test_tortls.c 78 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842
  1. /* Copyright (c) 2010-2018, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #define TORTLS_PRIVATE
  4. #define TORTLS_OPENSSL_PRIVATE
  5. #define LOG_PRIVATE
  6. #include "orconfig.h"
  7. #ifdef _WIN32
  8. #include <winsock2.h>
  9. #endif
  10. #include <math.h>
  11. #include "lib/cc/compat_compiler.h"
  12. /* Some versions of OpenSSL declare SSL_get_selected_srtp_profile twice in
  13. * srtp.h. Suppress the GCC warning so we can build with -Wredundant-decl. */
  14. DISABLE_GCC_WARNING(redundant-decls)
  15. #include <openssl/opensslv.h>
  16. #include <openssl/ssl.h>
  17. #include <openssl/ssl3.h>
  18. #include <openssl/err.h>
  19. #include <openssl/asn1t.h>
  20. #include <openssl/x509.h>
  21. #include <openssl/rsa.h>
  22. #include <openssl/evp.h>
  23. #include <openssl/bn.h>
  24. ENABLE_GCC_WARNING(redundant-decls)
  25. #include "or/or.h"
  26. #include "lib/log/torlog.h"
  27. #include "or/config.h"
  28. #include "lib/tls/tortls.h"
  29. #include "or/or_state_st.h"
  30. #include "test/test.h"
  31. #include "test/log_test_helpers.h"
  32. #define NS_MODULE tortls
  33. #ifndef HAVE_SSL_STATE
  34. #define OPENSSL_OPAQUE
  35. #endif
  36. #if defined(OPENSSL_OPAQUE) && !defined(LIBRESSL_VERSION_NUMBER)
  37. #define SSL_STATE_STR "before SSL initialization"
  38. #else
  39. #define SSL_STATE_STR "before/accept initialization"
  40. #endif
  41. #ifndef OPENSSL_OPAQUE
  42. static SSL_METHOD *
  43. give_me_a_test_method(void)
  44. {
  45. SSL_METHOD *method = tor_malloc_zero(sizeof(SSL_METHOD));
  46. memcpy(method, TLSv1_method(), sizeof(SSL_METHOD));
  47. return method;
  48. }
  49. static int
  50. fake_num_ciphers(void)
  51. {
  52. return 0;
  53. }
  54. #endif /* !defined(OPENSSL_OPAQUE) */
  55. static void
  56. test_tortls_errno_to_tls_error(void *data)
  57. {
  58. (void) data;
  59. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ECONNRESET)),OP_EQ,
  60. TOR_TLS_ERROR_CONNRESET);
  61. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ETIMEDOUT)),OP_EQ,
  62. TOR_TLS_ERROR_TIMEOUT);
  63. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(EHOSTUNREACH)),OP_EQ,
  64. TOR_TLS_ERROR_NO_ROUTE);
  65. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ENETUNREACH)),OP_EQ,
  66. TOR_TLS_ERROR_NO_ROUTE);
  67. tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ECONNREFUSED)),OP_EQ,
  68. TOR_TLS_ERROR_CONNREFUSED);
  69. tt_int_op(tor_errno_to_tls_error(0),OP_EQ,TOR_TLS_ERROR_MISC);
  70. done:
  71. (void)1;
  72. }
  73. static void
  74. test_tortls_err_to_string(void *data)
  75. {
  76. (void) data;
  77. tt_str_op(tor_tls_err_to_string(1),OP_EQ,"[Not an error.]");
  78. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_MISC),OP_EQ,"misc error");
  79. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_IO),OP_EQ,"unexpected close");
  80. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_CONNREFUSED),OP_EQ,
  81. "connection refused");
  82. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_CONNRESET),OP_EQ,
  83. "connection reset");
  84. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_NO_ROUTE),OP_EQ,
  85. "host unreachable");
  86. tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_TIMEOUT),OP_EQ,
  87. "connection timed out");
  88. tt_str_op(tor_tls_err_to_string(TOR_TLS_CLOSE),OP_EQ,"closed");
  89. tt_str_op(tor_tls_err_to_string(TOR_TLS_WANTREAD),OP_EQ,"want to read");
  90. tt_str_op(tor_tls_err_to_string(TOR_TLS_WANTWRITE),OP_EQ,"want to write");
  91. tt_str_op(tor_tls_err_to_string(-100),OP_EQ,"(unknown error code)");
  92. done:
  93. (void)1;
  94. }
  95. static int
  96. mock_tls_cert_matches_key(const tor_tls_t *tls, const tor_x509_cert_t *cert)
  97. {
  98. (void) tls;
  99. (void) cert; // XXXX look at this.
  100. return 1;
  101. }
  102. static void
  103. test_tortls_tor_tls_new(void *data)
  104. {
  105. (void) data;
  106. MOCK(tor_tls_cert_matches_key, mock_tls_cert_matches_key);
  107. crypto_pk_t *key1 = NULL, *key2 = NULL;
  108. SSL_METHOD *method = NULL;
  109. key1 = pk_generate(2);
  110. key2 = pk_generate(3);
  111. tor_tls_t *tls = NULL;
  112. tt_int_op(tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
  113. key1, key2, 86400), OP_EQ, 0);
  114. tls = tor_tls_new(-1, 0);
  115. tt_want(tls);
  116. tor_tls_free(tls); tls = NULL;
  117. SSL_CTX_free(client_tls_context->ctx);
  118. client_tls_context->ctx = NULL;
  119. tls = tor_tls_new(-1, 0);
  120. tt_ptr_op(tls, OP_EQ, NULL);
  121. #ifndef OPENSSL_OPAQUE
  122. method = give_me_a_test_method();
  123. SSL_CTX *ctx = SSL_CTX_new(method);
  124. method->num_ciphers = fake_num_ciphers;
  125. client_tls_context->ctx = ctx;
  126. tls = tor_tls_new(-1, 0);
  127. tt_ptr_op(tls, OP_EQ, NULL);
  128. #endif /* !defined(OPENSSL_OPAQUE) */
  129. done:
  130. UNMOCK(tor_tls_cert_matches_key);
  131. crypto_pk_free(key1);
  132. crypto_pk_free(key2);
  133. tor_tls_free(tls);
  134. tor_free(method);
  135. tor_tls_free_all();
  136. }
  137. #define NS_MODULE tortls
  138. NS_DECL(void, logv, (int severity, log_domain_mask_t domain,
  139. const char *funcname, const char *suffix,
  140. const char *format, va_list ap));
  141. static void
  142. NS(logv)(int severity, log_domain_mask_t domain,
  143. const char *funcname, const char *suffix, const char *format,
  144. va_list ap)
  145. {
  146. (void) severity;
  147. (void) domain;
  148. (void) funcname;
  149. (void) suffix;
  150. (void) format;
  151. (void) ap; // XXXX look at this.
