257. }
  1258. #endif
  1259. static void
  1260. test_tortls_is_server(void *ignored)
  1261. {
  1262. (void)ignored;
  1263. tor_tls_t *tls;
  1264. int ret;
  1265. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1266. tls->isServer = 1;
  1267. ret = tor_tls_is_server(tls);
  1268. tt_int_op(ret, OP_EQ, 1);
  1269. done:
  1270. tor_free(tls);
  1271. }
  1272. #ifndef OPENSSL_OPAQUE
  1273. static void
  1274. test_tortls_session_secret_cb(void *ignored)
  1275. {
  1276. (void)ignored;
  1277. tor_tls_t *tls;
  1278. SSL_CTX *ctx;
  1279. STACK_OF(SSL_CIPHER) *ciphers = NULL;
  1280. SSL_CIPHER *one;
  1281. SSL_library_init();
  1282. SSL_load_error_strings();
  1283. tor_tls_allocate_tor_tls_object_ex_data_index();
  1284. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1285. tls->magic = TOR_TLS_MAGIC;
  1286. ctx = SSL_CTX_new(TLSv1_method());
  1287. tls->ssl = SSL_new(ctx);
  1288. SSL_set_ex_data(tls->ssl, tor_tls_object_ex_data_index, tls);
  1289. SSL_set_session_secret_cb(tls->ssl, tor_tls_session_secret_cb, NULL);
  1290. tor_tls_session_secret_cb(tls->ssl, NULL, NULL, NULL, NULL, NULL);
  1291. tt_assert(!tls->ssl->tls_session_secret_cb);
  1292. one = get_cipher_by_name("ECDH-RSA-AES256-GCM-SHA384");
  1293. one->id = 0x00ff;
  1294. ciphers = sk_SSL_CIPHER_new_null();
  1295. sk_SSL_CIPHER_push(ciphers, one);
  1296. tls->client_cipher_list_type = 0;
  1297. tor_tls_session_secret_cb(tls->ssl, NULL, NULL, ciphers, NULL, NULL);
  1298. tt_assert(!tls->ssl->tls_session_secret_cb);
  1299. done:
  1300. sk_SSL_CIPHER_free(ciphers);
  1301. SSL_free(tls->ssl);
  1302. SSL_CTX_free(ctx);
  1303. tor_free(tls);
  1304. }
  1305. #endif
  1306. #ifndef OPENSSL_OPAQUE
  1307. /* TODO: It seems block_renegotiation and unblock_renegotiation and
  1308. * using different blags. This might not be correct */
  1309. static void
  1310. test_tortls_block_renegotiation(void *ignored)
  1311. {
  1312. (void)ignored;
  1313. tor_tls_t *tls;
  1314. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1315. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1316. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  1317. #ifndef SUPPORT_UNSAFE_RENEGOTIATION_FLAG
  1318. #define SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0
  1319. #endif
  1320. tls->ssl->s3->flags = SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
  1321. tor_tls_block_renegotiation(tls);
  1322. #ifndef OPENSSL_1_1_API
  1323. tt_assert(!(tls->ssl->s3->flags &
  1324. SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION));
  1325. #endif
  1326. done:
  1327. tor_free(tls->ssl->s3);
  1328. tor_free(tls->ssl);
  1329. tor_free(tls);
  1330. }
  1331. static void
  1332. test_tortls_unblock_renegotiation(void *ignored)
  1333. {
  1334. (void)ignored;
  1335. tor_tls_t *tls;
  1336. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1337. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1338. tor_tls_unblock_renegotiation(tls);
  1339. tt_uint_op(SSL_get_options(tls->ssl) &
  1340. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, OP_EQ,
  1341. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
  1342. done:
  1343. tor_free(tls->ssl);
  1344. tor_free(tls);
  1345. }
  1346. #endif
  1347. #ifndef OPENSSL_OPAQUE
  1348. static void
  1349. test_tortls_assert_renegotiation_unblocked(void *ignored)
  1350. {
  1351. (void)ignored;
  1352. tor_tls_t *tls;
  1353. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1354. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1355. tor_tls_unblock_renegotiation(tls);
  1356. tor_tls_assert_renegotiation_unblocked(tls);
  1357. /* No assertion here - this test will fail if tor_assert is turned on
  1358. * and things are bad. */
  1359. tor_free(tls->ssl);
  1360. tor_free(tls);
  1361. }
  1362. #endif
  1363. static void
  1364. test_tortls_set_logged_address(void *ignored)
  1365. {
  1366. (void)ignored;
  1367. tor_tls_t *tls;
  1368. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1369. tor_tls_set_logged_address(tls, "foo bar");
  1370. tt_str_op(tls->address, OP_EQ, "foo bar");
  1371. tor_tls_set_logged_address(tls, "foo bar 2");
  1372. tt_str_op(tls->address, OP_EQ, "foo bar 2");
  1373. done:
  1374. tor_free(tls->address);
  1375. tor_free(tls);
  1376. }
  1377. #ifndef OPENSSL_OPAQUE
  1378. static void
  1379. example_cb(tor_tls_t *t, void *arg)
  1380. {
  1381. (void)t;
  1382. (void)arg;
  1383. }
  1384. static void
  1385. test_tortls_set_renegotiate_callback(void *ignored)
  1386. {
  1387. (void)ignored;
  1388. tor_tls_t *tls;
  1389. const char *arg = "hello";
  1390. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1391. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1392. tor_tls_set_renegotiate_callback(tls, example_cb, (void*)arg);
  1393. tt_assert(tls->negotiated_callback == example_cb);
  1394. tt_assert(tls->callback_arg == arg);
  1395. tt_assert(!tls->got_renegotiate);
  1396. /* Assumes V2_HANDSHAKE_SERVER */
  1397. tt_assert(tls->ssl->info_callback == tor_tls_server_info_callback);
  1398. tor_tls_set_renegotiate_callback(tls, NULL, (void*)arg);
  1399. tt_assert(tls->ssl->info_callback == tor_tls_debug_state_callback);
  1400. done:
  1401. tor_free(tls->ssl);
  1402. tor_free(tls);
  1403. }
  1404. #endif
  1405. #ifndef OPENSSL_OPAQUE
  1406. static SSL_CIPHER *fixed_cipher1 = NULL;
  1407. static SSL_CIPHER *fixed_cipher2 = NULL;
  1408. static const SSL_CIPHER *
  1409. fake_get_cipher(unsigned ncipher)