  152. CALLED(logv)++;
  153. }
  154. static void
  155. test_tortls_tor_tls_get_error(void *data)
  156. {
  157. (void) data;
  158. MOCK(tor_tls_cert_matches_key, mock_tls_cert_matches_key);
  159. crypto_pk_t *key1 = NULL, *key2 = NULL;
  160. key1 = pk_generate(2);
  161. key2 = pk_generate(3);
  162. tor_tls_t *tls = NULL;
  163. tt_int_op(tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
  164. key1, key2, 86400), OP_EQ, 0);
  165. tls = tor_tls_new(-1, 0);
  166. NS_MOCK(logv);
  167. tt_int_op(CALLED(logv), OP_EQ, 0);
  168. tor_tls_get_error(tls, 0, 0,
  169. (const char *)"test", 0, 0);
  170. tt_int_op(CALLED(logv), OP_EQ, 1);
  171. done:
  172. UNMOCK(tor_tls_cert_matches_key);
  173. NS_UNMOCK(logv);
  174. crypto_pk_free(key1);
  175. crypto_pk_free(key2);
  176. tor_tls_free(tls);
  177. }
  178. static void
  179. library_init(void)
  180. {
  181. #ifdef OPENSSL_1_1_API
  182. OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
  183. #else
  184. SSL_library_init();
  185. SSL_load_error_strings();
  186. #endif
  187. }
  188. static void
  189. test_tortls_get_state_description(void *ignored)
  190. {
  191. (void)ignored;
  192. tor_tls_t *tls;
  193. char *buf;
  194. SSL_CTX *ctx;
  195. library_init();
  196. ctx = SSL_CTX_new(SSLv23_method());
  197. buf = tor_malloc_zero(1000);
  198. tls = tor_malloc_zero(sizeof(tor_tls_t));
  199. tor_tls_get_state_description(NULL, buf, 20);
  200. tt_str_op(buf, OP_EQ, "(No SSL object)");
  201. SSL_free(tls->ssl);
  202. tls->ssl = NULL;
  203. tor_tls_get_state_description(tls, buf, 20);
  204. tt_str_op(buf, OP_EQ, "(No SSL object)");
  205. tls->ssl = SSL_new(ctx);
  206. tor_tls_get_state_description(tls, buf, 200);
  207. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in HANDSHAKE");
  208. tls->state = TOR_TLS_ST_OPEN;
  209. tor_tls_get_state_description(tls, buf, 200);
  210. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in OPEN");
  211. tls->state = TOR_TLS_ST_GOTCLOSE;
  212. tor_tls_get_state_description(tls, buf, 200);
  213. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in GOTCLOSE");
  214. tls->state = TOR_TLS_ST_SENTCLOSE;
  215. tor_tls_get_state_description(tls, buf, 200);
  216. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in SENTCLOSE");
  217. tls->state = TOR_TLS_ST_CLOSED;
  218. tor_tls_get_state_description(tls, buf, 200);
  219. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in CLOSED");
  220. tls->state = TOR_TLS_ST_RENEGOTIATE;
  221. tor_tls_get_state_description(tls, buf, 200);
  222. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in RENEGOTIATE");
  223. tls->state = TOR_TLS_ST_BUFFEREVENT;
  224. tor_tls_get_state_description(tls, buf, 200);
  225. tt_str_op(buf, OP_EQ, SSL_STATE_STR);
  226. tls->state = 7;
  227. tor_tls_get_state_description(tls, buf, 200);
  228. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in unknown TLS state");
  229. done:
  230. SSL_CTX_free(ctx);
  231. SSL_free(tls->ssl);
  232. tor_free(buf);
  233. tor_free(tls);
  234. }
  235. static void
  236. test_tortls_get_by_ssl(void *ignored)
  237. {
  238. (void)ignored;
  239. tor_tls_t *tls;
  240. tor_tls_t *res;
  241. SSL_CTX *ctx;
  242. SSL *ssl;
  243. library_init();
  244. tor_tls_allocate_tor_tls_object_ex_data_index();
  245. ctx = SSL_CTX_new(SSLv23_method());
  246. tls = tor_malloc_zero(sizeof(tor_tls_t));
  247. tls->magic = TOR_TLS_MAGIC;
  248. ssl = SSL_new(ctx);
  249. res = tor_tls_get_by_ssl(ssl);
  250. tt_assert(!res);
  251. SSL_set_ex_data(ssl, tor_tls_object_ex_data_index, tls);
  252. res = tor_tls_get_by_ssl(ssl);
  253. tt_assert(res == tls);
  254. done:
  255. SSL_free(ssl);
  256. SSL_CTX_free(ctx);
  257. tor_free(tls);
  258. }
  259. static void
  260. test_tortls_allocate_tor_tls_object_ex_data_index(void *ignored)
  261. {
  262. (void)ignored;
  263. int first;
  264. tor_tls_allocate_tor_tls_object_ex_data_index();
  265. first = tor_tls_object_ex_data_index;
  266. tor_tls_allocate_tor_tls_object_ex_data_index();
  267. tt_int_op(first, OP_EQ, tor_tls_object_ex_data_index);
  268. done:
  269. (void)0;
  270. }
  271. static void
  272. test_tortls_log_one_error(void *ignored)
  273. {
  274. (void)ignored;
  275. tor_tls_t *tls;
  276. SSL_CTX *ctx;
  277. SSL *ssl = NULL;
  278. library_init();
  279. ctx = SSL_CTX_new(SSLv23_method());
  280. tls = tor_malloc_zero(sizeof(tor_tls_t));
  281. setup_capture_of_logs(LOG_INFO);
  282. tor_tls_log_one_error(NULL, 0, LOG_WARN, 0, "something");
  283. expect_log_msg("TLS error while something: "
  284. "(null) (in (null):(null):---)\n");
  285. mock_clean_saved_logs();
  286. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  287. expect_log_msg("TLS error: (null) "
  288. "(in (null):(null):---)\n");
  289. mock_clean_saved_logs();
  290. tls->address = tor_strdup("127.hello");
  291. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  292. expect_log_msg("TLS error with 127.hello: "
  293. "(null) (in (null):(null):---)\n");
  294. tor_free(tls->address);
  295. mock_clean_saved_logs();
  296. tls->address = tor_strdup("127.hello");
  297. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, "blarg");
  298. expect_log_msg("TLS error while blarg with "
  299. "127.hello: (null) (in (null):(null):---)\n");
  300. mock_clean_saved_logs();
  301. tor_tls_log_one_error(tls, ERR_PACK(1, 2, 3), LOG_WARN, 0, NULL);
  302. expect_log_msg("TLS error with 127.hello: "
  303. "BN lib (in unknown library:(null):---)\n");
  304. mock_clean_saved_logs();
  305. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_HTTP_REQUEST),
  306. LOG_WARN, 0, NULL);
  307. expect_log_severity(LOG_INFO);
  308. mock_clean_saved_logs();
  309. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_HTTPS_PROXY_REQUEST),
  310. LOG_WARN, 0, NULL);
  311. expect_log_severity(LOG_INFO);
  312. mock_clean_saved_logs();