  1410. {
  1411. switch (ncipher) {
  1412. case 1:
  1413. return fixed_cipher1;
  1414. case 2:
  1415. return fixed_cipher2;
  1416. default:
  1417. return NULL;
  1418. }
  1419. }
  1420. #endif
  1421. #ifndef OPENSSL_OPAQUE
  1422. static void
  1423. test_tortls_find_cipher_by_id(void *ignored)
  1424. {
  1425. (void)ignored;
  1426. int ret;
  1427. SSL *ssl;
  1428. SSL_CTX *ctx;
  1429. const SSL_METHOD *m = TLSv1_method();
  1430. SSL_METHOD *empty_method = tor_malloc_zero(sizeof(SSL_METHOD));
  1431. fixed_cipher1 = tor_malloc_zero(sizeof(SSL_CIPHER));
  1432. fixed_cipher2 = tor_malloc_zero(sizeof(SSL_CIPHER));
  1433. fixed_cipher2->id = 0xC00A;
  1434. SSL_library_init();
  1435. SSL_load_error_strings();
  1436. ctx = SSL_CTX_new(m);
  1437. ssl = SSL_new(ctx);
  1438. ret = find_cipher_by_id(ssl, NULL, 0xC00A);
  1439. tt_int_op(ret, OP_EQ, 1);
  1440. ret = find_cipher_by_id(ssl, m, 0xC00A);
  1441. tt_int_op(ret, OP_EQ, 1);
  1442. ret = find_cipher_by_id(ssl, m, 0xFFFF);
  1443. tt_int_op(ret, OP_EQ, 0);
  1444. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1445. tt_int_op(ret, OP_EQ, 1);
  1446. ret = find_cipher_by_id(ssl, empty_method, 0xFFFF);
  1447. #ifdef HAVE_SSL_CIPHER_FIND
  1448. tt_int_op(ret, OP_EQ, 0);
  1449. #else
  1450. tt_int_op(ret, OP_EQ, 1);
  1451. #endif
  1452. empty_method->get_cipher = fake_get_cipher;
  1453. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1454. tt_int_op(ret, OP_EQ, 1);
  1455. empty_method->get_cipher = m->get_cipher;
  1456. empty_method->num_ciphers = m->num_ciphers;
  1457. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1458. tt_int_op(ret, OP_EQ, 1);
  1459. empty_method->get_cipher = fake_get_cipher;
  1460. empty_method->num_ciphers = m->num_ciphers;
  1461. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1462. tt_int_op(ret, OP_EQ, 1);
  1463. empty_method->num_ciphers = fake_num_ciphers;
  1464. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1465. #ifdef HAVE_SSL_CIPHER_FIND
  1466. tt_int_op(ret, OP_EQ, 1);
  1467. #else
  1468. tt_int_op(ret, OP_EQ, 0);
  1469. #endif
  1470. done:
  1471. tor_free(empty_method);
  1472. SSL_free(ssl);
  1473. SSL_CTX_free(ctx);
  1474. tor_free(fixed_cipher1);
  1475. }
  1476. #endif
  1477. #ifndef OPENSSL_OPAQUE
  1478. static void
  1479. test_tortls_debug_state_callback(void *ignored)
  1480. {
  1481. (void)ignored;
  1482. SSL *ssl;
  1483. char *buf = tor_malloc_zero(1000);
  1484. int n;
  1485. int previous_log = setup_capture_of_logs(LOG_DEBUG);
  1486. ssl = tor_malloc_zero(sizeof(SSL));
  1487. tor_tls_debug_state_callback(ssl, 32, 45);
  1488. n = tor_snprintf(buf, 1000, "SSL %p is now in state unknown"
  1489. " state [type=32,val=45].\n", ssl);
  1490. /* tor's snprintf returns -1 on error */
  1491. tt_int_op(n, OP_NE, -1);
  1492. expect_log_msg(buf);
  1493. done:
  1494. teardown_capture_of_logs(previous_log);
  1495. tor_free(buf);
  1496. tor_free(ssl);
  1497. }
  1498. #endif
  1499. #ifndef OPENSSL_OPAQUE
  1500. static void
  1501. test_tortls_server_info_callback(void *ignored)
  1502. {
  1503. (void)ignored;
  1504. tor_tls_t *tls;
  1505. SSL_CTX *ctx;
  1506. SSL *ssl;
  1507. int previous_log = setup_capture_of_logs(LOG_WARN);
  1508. SSL_library_init();
  1509. SSL_load_error_strings();
  1510. ctx = SSL_CTX_new(TLSv1_method());
  1511. ssl = SSL_new(ctx);
  1512. tor_tls_allocate_tor_tls_object_ex_data_index();
  1513. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1514. tls->magic = TOR_TLS_MAGIC;
  1515. tls->ssl = ssl;
  1516. tor_tls_server_info_callback(NULL, 0, 0);
  1517. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_A);
  1518. mock_clean_saved_logs();
  1519. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1520. expect_log_msg("Couldn't look up the tls for an SSL*. How odd!\n");
  1521. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_B);
  1522. mock_clean_saved_logs();
  1523. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1524. expect_log_msg("Couldn't look up the tls for an SSL*. How odd!\n");
  1525. SSL_set_state(ssl, 99);
  1526. mock_clean_saved_logs();
  1527. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1528. expect_no_log_entry();
  1529. SSL_set_ex_data(tls->ssl, tor_tls_object_ex_data_index, tls);
  1530. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_B);
  1531. tls->negotiated_callback = 0;
  1532. tls->server_handshake_count = 120;
  1533. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1534. tt_int_op(tls->server_handshake_count, OP_EQ, 121);
  1535. tls->server_handshake_count = 127;
  1536. tls->negotiated_callback = (void *)1;
  1537. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1538. tt_int_op(tls->server_handshake_count, OP_EQ, 127);
  1539. tt_int_op(tls->got_renegotiate, OP_EQ, 1);
  1540. tls->ssl->session = SSL_SESSION_new();
  1541. tls->wasV2Handshake = 0;
  1542. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1543. tt_int_op(tls->wasV2Handshake, OP_EQ, 0);
  1544. done:
  1545. teardown_capture_of_logs(previous_log);
  1546. SSL_free(ssl);
  1547. SSL_CTX_free(ctx);
  1548. tor_free(tls);
  1549. }
  1550. #endif
  1551. #ifndef OPENSSL_OPAQUE
  1552. static int fixed_ssl_read_result_index;
  1553. static int fixed_ssl_read_result[5];
  1554. static int fixed_ssl_shutdown_result;
  1555. static int
  1556. fixed_ssl_read(SSL *s, void *buf, int len)
  1557. {
  1558. (void)s;
  1559. (void)buf;
  1560. (void)len;
  1561. return fixed_ssl_read_result[fixed_ssl_read_result_index++];
  1562. }
  1563. static int
  1564. fixed_ssl_shutdown(SSL *s)
  1565. {
  1566. (void)s;
  1567. return fixed_ssl_shutdown_result;
  1568. }
  1569. #ifndef LIBRESSL_VERSION_NUMBER
  1570. static int fixed_ssl_state_to_set;
  1571. static tor_tls_t *fixed_tls;
  1572. static int
  1573. setting_version_ssl_shutdown(SSL *s)
  1574. {
  1575. s->version = SSL2_VERSION;
  1576. return fixed_ssl_shutdown_result;
  1577. }
  1578. static int
  1579. setting_version_and_state_ssl_shutdown(SSL *s)
  1580. {
  1581. fixed_tls->state = fixed_ssl_state_to_set;
  1582. s->version = SSL2_VERSION;
  1583. return fixed_ssl_shutdown_result;
  1584. }
  1585. #endif
  1586. static int
  1587. dummy_handshake_func(SSL *s)
  1588. {
  1589. (void)s;
  1590. return 1;
  1591. }
  1592. static void
  1593. test_tortls_shutdown(void *ignored)
  1594. {
  1595. (void)ignored;
  1596. int ret;
  1597. tor_tls_t *tls;
  1598. SSL_METHOD *method = give_me_a_test_method();
  1599. int previous_log = setup_capture_of_logs(LOG_WARN);
  1600. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1601. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1602. tls->ssl->method = method;
  1603. method->ssl_read = fixed_ssl_read;
  1604. method->ssl_shutdown = fixed_ssl_shutdown;
  1605. ret = tor_tls_shutdown(tls);
  1606. tt_int_op(ret, OP_EQ, -9);
  1607. tls->state = TOR_TLS_ST_SENTCLOSE;
  1608. fixed_ssl_read_result_index = 0;
  1609. fixed_ssl_read_result[0] = 10;
  1610. fixed_ssl_read_result[1] = -1;
  1611. ret = tor_tls_shutdown(tls);
  1612. tt_int_op(ret, OP_EQ, -9);
  1613. #ifndef LIBRESSL_VERSION_NUMBER
  1614. tls->ssl->handshake_func = dummy_handshake_func;
  1615. fixed_ssl_read_result_index = 0;
  1616. fixed_ssl_read_result[0] = 10;
  1617. fixed_ssl_read_result[1] = 42;
  1618. fixed_ssl_read_result[2] = 0;
  1619. fixed_ssl_shutdown_result = 1;
  1620. ERR_clear_error();
  1621. tls->ssl->version = SSL2_VERSION;
  1622. ret = tor_tls_shutdown(tls);
  1623. tt_int_op(ret, OP_EQ, TOR_TLS_DONE);
  1624. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_CLOSED);
  1625. fixed_ssl_read_result_index = 0;
  1626. fixed_ssl_read_result[0] = 10;
  1627. fixed_ssl_read_result[1] = 42;
  1628. fixed_ssl_read_result[2] = 0;
  1629. fixed_ssl_shutdown_result = 0;
  1630. ERR_clear_error();
  1631. tls->ssl->version = 0;
  1632. ret = tor_tls_shutdown(tls);
  1633. tt_int_op(ret, OP_EQ, TOR_TLS_DONE);
  1634. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_CLOSED);
  1635. fixed_ssl_read_result_index = 0;
  1636. fixed_ssl_read_result[0] = 10;
  1637. fixed_ssl_read_result[1] = 42;
  1638. fixed_ssl_read_result[2] = 0;
  1639. fixed_ssl_shutdown_result = 0;
  1640. ERR_clear_error();
  1641. tls->ssl->version = 0;
  1642. method->ssl_shutdown = setting_version_ssl_shutdown;
  1643. ret = tor_tls_shutdown(tls);
  1644. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1645. fixed_ssl_read_result_index = 0;
  1646. fixed_ssl_read_result[0] = 10;
  1647. fixed_ssl_read_result[1] = 42;
  1648. fixed_ssl_read_result[2] = 0;
  1649. fixed_ssl_shutdown_result = 0;
  1650. fixed_tls = tls;
  1651. fixed_ssl_state_to_set = TOR_TLS_ST_GOTCLOSE;
  1652. ERR_clear_error();
  1653. tls->ssl->version = 0;
  1654. method->ssl_shutdown = setting_version_and_state_ssl_shutdown;
  1655. ret = tor_tls_shutdown(tls);
  1656. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1657. fixed_ssl_read_result_index = 0;
  1658. fixed_ssl_read_result[0] = 10;
  1659. fixed_ssl_read_result[1] = 42;
  1660. fixed_ssl_read_result[2] = 0;
  1661. fixed_ssl_read_result[3] = -1;
  1662. fixed_ssl_shutdown_result = 0;
  1663. fixed_tls = tls;
  1664. fixed_ssl_state_to_set = 0;
  1665. ERR_clear_error();
  1666. tls->ssl->version = 0;
  1667. method->ssl_shutdown = setting_version_and_state_ssl_shutdown;
  1668. ret = tor_tls_shutdown(tls);
  1669. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1670. #endif
  1671. done:
  1672. teardown_capture_of_logs(previous_log);
  1673. tor_free(method);
  1674. tor_free(tls->ssl);
  1675. tor_free(tls);
  1676. }
  1677. static int negotiated_callback_called;
  1678. static void
  1679. negotiated_callback_setter(tor_tls_t *t, void *arg)
  1680. {
  1681. (void)t;
  1682. (void)arg;
  1683. negotiated_callback_called++;
  1684. }
  1685. static void
  1686. test_tortls_read(void *ignored)
  1687. {
  1688. (void)ignored;
  1689. int ret;
  1690. tor_tls_t *tls;
  1691. char buf[100];
  1692. SSL_METHOD *method = give_me_a_test_method();
  1693. int previous_log = setup_capture_of_logs(LOG_WARN);
  1694. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1695. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1696. tls->state = TOR_TLS_ST_OPEN;
  1697. ret = tor_tls_read(tls, buf, 10);
  1698. tt_int_op(ret, OP_EQ, -9);
  1699. /* These tests assume that V2_HANDSHAKE_SERVER is set */
  1700. tls->ssl->handshake_func = dummy_handshake_func;
  1701. tls->ssl->method = method;
  1702. method->ssl_read = fixed_ssl_read;
  1703. fixed_ssl_read_result_index = 0;
  1704. fixed_ssl_read_result[0] = 42;
  1705. tls->state = TOR_TLS_ST_OPEN;
  1706. ERR_clear_error();
  1707. ret = tor_tls_read(tls, buf, 10);
  1708. tt_int_op(ret, OP_EQ, 42);
  1709. tls->state = TOR_TLS_ST_OPEN;
  1710. tls->got_renegotiate = 1;
  1711. fixed_ssl_read_result_index = 0;
  1712. ERR_clear_error();
  1713. ret = tor_tls_read(tls, buf, 10);
  1714. tt_int_op(tls->got_renegotiate, OP_EQ, 0);
  1715. tls->state = TOR_TLS_ST_OPEN;