  313. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_RECORD_LENGTH_MISMATCH),
  314. LOG_WARN, 0, NULL);
  315. expect_log_severity(LOG_INFO);
  316. #ifndef OPENSSL_1_1_API
  317. mock_clean_saved_logs();
  318. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_RECORD_TOO_LARGE),
  319. LOG_WARN, 0, NULL);
  320. expect_log_severity(LOG_INFO);
  321. #endif /* !defined(OPENSSL_1_1_API) */
  322. mock_clean_saved_logs();
  323. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_UNKNOWN_PROTOCOL),
  324. LOG_WARN, 0, NULL);
  325. expect_log_severity(LOG_INFO);
  326. mock_clean_saved_logs();
  327. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_UNSUPPORTED_PROTOCOL),
  328. LOG_WARN, 0, NULL);
  329. expect_log_severity(LOG_INFO);
  330. tls->ssl = SSL_new(ctx);
  331. mock_clean_saved_logs();
  332. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  333. expect_log_msg("TLS error with 127.hello: (null)"
  334. " (in (null):(null):" SSL_STATE_STR ")\n");
  335. done:
  336. teardown_capture_of_logs();
  337. SSL_free(ssl);
  338. SSL_CTX_free(ctx);
  339. if (tls && tls->ssl)
  340. SSL_free(tls->ssl);
  341. if (tls)
  342. tor_free(tls->address);
  343. tor_free(tls);
  344. }
  345. #ifndef OPENSSL_OPAQUE
  346. static void
  347. test_tortls_get_error(void *ignored)
  348. {
  349. (void)ignored;
  350. tor_tls_t *tls;
  351. int ret;
  352. SSL_CTX *ctx;
  353. library_init();
  354. ctx = SSL_CTX_new(SSLv23_method());
  355. setup_capture_of_logs(LOG_INFO);
  356. tls = tor_malloc_zero(sizeof(tor_tls_t));
  357. tls->ssl = SSL_new(ctx);
  358. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  359. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  360. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_IO);
  361. expect_log_msg("TLS error: unexpected close while"
  362. " something (before/accept initialization)\n");
  363. mock_clean_saved_logs();
  364. ret = tor_tls_get_error(tls, 2, 0, "something", LOG_WARN, 0);
  365. tt_int_op(ret, OP_EQ, 0);
  366. expect_no_log_entry();
  367. mock_clean_saved_logs();
  368. ret = tor_tls_get_error(tls, 0, 1, "something", LOG_WARN, 0);
  369. tt_int_op(ret, OP_EQ, -11);
  370. expect_no_log_entry();
  371. mock_clean_saved_logs();
  372. ERR_clear_error();
  373. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  374. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  375. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  376. expect_log_msg("TLS error while something: (null)"
  377. " (in bignum routines:(null):before/accept initialization)\n");
  378. mock_clean_saved_logs();
  379. ERR_clear_error();
  380. tls->ssl->rwstate = SSL_READING;
  381. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_READ;
  382. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  383. tt_int_op(ret, OP_EQ, TOR_TLS_WANTREAD);
  384. expect_no_log_entry();
  385. mock_clean_saved_logs();
  386. ERR_clear_error();
  387. tls->ssl->rwstate = SSL_READING;
  388. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_WRITE;
  389. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  390. tt_int_op(ret, OP_EQ, TOR_TLS_WANTWRITE);
  391. expect_no_log_entry();
  392. mock_clean_saved_logs();
  393. ERR_clear_error();
  394. tls->ssl->rwstate = 0;
  395. tls->ssl->shutdown = SSL_RECEIVED_SHUTDOWN;
  396. tls->ssl->s3->warn_alert =SSL_AD_CLOSE_NOTIFY;
  397. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  398. tt_int_op(ret, OP_EQ, TOR_TLS_CLOSE);
  399. expect_log_entry();
  400. mock_clean_saved_logs();
  401. ret = tor_tls_get_error(tls, 0, 2, "something", LOG_WARN, 0);
  402. tt_int_op(ret, OP_EQ, -10);
  403. expect_no_log_entry();
  404. mock_clean_saved_logs();
  405. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  406. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  407. tt_int_op(ret, OP_EQ, -9);
  408. expect_log_msg("TLS error while something: (null) (in system library:"
  409. "connect:before/accept initialization)\n");
  410. done:
  411. teardown_capture_of_logs();
  412. SSL_free(tls->ssl);
  413. tor_free(tls);
  414. SSL_CTX_free(ctx);
  415. }
  416. #endif /* !defined(OPENSSL_OPAQUE) */
  417. static void
  418. test_tortls_always_accept_verify_cb(void *ignored)
  419. {
  420. (void)ignored;
  421. int ret;
  422. ret = always_accept_verify_cb(0, NULL);
  423. tt_int_op(ret, OP_EQ, 1);
  424. done:
  425. (void)0;
  426. }
  427. #ifndef OPENSSL_OPAQUE
  428. static void
  429. test_tortls_x509_cert_free(void *ignored)
  430. {
  431. (void)ignored;
  432. tor_x509_cert_t *cert;
  433. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  434. tor_x509_cert_free(cert);
  435. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  436. cert->cert = X509_new();
  437. cert->encoded = tor_malloc_zero(1);
  438. tor_x509_cert_free(cert);
  439. }
  440. #endif /* !defined(OPENSSL_OPAQUE) */
  441. static void
  442. test_tortls_x509_cert_get_id_digests(void *ignored)
  443. {
  444. (void)ignored;
  445. tor_x509_cert_t *cert;
  446. common_digests_t *d;
  447. const common_digests_t *res;
  448. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  449. d = tor_malloc_zero(sizeof(common_digests_t));
  450. d->d[0][0] = 42;
  451. res = tor_x509_cert_get_id_digests(cert);
  452. tt_assert(!res);
  453. cert->pkey_digests_set = 1;
  454. cert->pkey_digests = *d;
  455. res = tor_x509_cert_get_id_digests(cert);
  456. tt_int_op(res->d[0][0], OP_EQ, 42);
  457. done:
  458. tor_free(cert);
  459. tor_free(d);
  460. }
  461. #ifndef OPENSSL_OPAQUE
  462. static int
  463. fixed_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  464. {
  465. (void) a; (void) b;
  466. return 1;
  467. }
  468. /*
  469. * Use only for the matching fake_x509_free() call
  470. */
  471. static X509 *
  472. fake_x509_malloc(void)
  473. {
  474. return tor_malloc_zero(sizeof(X509));
  475. }
  476. static void
  477. fake_x509_free(X509 *cert)
  478. {
  479. if (cert) {
  480. if (cert->cert_info) {
  481. if (cert->cert_info->key) {
  482. if (cert->cert_info->key->pkey) {
  483. tor_free(cert->cert_info->key->pkey);
  484. }
  485. tor_free(cert->cert_info->key);
  486. }
  487. tor_free(cert->cert_info);
  488. }
  489. tor_free(cert);
  490. }
  491. }
  492. static void
  493. test_tortls_cert_matches_key(void *ignored)
  494. {
  495. (void)ignored;
  496. int res;
  497. tor_tls_t *tls;
  498. tor_x509_cert_t *cert;
  499. X509 *one = NULL, *two = NULL;
  500. EVP_PKEY_ASN1_METHOD *meth = EVP_PKEY_asn1_new(999, 0, NULL, NULL);
  501. EVP_PKEY_asn1_set_public(meth, NULL, NULL, fixed_pub_cmp, NULL, NULL, NULL);
  502. tls = tor_malloc_zero(sizeof(tor_tls_t));
  503. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  504. one = fake_x509_malloc();
  505. one->references = 1;
  506. two = fake_x509_malloc();
  507. two->references = 1;
  508. res = tor_tls_cert_matches_key(tls, cert);
  509. tt_int_op(res, OP_EQ, 0);
  510. tls->ssl = tor_malloc_zero(sizeof(SSL));
  511. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  512. tls->ssl->session->peer = one;
  513. res = tor_tls_cert_matches_key(tls, cert);
  514. tt_int_op(res, OP_EQ, 0);
  515. cert->cert = two;
  516. res = tor_tls_cert_matches_key(tls, cert);
  517. tt_int_op(res, OP_EQ, 0);
  518. one->cert_info = tor_malloc_zero(sizeof(X509_CINF));
  519. one->cert_info->key = tor_malloc_zero(sizeof(X509_PUBKEY));
  520. one->cert_info->key->pkey = tor_malloc_zero(sizeof(EVP_PKEY));
  521. one->cert_info->key->pkey->references = 1;
  522. one->cert_info->key->pkey->ameth = meth;
  523. one->cert_info->key->pkey->type = 1;
  524. two->cert_info = tor_malloc_zero(sizeof(X509_CINF));
  525. two->cert_info->key = tor_malloc_zero(sizeof(X509_PUBKEY));
  526. two->cert_info->key->pkey = tor_malloc_zero(sizeof(EVP_PKEY));
  527. two->cert_info->key->pkey->references = 1;
  528. two->cert_info->key->pkey->ameth = meth;
  529. two->cert_info->key->pkey->type = 2;
  530. res = tor_tls_cert_matches_key(tls, cert);
  531. tt_int_op(res, OP_EQ, 0);
  532. one->cert_info->key->pkey->type = 1;
  533. two->cert_info->key->pkey->type = 1;
  534. res = tor_tls_cert_matches_key(tls, cert);
  535. tt_int_op(res, OP_EQ, 1);
  536. done:
  537. EVP_PKEY_asn1_free(meth);
  538. tor_free(tls->ssl->session);
  539. tor_free(tls->ssl);
  540. tor_free(tls);
  541. tor_free(cert);
  542. fake_x509_free(one);
  543. fake_x509_free(two);
  544. }
  545. static void
  546. test_tortls_cert_get_key(void *ignored)
  547. {
  548. (void)ignored;
  549. tor_x509_cert_t *cert = NULL;
  550. crypto_pk_t *res = NULL;
  551. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  552. X509 *key = NULL;
  553. key = fake_x509_malloc();
  554. key->references = 1;
  555. res = tor_tls_cert_get_key(cert);
  556. tt_assert(!res);
  557. cert->cert = key;
  558. key->cert_info = tor_malloc_zero(sizeof(X509_CINF));
  559. key->cert_info->key = tor_malloc_zero(sizeof(X509_PUBKEY));
  560. key->cert_info->key->pkey = tor_malloc_zero(sizeof(EVP_PKEY));
  561. key->cert_info->key->pkey->references = 1;
  562. key->cert_info->key->pkey->type = 2;
  563. res = tor_tls_cert_get_key(cert);
  564. tt_assert(!res);
  565. done:
  566. fake_x509_free(key);
  567. tor_free(cert);
  568. crypto_pk_free(res);
  569. }
  570. #endif /* !defined(OPENSSL_OPAQUE) */
  571. static void
  572. test_tortls_get_my_client_auth_key(void *ignored)
  573. {
  574. (void)ignored;
  575. crypto_pk_t *ret;
  576. crypto_pk_t *expected;
  577. tor_tls_context_t *ctx;
  578. RSA *k = RSA_new();
  579. ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
  580. expected = crypto_new_pk_from_rsa_(k);
  581. ctx->auth_key = expected;
  582. client_tls_context = NULL;
  583. ret = tor_tls_get_my_client_auth_key();
  584. tt_assert(!ret);
  585. client_tls_context = ctx;
  586. ret = tor_tls_get_my_client_auth_key();
  587. tt_assert(ret == expected);
  588. done:
  589. RSA_free(k);
  590. tor_free(expected);
  591. tor_free(ctx);
  592. }
  593. static void
  594. test_tortls_get_my_certs(void *ignored)
  595. {
  596. (void)ignored;
  597. int ret;
  598. tor_tls_context_t *ctx;
  599. const tor_x509_cert_t *link_cert_out = NULL;
  600. const tor_x509_cert_t *id_cert_out = NULL;
  601. ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
  602. client_tls_context = NULL;
  603. ret = tor_tls_get_my_certs(0, NULL, NULL);
  604. tt_int_op(ret, OP_EQ, -1);
  605. server_tls_context = NULL;
  606. ret = tor_tls_get_my_certs(1, NULL, NULL);
  607. tt_int_op(ret, OP_EQ, -1);
  608. client_tls_context = ctx;
  609. ret = tor_tls_get_my_certs(0, NULL, NULL);
  610. tt_int_op(ret, OP_EQ, 0);
  611. client_tls_context = ctx;
  612. ret = tor_tls_get_my_certs(0, &link_cert_out, &id_cert_out);
  613. tt_int_op(ret, OP_EQ, 0);
  614. server_tls_context = ctx;
  615. ret = tor_tls_get_my_certs(1, &link_cert_out, &id_cert_out);
  616. tt_int_op(ret, OP_EQ, 0);
  617. done:
  618. (void)1;
  619. }
  620. #ifndef HAVE_SSL_GET_CLIENT_CIPHERS
  621. static SSL_CIPHER *
  622. get_cipher_by_name(const char *name)
  623. {
  624. int i;
  625. const SSL_METHOD *method = SSLv23_method();
  626. int num = method->num_ciphers();
  627. for (i = 0; i < num; ++i) {
  628. const SSL_CIPHER *cipher = method->get_cipher(i);
  629. const char *ciphername = SSL_CIPHER_get_name(cipher);
  630. if (!strcmp(ciphername, name)) {
  631. return (SSL_CIPHER *)cipher;
  632. }
  633. }
  634. return NULL;
  635. }
  636. #endif /* !defined(HAVE_SSL_GET_CLIENT_CIPHERS) */
  637. #ifndef OPENSSL_OPAQUE
  638. static void
  639. test_tortls_get_ciphersuite_name(void *ignored)
  640. {
  641. (void)ignored;
  642. const char *ret;
  643. tor_tls_t *ctx;
  644. ctx = tor_malloc_zero(sizeof(tor_tls_t));
  645. ctx->ssl = tor_malloc_zero(sizeof(SSL));
  646. ret = tor_tls_get_ciphersuite_name(ctx);
  647. tt_str_op(ret, OP_EQ, "(NONE)");