  1716. tls->got_renegotiate = 1;
  1717. negotiated_callback_called = 0;
  1718. tls->negotiated_callback = negotiated_callback_setter;
  1719. fixed_ssl_read_result_index = 0;
  1720. ERR_clear_error();
  1721. ret = tor_tls_read(tls, buf, 10);
  1722. tt_int_op(negotiated_callback_called, OP_EQ, 1);
  1723. #ifndef LIBRESSL_VERSION_NUMBER
  1724. fixed_ssl_read_result_index = 0;
  1725. fixed_ssl_read_result[0] = 0;
  1726. tls->ssl->version = SSL2_VERSION;
  1727. ERR_clear_error();
  1728. ret = tor_tls_read(tls, buf, 10);
  1729. tt_int_op(ret, OP_EQ, TOR_TLS_CLOSE);
  1730. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_CLOSED);
  1731. #endif
  1732. // TODO: fill up
  1733. done:
  1734. teardown_capture_of_logs(previous_log);
  1735. tor_free(tls->ssl);
  1736. tor_free(tls);
  1737. tor_free(method);
  1738. }
  1739. static int fixed_ssl_write_result;
  1740. static int
  1741. fixed_ssl_write(SSL *s, const void *buf, int len)
  1742. {
  1743. (void)s;
  1744. (void)buf;
  1745. (void)len;
  1746. return fixed_ssl_write_result;
  1747. }
  1748. static void
  1749. test_tortls_write(void *ignored)
  1750. {
  1751. (void)ignored;
  1752. int ret;
  1753. tor_tls_t *tls;
  1754. SSL_METHOD *method = give_me_a_test_method();
  1755. char buf[100];
  1756. int previous_log = setup_capture_of_logs(LOG_WARN);
  1757. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1758. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1759. tls->state = TOR_TLS_ST_OPEN;
  1760. ret = tor_tls_write(tls, buf, 0);
  1761. tt_int_op(ret, OP_EQ, 0);
  1762. ret = tor_tls_write(tls, buf, 10);
  1763. tt_int_op(ret, OP_EQ, -9);
  1764. tls->ssl->method = method;
  1765. tls->wantwrite_n = 1;
  1766. ret = tor_tls_write(tls, buf, 10);
  1767. tt_int_op(tls->wantwrite_n, OP_EQ, 0);
  1768. method->ssl_write = fixed_ssl_write;
  1769. tls->ssl->handshake_func = dummy_handshake_func;
  1770. fixed_ssl_write_result = 1;
  1771. ERR_clear_error();
  1772. ret = tor_tls_write(tls, buf, 10);
  1773. tt_int_op(ret, OP_EQ, 1);
  1774. fixed_ssl_write_result = -1;
  1775. ERR_clear_error();
  1776. tls->ssl->rwstate = SSL_READING;
  1777. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  1778. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_READ;
  1779. ret = tor_tls_write(tls, buf, 10);
  1780. tt_int_op(ret, OP_EQ, TOR_TLS_WANTREAD);
  1781. ERR_clear_error();
  1782. tls->ssl->rwstate = SSL_READING;
  1783. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  1784. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_WRITE;
  1785. ret = tor_tls_write(tls, buf, 10);
  1786. tt_int_op(ret, OP_EQ, TOR_TLS_WANTWRITE);
  1787. done:
  1788. teardown_capture_of_logs(previous_log);
  1789. BIO_free(tls->ssl->rbio);
  1790. tor_free(tls->ssl);
  1791. tor_free(tls);
  1792. tor_free(method);
  1793. }
  1794. #endif
  1795. #ifndef OPENSSL_OPAQUE
  1796. static int fixed_ssl_accept_result;
  1797. static int fixed_ssl_connect_result;
  1798. static int
  1799. setting_error_ssl_accept(SSL *ssl)
  1800. {
  1801. (void)ssl;
  1802. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  1803. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  1804. return fixed_ssl_accept_result;
  1805. }
  1806. static int
  1807. setting_error_ssl_connect(SSL *ssl)
  1808. {
  1809. (void)ssl;
  1810. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  1811. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  1812. return fixed_ssl_connect_result;
  1813. }
  1814. static int
  1815. fixed_ssl_accept(SSL *ssl)
  1816. {
  1817. (void) ssl;
  1818. return fixed_ssl_accept_result;
  1819. }
  1820. static void
  1821. test_tortls_handshake(void *ignored)
  1822. {
  1823. (void)ignored;
  1824. int ret;
  1825. tor_tls_t *tls;
  1826. SSL_CTX *ctx;
  1827. SSL_METHOD *method = give_me_a_test_method();
  1828. int previous_log = setup_capture_of_logs(LOG_INFO);
  1829. SSL_library_init();
  1830. SSL_load_error_strings();
  1831. ctx = SSL_CTX_new(TLSv1_method());
  1832. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1833. tls->ssl = SSL_new(ctx);
  1834. tls->state = TOR_TLS_ST_HANDSHAKE;
  1835. ret = tor_tls_handshake(tls);
  1836. tt_int_op(ret, OP_EQ, -9);
  1837. tls->isServer = 1;
  1838. tls->state = TOR_TLS_ST_HANDSHAKE;
  1839. ret = tor_tls_handshake(tls);
  1840. tt_int_op(ret, OP_EQ, -9);
  1841. tls->ssl->method = method;
  1842. method->ssl_accept = fixed_ssl_accept;
  1843. fixed_ssl_accept_result = 2;
  1844. ERR_clear_error();
  1845. tls->state = TOR_TLS_ST_HANDSHAKE;
  1846. ret = tor_tls_handshake(tls);
  1847. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_OPEN);
  1848. method->ssl_accept = setting_error_ssl_accept;
  1849. fixed_ssl_accept_result = 1;
  1850. ERR_clear_error();
  1851. mock_clean_saved_logs();
  1852. tls->state = TOR_TLS_ST_HANDSHAKE;
  1853. ret = tor_tls_handshake(tls);
  1854. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1855. expect_log_entry();
  1856. /* This fails on jessie. Investigate why! */
  1857. #if 0
  1858. expect_log_msg("TLS error while handshaking: (null) (in bignum routines:"
  1859. "(null):SSLv3 write client hello B)\n");
  1860. expect_log_msg("TLS error while handshaking: (null) (in system library:"
  1861. "connect:SSLv3 write client hello B)\n");
  1862. #endif
  1863. expect_log_severity(LOG_INFO);
  1864. tls->isServer = 0;
  1865. method->ssl_connect = setting_error_ssl_connect;
  1866. fixed_ssl_connect_result = 1;
  1867. ERR_clear_error();
  1868. mock_clean_saved_logs();
  1869. tls->state = TOR_TLS_ST_HANDSHAKE;
  1870. ret = tor_tls_handshake(tls);
  1871. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1872. expect_log_entry();
  1873. #if 0
  1874. /* See above */
  1875. expect_log_msg("TLS error while handshaking: "
  1876. "(null) (in bignum routines:(null):SSLv3 write client hello B)\n");
  1877. expect_log_msg("TLS error while handshaking: "
  1878. "(null) (in system library:connect:SSLv3 write client hello B)\n");
  1879. #endif
  1880. expect_log_severity(LOG_WARN);
  1881. done:
  1882. teardown_capture_of_logs(previous_log);
  1883. SSL_free(tls->ssl);
  1884. SSL_CTX_free(ctx);
  1885. tor_free(tls);
  1886. tor_free(method);
  1887. }
  1888. #endif
  1889. #ifndef OPENSSL_OPAQUE
  1890. static void
  1891. test_tortls_finish_handshake(void *ignored)
  1892. {
  1893. (void)ignored;
  1894. int ret;
  1895. tor_tls_t *tls;
  1896. SSL_CTX *ctx;
  1897. SSL_METHOD *method = give_me_a_test_method();
  1898. SSL_library_init();
  1899. SSL_load_error_strings();
  1900. X509 *c1 = read_cert_from(validCertString);
  1901. SESS_CERT_local *sess = NULL;
  1902. ctx = SSL_CTX_new(method);
  1903. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1904. tls->ssl = SSL_new(ctx);
  1905. tls->state = TOR_TLS_ST_OPEN;
  1906. ret = tor_tls_finish_handshake(tls);
  1907. tt_int_op(ret, OP_EQ, 0);
  1908. tls->isServer = 1;
  1909. tls->wasV2Handshake = 0;
  1910. ret = tor_tls_finish_handshake(tls);
  1911. tt_int_op(ret, OP_EQ, 0);
  1912. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1913. tls->wasV2Handshake = 1;
  1914. ret = tor_tls_finish_handshake(tls);
  1915. tt_int_op(ret, OP_EQ, 0);
  1916. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1917. tls->wasV2Handshake = 1;
  1918. tls->ssl->session = SSL_SESSION_new();
  1919. ret = tor_tls_finish_handshake(tls);
  1920. tt_int_op(ret, OP_EQ, 0);
  1921. tt_int_op(tls->wasV2Handshake, OP_EQ, 0);
  1922. tls->isServer = 0;
  1923. sess = tor_malloc_zero(sizeof(SESS_CERT_local));
  1924. tls->ssl->session->sess_cert = (void *)sess;
  1925. sess->cert_chain = sk_X509_new_null();
  1926. sk_X509_push(sess->cert_chain, c1);
  1927. tls->ssl->session->peer = c1;
  1928. tls->wasV2Handshake = 0;
  1929. ret = tor_tls_finish_handshake(tls);
  1930. tt_int_op(ret, OP_EQ, 0);
  1931. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1932. method->num_ciphers = fake_num_ciphers;
  1933. ret = tor_tls_finish_handshake(tls);
  1934. tt_int_op(ret, OP_EQ, -9);
  1935. done:
  1936. if (sess)
  1937. sk_X509_free(sess->cert_chain);
  1938. if (tls->ssl && tls->ssl->session) {
  1939. tor_free(tls->ssl->session->sess_cert);
  1940. }
  1941. SSL_free(tls->ssl);
  1942. tor_free(tls);
  1943. SSL_CTX_free(ctx);
  1944. tor_free(method);
  1945. }
  1946. #endif
  1947. static int fixed_crypto_pk_new_result_index;
  1948. static crypto_pk_t *fixed_crypto_pk_new_result[5];
  1949. static crypto_pk_t *
  1950. fixed_crypto_pk_new(void)
  1951. {
  1952. return fixed_crypto_pk_new_result[fixed_crypto_pk_new_result_index++];
  1953. }
  1954. #ifndef OPENSSL_OPAQUE
  1955. static int fixed_crypto_pk_generate_key_with_bits_result_index;
  1956. static int fixed_crypto_pk_generate_key_with_bits_result[5];
  1957. static int fixed_tor_tls_create_certificate_result_index;
  1958. static X509 *fixed_tor_tls_create_certificate_result[5];
  1959. static int fixed_tor_x509_cert_new_result_index;
  1960. static tor_x509_cert_t *fixed_tor_x509_cert_new_result[5];
  1961. static int
  1962. fixed_crypto_pk_generate_key_with_bits(crypto_pk_t *env, int bits)
  1963. {
  1964. (void)env;
  1965. (void)bits;
  1966. return fixed_crypto_pk_generate_key_with_bits_result[
  1967. fixed_crypto_pk_generate_key_with_bits_result_index++];
  1968. }
  1969. static X509 *
  1970. fixed_tor_tls_create_certificate(crypto_pk_t *rsa,
  1971. crypto_pk_t *rsa_sign,
  1972. const char *cname,
  1973. const char *cname_sign,
  1974. unsigned int cert_lifetime)
  1975. {
  1976. (void)rsa;
  1977. (void)rsa_sign;
  1978. (void)cname;
  1979. (void)cname_sign;
  1980. (void)cert_lifetime;
  1981. return fixed_tor_tls_create_certificate_result[
  1982. fixed_tor_tls_create_certificate_result_index++];
  1983. }
  1984. static tor_x509_cert_t *
  1985. fixed_tor_x509_cert_new(X509 *x509_cert)
  1986. {
  1987. (void) x509_cert;
  1988. return fixed_tor_x509_cert_new_result[
  1989. fixed_tor_x509_cert_new_result_index++];
  1990. }
  1991. static void
  1992. test_tortls_context_new(void *ignored)
  1993. {
  1994. (void)ignored;
  1995. tor_tls_context_t *ret;
  1996. crypto_pk_t *pk1, *pk2, *pk3, *pk4, *pk5, *pk6, *pk7, *pk8, *pk9, *pk10,
  1997. *pk11, *pk12, *pk13, *pk14, *pk15, *pk16, *pk17, *pk18;
  1998. pk1 = crypto_pk_new();
  1999. pk2 = crypto_pk_new();
  2000. pk3 = crypto_pk_new();
  2001. pk4 = crypto_pk_new();
  2002. pk5 = crypto_pk_new();
  2003. pk6 = crypto_pk_new();
  2004. pk7 = crypto_pk_new();
  2005. pk8 = crypto_pk_new();
  2006. pk9 = crypto_pk_new();
  2007. pk10 = crypto_pk_new();
  2008. pk11 = crypto_pk_new();
  2009. pk12 = crypto_pk_new();
  2010. pk13 = crypto_pk_new();
  2011. pk14 = crypto_pk_new();
  2012. pk15 = crypto_pk_new();
  2013. pk16 = crypto_pk_new();
  2014. pk17 = crypto_pk_new();
  2015. pk18 = crypto_pk_new();
  2016. fixed_crypto_pk_new_result_index = 0;
  2017. fixed_crypto_pk_new_result[0] = NULL;
  2018. MOCK(crypto_pk_new, fixed_crypto_pk_new);