  648. done:
  649. tor_free(ctx->ssl);
  650. tor_free(ctx);
  651. }
  652. static SSL_CIPHER *
  653. get_cipher_by_id(uint16_t id)
  654. {
  655. int i;
  656. const SSL_METHOD *method = SSLv23_method();
  657. int num = method->num_ciphers();
  658. for (i = 0; i < num; ++i) {
  659. const SSL_CIPHER *cipher = method->get_cipher(i);
  660. if (id == (SSL_CIPHER_get_id(cipher) & 0xffff)) {
  661. return (SSL_CIPHER *)cipher;
  662. }
  663. }
  664. return NULL;
  665. }
  666. static void
  667. test_tortls_classify_client_ciphers(void *ignored)
  668. {
  669. (void)ignored;
  670. int i;
  671. int ret;
  672. SSL_CTX *ctx;
  673. SSL *ssl;
  674. tor_tls_t *tls;
  675. STACK_OF(SSL_CIPHER) *ciphers;
  676. SSL_CIPHER *tmp_cipher;
  677. library_init();
  678. tor_tls_allocate_tor_tls_object_ex_data_index();
  679. tls = tor_malloc_zero(sizeof(tor_tls_t));
  680. tls->magic = TOR_TLS_MAGIC;
  681. ctx = SSL_CTX_new(TLSv1_method());
  682. ssl = SSL_new(ctx);
  683. tls->ssl = ssl;
  684. ciphers = sk_SSL_CIPHER_new_null();
  685. ret = tor_tls_classify_client_ciphers(ssl, NULL);
  686. tt_int_op(ret, OP_EQ, -1);
  687. SSL_set_ex_data(ssl, tor_tls_object_ex_data_index, tls);
  688. tls->client_cipher_list_type = 42;
  689. ret = tor_tls_classify_client_ciphers(ssl, NULL);
  690. tt_int_op(ret, OP_EQ, 42);
  691. tls->client_cipher_list_type = 0;
  692. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  693. tt_int_op(ret, OP_EQ, 1);
  694. tt_int_op(tls->client_cipher_list_type, OP_EQ, 1);
  695. tls->client_cipher_list_type = 0;
  696. ret = tor_tls_classify_client_ciphers(ssl, SSL_get_ciphers(ssl));
  697. tt_int_op(ret, OP_EQ, 3);
  698. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  699. SSL_CIPHER *one = get_cipher_by_name(TLS1_TXT_DHE_RSA_WITH_AES_128_SHA),
  700. *two = get_cipher_by_name(TLS1_TXT_DHE_RSA_WITH_AES_256_SHA),
  701. *three = get_cipher_by_name(SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA),
  702. *four = NULL;
  703. sk_SSL_CIPHER_push(ciphers, one);
  704. sk_SSL_CIPHER_push(ciphers, two);
  705. sk_SSL_CIPHER_push(ciphers, three);
  706. sk_SSL_CIPHER_push(ciphers, four);
  707. tls->client_cipher_list_type = 0;
  708. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  709. tt_int_op(ret, OP_EQ, 1);
  710. tt_int_op(tls->client_cipher_list_type, OP_EQ, 1);
  711. sk_SSL_CIPHER_zero(ciphers);
  712. one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384");
  713. tt_assert(one);
  714. one->id = 0x00ff;
  715. two = get_cipher_by_name("ECDHE-RSA-AES128-GCM-SHA256");
  716. tt_assert(two);
  717. two->id = 0x0000;
  718. sk_SSL_CIPHER_push(ciphers, one);
  719. tls->client_cipher_list_type = 0;
  720. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  721. tt_int_op(ret, OP_EQ, 3);
  722. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  723. sk_SSL_CIPHER_push(ciphers, two);
  724. tls->client_cipher_list_type = 0;
  725. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  726. tt_int_op(ret, OP_EQ, 3);
  727. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  728. one->id = 0xC00A;
  729. tls->client_cipher_list_type = 0;
  730. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  731. tt_int_op(ret, OP_EQ, 3);
  732. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  733. sk_SSL_CIPHER_zero(ciphers);
  734. for (i=0; v2_cipher_list[i]; i++) {
  735. tmp_cipher = get_cipher_by_id(v2_cipher_list[i]);
  736. tt_assert(tmp_cipher);
  737. sk_SSL_CIPHER_push(ciphers, tmp_cipher);
  738. }
  739. tls->client_cipher_list_type = 0;
  740. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  741. tt_int_op(ret, OP_EQ, 2);
  742. tt_int_op(tls->client_cipher_list_type, OP_EQ, 2);
  743. done:
  744. sk_SSL_CIPHER_free(ciphers);
  745. SSL_free(tls->ssl);
  746. tor_free(tls);
  747. SSL_CTX_free(ctx);
  748. }
  749. #endif /* !defined(OPENSSL_OPAQUE) */
  750. static void
  751. test_tortls_client_is_using_v2_ciphers(void *ignored)
  752. {
  753. (void)ignored;
  754. #ifdef HAVE_SSL_GET_CLIENT_CIPHERS
  755. tt_skip();
  756. done:
  757. (void)1;
  758. #else
  759. int ret;
  760. SSL_CTX *ctx;
  761. SSL *ssl;
  762. SSL_SESSION *sess;
  763. STACK_OF(SSL_CIPHER) *ciphers;
  764. library_init();
  765. ctx = SSL_CTX_new(TLSv1_method());
  766. ssl = SSL_new(ctx);
  767. sess = SSL_SESSION_new();
  768. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  769. tt_int_op(ret, OP_EQ, -1);
  770. ssl->session = sess;
  771. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  772. tt_int_op(ret, OP_EQ, 0);
  773. ciphers = sk_SSL_CIPHER_new_null();
  774. SSL_CIPHER *one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384");
  775. tt_assert(one);
  776. one->id = 0x00ff;
  777. sk_SSL_CIPHER_push(ciphers, one);
  778. sess->ciphers = ciphers;
  779. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  780. tt_int_op(ret, OP_EQ, 1);
  781. done:
  782. SSL_free(ssl);
  783. SSL_CTX_free(ctx);
  784. #endif /* defined(HAVE_SSL_GET_CLIENT_CIPHERS) */
  785. }
  786. #ifndef OPENSSL_OPAQUE
  787. static X509 *fixed_try_to_extract_certs_from_tls_cert_out_result = NULL;
  788. static X509 *fixed_try_to_extract_certs_from_tls_id_cert_out_result = NULL;
  789. static void
  790. fixed_try_to_extract_certs_from_tls(int severity, tor_tls_t *tls,
  791. X509 **cert_out, X509 **id_cert_out)
  792. {
  793. (void) severity;
  794. (void) tls;
  795. *cert_out = fixed_try_to_extract_certs_from_tls_cert_out_result;
  796. *id_cert_out = fixed_try_to_extract_certs_from_tls_id_cert_out_result;
  797. }
  798. #endif /* !defined(OPENSSL_OPAQUE) */
  799. #ifndef OPENSSL_OPAQUE
  800. static const char* notCompletelyValidCertString =
  801. "-----BEGIN CERTIFICATE-----\n"
  802. "MIICVjCCAb8CAg37MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\n"
  803. "A1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\n"
  804. "MRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\n"