  2019. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2020. tt_assert(!ret);
  2021. MOCK(crypto_pk_generate_key_with_bits,
  2022. fixed_crypto_pk_generate_key_with_bits);
  2023. fixed_crypto_pk_new_result_index = 0;
  2024. fixed_crypto_pk_new_result[0] = pk1;
  2025. fixed_crypto_pk_new_result[1] = NULL;
  2026. fixed_crypto_pk_generate_key_with_bits_result[0] = -1;
  2027. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2028. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2029. tt_assert(!ret);
  2030. fixed_crypto_pk_new_result_index = 0;
  2031. fixed_crypto_pk_new_result[0] = pk2;
  2032. fixed_crypto_pk_new_result[1] = NULL;
  2033. fixed_crypto_pk_generate_key_with_bits_result[0] = 0;
  2034. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2035. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2036. tt_assert(!ret);
  2037. fixed_crypto_pk_new_result_index = 0;
  2038. fixed_crypto_pk_new_result[0] = pk3;
  2039. fixed_crypto_pk_new_result[1] = pk4;
  2040. fixed_crypto_pk_new_result[2] = NULL;
  2041. fixed_crypto_pk_generate_key_with_bits_result[0] = 0;
  2042. fixed_crypto_pk_generate_key_with_bits_result[1] = -1;
  2043. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2044. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2045. tt_assert(!ret);
  2046. MOCK(tor_tls_create_certificate, fixed_tor_tls_create_certificate);
  2047. fixed_crypto_pk_new_result_index = 0;
  2048. fixed_crypto_pk_new_result[0] = pk5;
  2049. fixed_crypto_pk_new_result[1] = pk6;
  2050. fixed_crypto_pk_new_result[2] = NULL;
  2051. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2052. fixed_crypto_pk_generate_key_with_bits_result[1] = 0;
  2053. fixed_tor_tls_create_certificate_result_index = 0;
  2054. fixed_tor_tls_create_certificate_result[0] = NULL;
  2055. fixed_tor_tls_create_certificate_result[1] = tor_malloc_zero(sizeof(X509));
  2056. fixed_tor_tls_create_certificate_result[2] = tor_malloc_zero(sizeof(X509));
  2057. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2058. tt_assert(!ret);
  2059. fixed_crypto_pk_new_result_index = 0;
  2060. fixed_crypto_pk_new_result[0] = pk7;
  2061. fixed_crypto_pk_new_result[1] = pk8;
  2062. fixed_crypto_pk_new_result[2] = NULL;
  2063. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2064. fixed_tor_tls_create_certificate_result_index = 0;
  2065. fixed_tor_tls_create_certificate_result[0] = tor_malloc_zero(sizeof(X509));
  2066. fixed_tor_tls_create_certificate_result[1] = NULL;
  2067. fixed_tor_tls_create_certificate_result[2] = tor_malloc_zero(sizeof(X509));
  2068. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2069. tt_assert(!ret);
  2070. fixed_crypto_pk_new_result_index = 0;
  2071. fixed_crypto_pk_new_result[0] = pk9;
  2072. fixed_crypto_pk_new_result[1] = pk10;
  2073. fixed_crypto_pk_new_result[2] = NULL;
  2074. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2075. fixed_tor_tls_create_certificate_result_index = 0;
  2076. fixed_tor_tls_create_certificate_result[0] = tor_malloc_zero(sizeof(X509));
  2077. fixed_tor_tls_create_certificate_result[1] = tor_malloc_zero(sizeof(X509));
  2078. fixed_tor_tls_create_certificate_result[2] = NULL;
  2079. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2080. tt_assert(!ret);
  2081. MOCK(tor_x509_cert_new, fixed_tor_x509_cert_new);
  2082. fixed_crypto_pk_new_result_index = 0;
  2083. fixed_crypto_pk_new_result[0] = pk11;
  2084. fixed_crypto_pk_new_result[1] = pk12;
  2085. fixed_crypto_pk_new_result[2] = NULL;
  2086. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2087. fixed_tor_tls_create_certificate_result_index = 0;
  2088. fixed_tor_tls_create_certificate_result[0] = tor_malloc_zero(sizeof(X509));
  2089. fixed_tor_tls_create_certificate_result[1] = tor_malloc_zero(sizeof(X509));
  2090. fixed_tor_tls_create_certificate_result[2] = tor_malloc_zero(sizeof(X509));
  2091. fixed_tor_x509_cert_new_result_index = 0;
  2092. fixed_tor_x509_cert_new_result[0] = NULL;
  2093. fixed_tor_x509_cert_new_result[1] = NULL;
  2094. fixed_tor_x509_cert_new_result[2] = NULL;
  2095. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2096. tt_assert(!ret);
  2097. fixed_crypto_pk_new_result_index = 0;
  2098. fixed_crypto_pk_new_result[0] = pk13;
  2099. fixed_crypto_pk_new_result[1] = pk14;
  2100. fixed_crypto_pk_new_result[2] = NULL;
  2101. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2102. fixed_tor_tls_create_certificate_result_index = 0;
  2103. fixed_tor_tls_create_certificate_result[0] = tor_malloc_zero(sizeof(X509));
  2104. fixed_tor_tls_create_certificate_result[1] = tor_malloc_zero(sizeof(X509));
  2105. fixed_tor_tls_create_certificate_result[2] = tor_malloc_zero(sizeof(X509));
  2106. fixed_tor_x509_cert_new_result_index = 0;
  2107. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2108. fixed_tor_x509_cert_new_result[1] = NULL;
  2109. fixed_tor_x509_cert_new_result[2] = NULL;
  2110. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2111. tt_assert(!ret);
  2112. fixed_crypto_pk_new_result_index = 0;
  2113. fixed_crypto_pk_new_result[0] = pk15;
  2114. fixed_crypto_pk_new_result[1] = pk16;
  2115. fixed_crypto_pk_new_result[2] = NULL;
  2116. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2117. fixed_tor_tls_create_certificate_result_index = 0;
  2118. fixed_tor_tls_create_certificate_result[0] = tor_malloc_zero(sizeof(X509));
  2119. fixed_tor_tls_create_certificate_result[1] = tor_malloc_zero(sizeof(X509));
  2120. fixed_tor_tls_create_certificate_result[2] = tor_malloc_zero(sizeof(X509));