  805. "YiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\n"
  806. "ODIyMDUyNzIzWhcNMTcwODIxMDUyNzIzWjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\n"
  807. "CAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\n"
  808. "ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMYBBrx5PlP0WNI/ZdzD\n"
  809. "+6Pktmurn+F2kQYbtc7XQh8/LTBvCo+P6iZoLEmUA9e7EXLRxgU1CVqeAi7QcAn9\n"
  810. "MwBlc8ksFJHB0rtf9pmf8Oza9E0Bynlq/4/Kb1x+d+AyhL7oK9tQwB24uHOueHi1\n"
  811. "C/iVv8CSWKiYe6hzN1txYe8rAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAASPdjigJ\n"
  812. "kXCqKWpnZ/Oc75EUcMi6HztaW8abUMlYXPIgkV2F7YanHOB7K4f7OOLjiz8DTPFf\n"
  813. "jC9UeuErhaA/zzWi8ewMTFZW/WshOrm3fNvcMrMLKtH534JKvcdMg6qIdjTFINIr\n"
  814. "evnAhf0cwULaebn+lMs8Pdl7y37+sfluVok=\n"
  815. "-----END CERTIFICATE-----\n";
  816. #endif /* !defined(OPENSSL_OPAQUE) */
  817. static const char* validCertString = "-----BEGIN CERTIFICATE-----\n"
  818. "MIIDpTCCAY0CAg3+MA0GCSqGSIb3DQEBBQUAMF4xCzAJBgNVBAYTAlVTMREwDwYD\n"
  819. "VQQIDAhJbGxpbm9pczEQMA4GA1UEBwwHQ2hpY2FnbzEUMBIGA1UECgwLVG9yIFRl\n"
  820. "c3RpbmcxFDASBgNVBAMMC1RvciBUZXN0aW5nMB4XDTE1MDkwNjEzMzk1OVoXDTQz\n"
  821. "MDEyMjEzMzk1OVowVjELMAkGA1UEBhMCVVMxEDAOBgNVBAcMB0NoaWNhZ28xFDAS\n"
  822. "BgNVBAoMC1RvciBUZXN0aW5nMR8wHQYDVQQDDBZ0ZXN0aW5nLnRvcnByb2plY3Qu\n"
  823. "b3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoT6uyVVhWyOF3wkHjjYbd\n"
  824. "nKaykyRv4JVtKQdZ4OpEErmX1zw4MmyzpQNV6iR4bQnWiyLfzyVJMZDIC/WILBfX\n"
  825. "w2Pza/yuLgUvDc3twMuhOACzOQVO8PrEF/aVv2+hbCCy2udXvKhnYn+CCXl3ozc8\n"
  826. "XcKYvujTXDyvGWY3xwAjlQIDAQABMA0GCSqGSIb3DQEBBQUAA4ICAQCUvnhzQWuQ\n"
  827. "MrN+pERkE+zcTI/9dGS90rUMMLgu8VDNqTa0TUQh8uO0EQ6uDvI8Js6e8tgwS0BR\n"
  828. "UBahqb7ZHv+rejGCBr5OudqD+x4STiiuPNJVs86JTLN8SpM9CHjIBH5WCCN2KOy3\n"
  829. "mevNoRcRRyYJzSFULCunIK6FGulszigMYGscrO4oiTkZiHPh9KvWT40IMiHfL+Lw\n"
  830. "EtEWiLex6064LcA2YQ1AMuSZyCexks63lcfaFmQbkYOKqXa1oLkIRuDsOaSVjTfe\n"
  831. "vec+X6jvf12cFTKS5WIeqkKF2Irt+dJoiHEGTe5RscUMN/f+gqHPzfFz5dR23sxo\n"
  832. "g+HC6MZHlFkLAOx3wW6epPS8A/m1mw3zMPoTnb2U2YYt8T0dJMMlUn/7Y1sEAa+a\n"
  833. "dSTMaeUf6VnJ//11m454EZl1to9Z7oJOgqmFffSrdD4BGIWe8f7hhW6L1Enmqe/J\n"
  834. "BKL3wbzZh80O1W0bndAwhnEEhlzneFY84cbBo9pmVxpODHkUcStpr5Z7pBDrcL21\n"
  835. "Ss/aB/1YrsVXhdvJdOGxl3Mnl9dUY57CympLGlT8f0pPS6GAKOelECOhFMHmJd8L\n"
  836. "dj3XQSmKtYHevZ6IvuMXSlB/fJvSjSlkCuLo5+kJoaqPuRu+i/S1qxeRy3CBwmnE\n"
  837. "LdSNdcX4N79GQJ996PA8+mUCQG7YRtK+WA==\n"
  838. "-----END CERTIFICATE-----\n";
  839. static const char* caCertString = "-----BEGIN CERTIFICATE-----\n"
  840. "MIIFjzCCA3egAwIBAgIJAKd5WgyfPMYRMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV\n"
  841. "BAYTAlVTMREwDwYDVQQIDAhJbGxpbm9pczEQMA4GA1UEBwwHQ2hpY2FnbzEUMBIG\n"
  842. "A1UECgwLVG9yIFRlc3RpbmcxFDASBgNVBAMMC1RvciBUZXN0aW5nMB4XDTE1MDkw\n"
  843. "NjEzMzc0MVoXDTQzMDEyMjEzMzc0MVowXjELMAkGA1UEBhMCVVMxETAPBgNVBAgM\n"
  844. "CElsbGlub2lzMRAwDgYDVQQHDAdDaGljYWdvMRQwEgYDVQQKDAtUb3IgVGVzdGlu\n"
  845. "ZzEUMBIGA1UEAwwLVG9yIFRlc3RpbmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw\n"
  846. "ggIKAoICAQCpLMUEiLW5leUgBZoEJms2V7lZRhIAjnJBhVMHD0e3UubNknmaQoxf\n"
  847. "ARz3rvqOaRd0JlV+qM9qE0DjiYcCVP1cAfqAo9d83uS1vwY3YMVJzADlaIiHfyVW\n"
  848. "uEgBy0vvkeUBqaua24dYlcwsemOiXYLu41yM1wkcGHW1AhBNHppY6cznb8TyLgNM\n"
  849. "2x3SGUdzc5XMyAFx51faKGBA3wjs+Hg1PLY7d30nmCgEOBavpm5I1disM/0k+Mcy\n"
  850. "YmAKEo/iHJX/rQzO4b9znP69juLlR8PDBUJEVIG/CYb6+uw8MjjUyiWXYoqfVmN2\n"
  851. "hm/lH8b6rXw1a2Aa3VTeD0DxaWeacMYHY/i01fd5n7hCoDTRNdSw5KJ0L3Z0SKTu\n"
  852. "0lzffKzDaIfyZGlpW5qdouACkWYzsaitQOePVE01PIdO30vUfzNTFDfy42ccx3Di\n"
  853. "59UCu+IXB+eMtrBfsok0Qc63vtF1linJgjHW1z/8ujk8F7/qkOfODhk4l7wngc2A\n"
  854. "EmwWFIFoGaiTEZHB9qteXr4unbXZ0AHpM02uGGwZEGohjFyebEb73M+J57WKKAFb\n"
  855. "PqbLcGUksL1SHNBNAJcVLttX55sO4nbidOS/kA3m+F1R04MBTyQF9qA6YDDHqdI3\n"
  856. "h/3pw0Z4fxVouTYT4/NfRnX4JTP4u+7Mpcoof28VME0qWqD1LnRhFQIDAQABo1Aw\n"
  857. "TjAdBgNVHQ4EFgQUMoAgIXH7pZ3QMRwTjT+DM9Yo/v0wHwYDVR0jBBgwFoAUMoAg\n"
  858. "IXH7pZ3QMRwTjT+DM9Yo/v0wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n"
  859. "AgEAUJxacjXR9sT+Xs6ISFiUsyd0T6WVKMnV46xrYJHirGfx+krWHrjxMY+ZtxYD\n"
  860. "DBDGlo11Qc4v6QrclNf5QUBfIiGQsP9Cm6hHcQ+Tpg9HHCgSqG1YNPwCPReCR4br\n"
  861. "BLvLfrfkcBL2IWM0PdQdCze+59DBfipsULD2mEn9fjYRXQEwb2QWtQ9qRc20Yb/x\n"
  862. "Q4b/+CvUodLkaq7B8MHz0BV8HHcBoph6DYaRmO/N+hPauIuSp6XyaGYcEefGKVKj\n"
  863. "G2+fcsdyXsoijNdL8vNKwm4j2gVwCBnw16J00yfFoV46YcbfqEdJB2je0XSvwXqt\n"
  864. "14AOTngxso2h9k9HLtrfpO1ZG/B5AcCMs1lzbZ2fp5DPHtjvvmvA2RJqgo3yjw4W\n"
  865. "4DHAuTglYFlC3mDHNfNtcGP20JvepcQNzNP2UzwcpOc94hfKikOFw+gf9Vf1qd0y\n"
  866. "h/Sk6OZHn2+JVUPiWHIQV98Vtoh4RmUZDJD+b55ia3fQGTGzt4z1XFzQYSva5sfs\n"
  867. "wocS/papthqWldQU7x+3wofNd5CNU1x6WKXG/yw30IT/4F8ADJD6GeygNT8QJYvt\n"
  868. "u/8lAkbOy6B9xGmSvr0Kk1oq9P2NshA6kalxp1Oz/DTNDdL4AeBXV3JmM6WWCjGn\n"
  869. "Yy1RT69d0rwYc5u/vnqODz1IjvT90smsrkBumGt791FAFeg=\n"
  870. "-----END CERTIFICATE-----\n";
  871. static X509 *
  872. read_cert_from(const char *str)
  873. {
  874. BIO *bio = BIO_new(BIO_s_mem());
  875. BIO_write(bio, str, (int) strlen(str));
  876. X509 *res = PEM_read_bio_X509(bio, NULL, NULL, NULL);
  877. BIO_free(bio);
  878. return res;
  879. }
  880. #ifndef OPENSSL_OPAQUE
  881. static void
  882. test_tortls_verify(void *ignored)
  883. {
  884. (void)ignored;
  885. int ret;
  886. tor_tls_t *tls;
  887. crypto_pk_t *k = NULL;
  888. X509 *cert1 = NULL, *cert2 = NULL, *invalidCert = NULL,
  889. *validCert = NULL, *caCert = NULL;
  890. cert1 = tor_malloc_zero(sizeof(X509));
  891. cert1->references = 10;
  892. cert2 = tor_malloc_zero(sizeof(X509));
  893. cert2->references = 10;
  894. validCert = read_cert_from(validCertString);
  895. caCert = read_cert_from(caCertString);
  896. invalidCert = read_cert_from(notCompletelyValidCertString);
  897. tls = tor_malloc_zero(sizeof(tor_tls_t));
  898. ret = tor_tls_verify(LOG_WARN, tls, &k);
  899. tt_int_op(ret, OP_EQ, -1);