  2121. fixed_tor_x509_cert_new_result_index = 0;
  2122. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2123. fixed_tor_x509_cert_new_result[1] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2124. fixed_tor_x509_cert_new_result[2] = NULL;
  2125. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2126. tt_assert(!ret);
  2127. fixed_crypto_pk_new_result_index = 0;
  2128. fixed_crypto_pk_new_result[0] = pk17;
  2129. fixed_crypto_pk_new_result[1] = pk18;
  2130. fixed_crypto_pk_new_result[2] = NULL;
  2131. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2132. fixed_tor_tls_create_certificate_result_index = 0;
  2133. fixed_tor_tls_create_certificate_result[0] = tor_malloc_zero(sizeof(X509));
  2134. fixed_tor_tls_create_certificate_result[1] = tor_malloc_zero(sizeof(X509));
  2135. fixed_tor_tls_create_certificate_result[2] = tor_malloc_zero(sizeof(X509));
  2136. fixed_tor_x509_cert_new_result_index = 0;
  2137. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2138. fixed_tor_x509_cert_new_result[1] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2139. fixed_tor_x509_cert_new_result[2] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2140. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2141. tt_assert(!ret);
  2142. done:
  2143. UNMOCK(tor_x509_cert_new);
  2144. UNMOCK(tor_tls_create_certificate);
  2145. UNMOCK(crypto_pk_generate_key_with_bits);
  2146. UNMOCK(crypto_pk_new);
  2147. }
  2148. #endif
  2149. static int fixed_crypto_pk_get_evp_pkey_result_index = 0;
  2150. static EVP_PKEY *fixed_crypto_pk_get_evp_pkey_result[5];
  2151. static EVP_PKEY *
  2152. fixed_crypto_pk_get_evp_pkey_(crypto_pk_t *env, int private)
  2153. {
  2154. (void) env;
  2155. (void) private;
  2156. return fixed_crypto_pk_get_evp_pkey_result[
  2157. fixed_crypto_pk_get_evp_pkey_result_index++];
  2158. }
  2159. static void
  2160. test_tortls_create_certificate(void *ignored)
  2161. {
  2162. (void)ignored;
  2163. X509 *ret;
  2164. crypto_pk_t *pk1, *pk2;
  2165. pk1 = crypto_pk_new();
  2166. pk2 = crypto_pk_new();
  2167. MOCK(crypto_pk_get_evp_pkey_, fixed_crypto_pk_get_evp_pkey_);
  2168. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  2169. fixed_crypto_pk_get_evp_pkey_result[0] = NULL;
  2170. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  2171. tt_assert(!ret);
  2172. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  2173. fixed_crypto_pk_get_evp_pkey_result[0] = EVP_PKEY_new();
  2174. fixed_crypto_pk_get_evp_pkey_result[1] = NULL;
  2175. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  2176. tt_assert(!ret);
  2177. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  2178. fixed_crypto_pk_get_evp_pkey_result[0] = EVP_PKEY_new();
  2179. fixed_crypto_pk_get_evp_pkey_result[1] = EVP_PKEY_new();
  2180. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  2181. tt_assert(!ret);
  2182. done:
  2183. UNMOCK(crypto_pk_get_evp_pkey_);
  2184. crypto_pk_free(pk1);
  2185. crypto_pk_free(pk2);
  2186. }
  2187. static void
  2188. test_tortls_cert_new(void *ignored)
  2189. {
  2190. (void)ignored;
  2191. tor_x509_cert_t *ret;
  2192. X509 *cert = read_cert_from(validCertString);
  2193. ret = tor_x509_cert_new(NULL);
  2194. tt_assert(!ret);
  2195. ret = tor_x509_cert_new(cert);
  2196. tt_assert(ret);
  2197. tor_x509_cert_free(ret);
  2198. ret = NULL;
  2199. #if 0
  2200. cert = read_cert_from(validCertString);
  2201. /* XXX this doesn't do what you think: it alters a copy of the pubkey. */
  2202. X509_get_pubkey(cert)->type = EVP_PKEY_DSA;
  2203. ret = tor_x509_cert_new(cert);
  2204. tt_assert(ret);
  2205. #endif
  2206. #ifndef OPENSSL_OPAQUE
  2207. cert = read_cert_from(validCertString);
  2208. X509_CINF_free(cert->cert_info);
  2209. cert->cert_info = NULL;
  2210. ret = tor_x509_cert_new(cert);
  2211. tt_assert(ret);
  2212. #endif
  2213. done:
  2214. tor_x509_cert_free(ret);
  2215. }
  2216. static void
  2217. test_tortls_cert_is_valid(void *ignored)
  2218. {
  2219. (void)ignored;
  2220. int ret;
  2221. tor_x509_cert_t *cert = NULL, *scert = NULL;
  2222. scert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2223. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0);
  2224. tt_int_op(ret, OP_EQ, 0);
  2225. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2226. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0);
  2227. tt_int_op(ret, OP_EQ, 0);
  2228. tor_free(scert);
  2229. tor_free(cert);
  2230. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2231. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2232. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0);
  2233. tt_int_op(ret, OP_EQ, 1);
  2234. #ifndef OPENSSL_OPAQUE
  2235. tor_x509_cert_free(cert);
  2236. tor_x509_cert_free(scert);
  2237. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2238. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2239. ASN1_TIME_free(cert->cert->cert_info->validity->notAfter);
  2240. cert->cert->cert_info->validity->notAfter =
  2241. ASN1_TIME_set(NULL, time(NULL)-1000000);
  2242. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0);
  2243. tt_int_op(ret, OP_EQ, 0);
  2244. tor_x509_cert_free(cert);
  2245. tor_x509_cert_free(scert);
  2246. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2247. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2248. X509_PUBKEY_free(cert->cert->cert_info->key);
  2249. cert->cert->cert_info->key = NULL;
  2250. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 1);