  900. MOCK(try_to_extract_certs_from_tls, fixed_try_to_extract_certs_from_tls);
  901. fixed_try_to_extract_certs_from_tls_cert_out_result = cert1;
  902. ret = tor_tls_verify(LOG_WARN, tls, &k);
  903. tt_int_op(ret, OP_EQ, -1);
  904. fixed_try_to_extract_certs_from_tls_id_cert_out_result = cert2;
  905. ret = tor_tls_verify(LOG_WARN, tls, &k);
  906. tt_int_op(ret, OP_EQ, -1);
  907. fixed_try_to_extract_certs_from_tls_cert_out_result = invalidCert;
  908. fixed_try_to_extract_certs_from_tls_id_cert_out_result = invalidCert;
  909. ret = tor_tls_verify(LOG_WARN, tls, &k);
  910. tt_int_op(ret, OP_EQ, -1);
  911. fixed_try_to_extract_certs_from_tls_cert_out_result = validCert;
  912. fixed_try_to_extract_certs_from_tls_id_cert_out_result = caCert;
  913. ret = tor_tls_verify(LOG_WARN, tls, &k);
  914. tt_int_op(ret, OP_EQ, 0);
  915. tt_assert(k);
  916. done:
  917. UNMOCK(try_to_extract_certs_from_tls);
  918. tor_free(cert1);
  919. tor_free(cert2);
  920. tor_free(tls);
  921. tor_free(k);
  922. }
  923. #endif /* !defined(OPENSSL_OPAQUE) */
  924. #ifndef OPENSSL_OPAQUE
  925. static void
  926. test_tortls_check_lifetime(void *ignored)
  927. {
  928. (void)ignored;
  929. int ret;
  930. tor_tls_t *tls;
  931. X509 *validCert = read_cert_from(validCertString);
  932. time_t now = time(NULL);
  933. tls = tor_malloc_zero(sizeof(tor_tls_t));
  934. ret = tor_tls_check_lifetime(LOG_WARN, tls, time(NULL), 0, 0);
  935. tt_int_op(ret, OP_EQ, -1);
  936. tls->ssl = tor_malloc_zero(sizeof(SSL));
  937. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  938. tls->ssl->session->peer = validCert;
  939. ret = tor_tls_check_lifetime(LOG_WARN, tls, time(NULL), 0, 0);
  940. tt_int_op(ret, OP_EQ, 0);
  941. ASN1_STRING_free(validCert->cert_info->validity->notBefore);
  942. validCert->cert_info->validity->notBefore = ASN1_TIME_set(NULL, now-10);
  943. ASN1_STRING_free(validCert->cert_info->validity->notAfter);
  944. validCert->cert_info->validity->notAfter = ASN1_TIME_set(NULL, now+60);
  945. ret = tor_tls_check_lifetime(LOG_WARN, tls, time(NULL), 0, -1000);
  946. tt_int_op(ret, OP_EQ, -1);
  947. ret = tor_tls_check_lifetime(LOG_WARN, tls, time(NULL), -1000, 0);
  948. tt_int_op(ret, OP_EQ, -1);
  949. done:
  950. tor_free(tls->ssl->session);
  951. tor_free(tls->ssl);
  952. tor_free(tls);
  953. X509_free(validCert);
  954. }
  955. #endif /* !defined(OPENSSL_OPAQUE) */
  956. #ifndef OPENSSL_OPAQUE
  957. static int fixed_ssl_pending_result = 0;
  958. static int
  959. fixed_ssl_pending(const SSL *ignored)
  960. {
  961. (void)ignored;
  962. return fixed_ssl_pending_result;
  963. }
  964. static void
  965. test_tortls_get_pending_bytes(void *ignored)
  966. {
  967. (void)ignored;
  968. int ret;
  969. tor_tls_t *tls;
  970. SSL_METHOD *method;
  971. tls = tor_malloc_zero(sizeof(tor_tls_t));
  972. tls->ssl = tor_malloc_zero(sizeof(SSL));
  973. method = tor_malloc_zero(sizeof(SSL_METHOD));
  974. method->ssl_pending = fixed_ssl_pending;
  975. tls->ssl->method = method;
  976. fixed_ssl_pending_result = 42;
  977. ret = tor_tls_get_pending_bytes(tls);
  978. tt_int_op(ret, OP_EQ, 42);
  979. done:
  980. tor_free(method);
  981. tor_free(tls->ssl);
  982. tor_free(tls);
  983. }
  984. #endif /* !defined(OPENSSL_OPAQUE) */
  985. static void
  986. test_tortls_get_forced_write_size(void *ignored)
  987. {
  988. (void)ignored;
  989. long ret;
  990. tor_tls_t *tls;
  991. tls = tor_malloc_zero(sizeof(tor_tls_t));
  992. tls->wantwrite_n = 43;
  993. ret = tor_tls_get_forced_write_size(tls);
  994. tt_int_op(ret, OP_EQ, 43);
  995. done:
  996. tor_free(tls);
  997. }
  998. static void
  999. test_tortls_get_write_overhead_ratio(void *ignored)
  1000. {
  1001. (void)ignored;
  1002. double ret;
  1003. total_bytes_written_over_tls = 0;
  1004. ret = tls_get_write_overhead_ratio();
  1005. tt_double_op(fabs(ret - 1.0), OP_LT, 1E-12);
  1006. total_bytes_written_by_tls = 10;
  1007. total_bytes_written_over_tls = 1;
  1008. ret = tls_get_write_overhead_ratio();
  1009. tt_double_op(fabs(ret - 10.0), OP_LT, 1E-12);
  1010. total_bytes_written_by_tls = 10;
  1011. total_bytes_written_over_tls = 2;
  1012. ret = tls_get_write_overhead_ratio();
  1013. tt_double_op(fabs(ret - 5.0), OP_LT, 1E-12);
  1014. done:
  1015. (void)0;
  1016. }
  1017. static void
  1018. test_tortls_used_v1_handshake(void *ignored)
  1019. {
  1020. (void)ignored;
  1021. int ret;
  1022. tor_tls_t *tls;
  1023. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1024. // These tests assume both V2 handshake server and client are enabled
  1025. tls->wasV2Handshake = 0;
  1026. ret = tor_tls_used_v1_handshake(tls);
  1027. tt_int_op(ret, OP_EQ, 1);
  1028. tls->wasV2Handshake = 1;
  1029. ret = tor_tls_used_v1_handshake(tls);
  1030. tt_int_op(ret, OP_EQ, 0);
  1031. done:
  1032. tor_free(tls);
  1033. }
  1034. static void
  1035. test_tortls_get_num_server_handshakes(void *ignored)
  1036. {
  1037. (void)ignored;
  1038. int ret;
  1039. tor_tls_t *tls;
  1040. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1041. tls->server_handshake_count = 3;
  1042. ret = tor_tls_get_num_server_handshakes(tls);
  1043. tt_int_op(ret, OP_EQ, 3);
  1044. done:
  1045. tor_free(tls);
  1046. }
  1047. static void
  1048. test_tortls_server_got_renegotiate(void *ignored)
  1049. {
  1050. (void)ignored;
  1051. int ret;
  1052. tor_tls_t *tls;
  1053. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1054. tls->got_renegotiate = 1;
  1055. ret = tor_tls_server_got_renegotiate(tls);
  1056. tt_int_op(ret, OP_EQ, 1);
  1057. done:
  1058. tor_free(tls);
  1059. }
  1060. #ifndef OPENSSL_OPAQUE
  1061. static void
  1062. test_tortls_SSL_SESSION_get_master_key(void *ignored)
  1063. {
  1064. (void)ignored;
  1065. size_t ret;
  1066. tor_tls_t *tls;
  1067. uint8_t *out;
  1068. out = tor_malloc_zero(1);