  2251. tt_int_op(ret, OP_EQ, 0);
  2252. #endif
  2253. #if 0
  2254. tor_x509_cert_free(cert);
  2255. tor_x509_cert_free(scert);
  2256. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2257. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2258. /* This doesn't actually change the key in the cert. XXXXXX */
  2259. BN_one(EVP_PKEY_get1_RSA(X509_get_pubkey(cert->cert))->n);
  2260. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 1);
  2261. tt_int_op(ret, OP_EQ, 0);
  2262. tor_x509_cert_free(cert);
  2263. tor_x509_cert_free(scert);
  2264. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2265. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2266. /* This doesn't actually change the key in the cert. XXXXXX */
  2267. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  2268. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 1);
  2269. tt_int_op(ret, OP_EQ, 0);
  2270. tor_x509_cert_free(cert);
  2271. tor_x509_cert_free(scert);
  2272. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2273. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2274. /* This doesn't actually change the key in the cert. XXXXXX */
  2275. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  2276. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0);
  2277. tt_int_op(ret, OP_EQ, 1);
  2278. tor_x509_cert_free(cert);
  2279. tor_x509_cert_free(scert);
  2280. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2281. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2282. /* This doesn't actually change the key in the cert. XXXXXX */
  2283. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  2284. X509_get_pubkey(cert->cert)->ameth = NULL;
  2285. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0);
  2286. tt_int_op(ret, OP_EQ, 0);
  2287. #endif
  2288. done:
  2289. tor_x509_cert_free(cert);
  2290. tor_x509_cert_free(scert);
  2291. }
  2292. static void
  2293. test_tortls_context_init_one(void *ignored)
  2294. {
  2295. (void)ignored;
  2296. int ret;
  2297. tor_tls_context_t *old = NULL;
  2298. MOCK(crypto_pk_new, fixed_crypto_pk_new);
  2299. fixed_crypto_pk_new_result_index = 0;
  2300. fixed_crypto_pk_new_result[0] = NULL;
  2301. ret = tor_tls_context_init_one(&old, NULL, 0, 0, 0);
  2302. tt_int_op(ret, OP_EQ, -1);
  2303. done:
  2304. UNMOCK(crypto_pk_new);
  2305. }
  2306. #define LOCAL_TEST_CASE(name, flags) \
  2307. { #name, test_tortls_##name, (flags|TT_FORK), NULL, NULL }
  2308. #ifdef OPENSSL_OPAQUE
  2309. #define INTRUSIVE_TEST_CASE(name, flags) \
  2310. { #name, NULL, TT_SKIP, NULL, NULL }
  2311. #else
  2312. #define INTRUSIVE_TEST_CASE(name, flags) LOCAL_TEST_CASE(name, flags)
  2313. #endif
  2314. struct testcase_t tortls_tests[] = {
  2315. LOCAL_TEST_CASE(errno_to_tls_error, 0),
  2316. LOCAL_TEST_CASE(err_to_string, 0),
  2317. LOCAL_TEST_CASE(tor_tls_new, TT_FORK),
  2318. LOCAL_TEST_CASE(tor_tls_get_error, 0),
  2319. LOCAL_TEST_CASE(get_state_description, TT_FORK),
  2320. LOCAL_TEST_CASE(get_by_ssl, TT_FORK),
  2321. LOCAL_TEST_CASE(allocate_tor_tls_object_ex_data_index, TT_FORK),
  2322. LOCAL_TEST_CASE(log_one_error, TT_FORK),
  2323. INTRUSIVE_TEST_CASE(get_error, TT_FORK),
  2324. LOCAL_TEST_CASE(always_accept_verify_cb, 0),
  2325. INTRUSIVE_TEST_CASE(x509_cert_free, 0),
  2326. LOCAL_TEST_CASE(x509_cert_get_id_digests, 0),
  2327. INTRUSIVE_TEST_CASE(cert_matches_key, 0),
  2328. INTRUSIVE_TEST_CASE(cert_get_key, 0),
  2329. LOCAL_TEST_CASE(get_my_client_auth_key, TT_FORK),
  2330. LOCAL_TEST_CASE(get_my_certs, TT_FORK),
  2331. INTRUSIVE_TEST_CASE(get_ciphersuite_name, 0),
  2332. INTRUSIVE_TEST_CASE(classify_client_ciphers, 0),
  2333. LOCAL_TEST_CASE(client_is_using_v2_ciphers, 0),
  2334. INTRUSIVE_TEST_CASE(verify, 0),
  2335. INTRUSIVE_TEST_CASE(check_lifetime, 0),
  2336. INTRUSIVE_TEST_CASE(get_pending_bytes, 0),
  2337. LOCAL_TEST_CASE(get_forced_write_size, 0),
  2338. LOCAL_TEST_CASE(get_write_overhead_ratio, TT_FORK),
  2339. LOCAL_TEST_CASE(used_v1_handshake, TT_FORK),
  2340. LOCAL_TEST_CASE(get_num_server_handshakes, 0),
  2341. LOCAL_TEST_CASE(server_got_renegotiate, 0),
  2342. INTRUSIVE_TEST_CASE(SSL_SESSION_get_master_key, 0),
  2343. INTRUSIVE_TEST_CASE(get_tlssecrets, 0),
  2344. INTRUSIVE_TEST_CASE(get_buffer_sizes, 0),
  2345. LOCAL_TEST_CASE(evaluate_ecgroup_for_tls, 0),
  2346. INTRUSIVE_TEST_CASE(try_to_extract_certs_from_tls, 0),
  2347. INTRUSIVE_TEST_CASE(get_peer_cert, 0),
  2348. INTRUSIVE_TEST_CASE(peer_has_cert, 0),
  2349. INTRUSIVE_TEST_CASE(shutdown, 0),
  2350. INTRUSIVE_TEST_CASE(finish_handshake, 0),
  2351. INTRUSIVE_TEST_CASE(handshake, 0),
  2352. INTRUSIVE_TEST_CASE(write, 0),
  2353. INTRUSIVE_TEST_CASE(read, 0),
  2354. INTRUSIVE_TEST_CASE(server_info_callback, 0),
  2355. LOCAL_TEST_CASE(is_server, 0),
  2356. INTRUSIVE_TEST_CASE(assert_renegotiation_unblocked, 0),
  2357. INTRUSIVE_TEST_CASE(block_renegotiation, 0),
  2358. INTRUSIVE_TEST_CASE(unblock_renegotiation, 0),
  2359. INTRUSIVE_TEST_CASE(set_renegotiate_callback, 0),
  2360. LOCAL_TEST_CASE(set_logged_address, 0),
  2361. INTRUSIVE_TEST_CASE(find_cipher_by_id, 0),
  2362. INTRUSIVE_TEST_CASE(session_secret_cb, 0),
  2363. INTRUSIVE_TEST_CASE(debug_state_callback, 0),
  2364. INTRUSIVE_TEST_CASE(context_new, 0),
  2365. LOCAL_TEST_CASE(create_certificate, 0),
  2366. LOCAL_TEST_CASE(cert_new, 0),
  2367. LOCAL_TEST_CASE(cert_is_valid, 0),
  2368. LOCAL_TEST_CASE(context_init_one, 0),
  2369. END_OF_TESTCASES
  2370. };