  1069. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1070. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1071. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1072. tls->ssl->session->master_key_length = 1;
  1073. #ifndef HAVE_SSL_SESSION_GET_MASTER_KEY
  1074. tls->ssl->session->master_key[0] = 43;
  1075. ret = SSL_SESSION_get_master_key(tls->ssl->session, out, 0);
  1076. tt_int_op(ret, OP_EQ, 1);
  1077. tt_int_op(out[0], OP_EQ, 0);
  1078. ret = SSL_SESSION_get_master_key(tls->ssl->session, out, 1);
  1079. tt_int_op(ret, OP_EQ, 1);
  1080. tt_int_op(out[0], OP_EQ, 43);
  1081. done:
  1082. #endif /* !defined(HAVE_SSL_SESSION_GET_MASTER_KEY) */
  1083. tor_free(tls->ssl->session);
  1084. tor_free(tls->ssl);
  1085. tor_free(tls);
  1086. tor_free(out);
  1087. }
  1088. #endif /* !defined(OPENSSL_OPAQUE) */
  1089. #ifndef OPENSSL_OPAQUE
  1090. static void
  1091. test_tortls_get_tlssecrets(void *ignored)
  1092. {
  1093. (void)ignored;
  1094. int ret;
  1095. uint8_t *secret_out = tor_malloc_zero(DIGEST256_LEN);
  1096. tor_tls_t *tls;
  1097. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1098. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1099. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1100. tls->ssl->session->master_key_length = 1;
  1101. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  1102. ret = tor_tls_get_tlssecrets(tls, secret_out);
  1103. tt_int_op(ret, OP_EQ, 0);
  1104. done:
  1105. tor_free(secret_out);
  1106. tor_free(tls->ssl->s3);
  1107. tor_free(tls->ssl->session);
  1108. tor_free(tls->ssl);
  1109. tor_free(tls);
  1110. }
  1111. #endif /* !defined(OPENSSL_OPAQUE) */
  1112. #ifndef OPENSSL_OPAQUE
  1113. static void
  1114. test_tortls_get_buffer_sizes(void *ignored)
  1115. {
  1116. (void)ignored;
  1117. int ret;
  1118. tor_tls_t *tls;
  1119. size_t rbuf_c=-1, rbuf_b=-1, wbuf_c=-1, wbuf_b=-1;
  1120. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1121. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1122. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  1123. tls->ssl->s3->rbuf.buf = NULL;
  1124. tls->ssl->s3->rbuf.len = 1;
  1125. tls->ssl->s3->rbuf.offset = 0;
  1126. tls->ssl->s3->rbuf.left = 42;
  1127. tls->ssl->s3->wbuf.buf = NULL;
  1128. tls->ssl->s3->wbuf.len = 2;
  1129. tls->ssl->s3->wbuf.offset = 0;
  1130. tls->ssl->s3->wbuf.left = 43;
  1131. ret = tor_tls_get_buffer_sizes(tls, &rbuf_c, &rbuf_b, &wbuf_c, &wbuf_b);
  1132. #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0)
  1133. tt_int_op(ret, OP_EQ, -1);
  1134. #else
  1135. tt_int_op(ret, OP_EQ, 0);
  1136. tt_int_op(rbuf_c, OP_EQ, 0);
  1137. tt_int_op(wbuf_c, OP_EQ, 0);
  1138. tt_int_op(rbuf_b, OP_EQ, 42);
  1139. tt_int_op(wbuf_b, OP_EQ, 43);
  1140. tls->ssl->s3->rbuf.buf = tor_malloc_zero(1);
  1141. tls->ssl->s3->wbuf.buf = tor_malloc_zero(1);
  1142. ret = tor_tls_get_buffer_sizes(tls, &rbuf_c, &rbuf_b, &wbuf_c, &wbuf_b);
  1143. tt_int_op(ret, OP_EQ, 0);
  1144. tt_int_op(rbuf_c, OP_EQ, 1);
  1145. tt_int_op(wbuf_c, OP_EQ, 2);
  1146. #endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) */
  1147. done:
  1148. tor_free(tls->ssl->s3->rbuf.buf);
  1149. tor_free(tls->ssl->s3->wbuf.buf);
  1150. tor_free(tls->ssl->s3);
  1151. tor_free(tls->ssl);
  1152. tor_free(tls);
  1153. }
  1154. #endif /* !defined(OPENSSL_OPAQUE) */
  1155. static void
  1156. test_tortls_evaluate_ecgroup_for_tls(void *ignored)
  1157. {
  1158. (void)ignored;
  1159. int ret;
  1160. ret = evaluate_ecgroup_for_tls(NULL);
  1161. tt_int_op(ret, OP_EQ, 1);
  1162. ret = evaluate_ecgroup_for_tls("foobar");
  1163. tt_int_op(ret, OP_EQ, 0);
  1164. ret = evaluate_ecgroup_for_tls("P256");
  1165. tt_int_op(ret, OP_EQ, 1);
  1166. ret = evaluate_ecgroup_for_tls("P224");
  1167. // tt_int_op(ret, OP_EQ, 1); This varies between machines
  1168. tt_assert(ret == 0 || ret == 1);
  1169. done:
  1170. (void)0;
  1171. }
  1172. #ifndef OPENSSL_OPAQUE
  1173. typedef struct cert_pkey_st_local
  1174. {
  1175. X509 *x509;
  1176. EVP_PKEY *privatekey;
  1177. const EVP_MD *digest;
  1178. } CERT_PKEY_local;
  1179. typedef struct sess_cert_st_local
  1180. {
  1181. STACK_OF(X509) *cert_chain;
  1182. int peer_cert_type;
  1183. CERT_PKEY_local *peer_key;
  1184. CERT_PKEY_local peer_pkeys[8];
  1185. int references;
  1186. } SESS_CERT_local;
  1187. static void
  1188. test_tortls_try_to_extract_certs_from_tls(void *ignored)
  1189. {
  1190. (void)ignored;
  1191. tor_tls_t *tls;
  1192. X509 *cert = NULL, *id_cert = NULL, *c1 = NULL, *c2 = NULL;
  1193. SESS_CERT_local *sess = NULL;
  1194. c1 = read_cert_from(validCertString);
  1195. c2 = read_cert_from(caCertString);
  1196. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1197. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1198. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1199. sess = tor_malloc_zero(sizeof(SESS_CERT_local));
  1200. tls->ssl->session->sess_cert = (void *)sess;
  1201. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  1202. tt_assert(!cert);
  1203. tt_assert(!id_cert);
  1204. tls->ssl->session->peer = c1;
  1205. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  1206. tt_assert(cert == c1);
  1207. tt_assert(!id_cert);
  1208. X509_free(cert); /* decrease refcnt */
  1209. sess->cert_chain = sk_X509_new_null();
  1210. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  1211. tt_assert(cert == c1);
  1212. tt_assert(!id_cert);
  1213. X509_free(cert); /* decrease refcnt */
  1214. sk_X509_push(sess->cert_chain, c1);
  1215. sk_X509_push(sess->cert_chain, c2);
  1216. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  1217. tt_assert(cert == c1);
  1218. tt_assert(id_cert);
  1219. X509_free(cert); /* decrease refcnt */
  1220. done:
  1221. sk_X509_free(sess->cert_chain);
  1222. tor_free(sess);
  1223. tor_free(tls->ssl->session);
  1224. tor_free(tls->ssl);
  1225. tor_free(tls);
  1226. X509_free(c1);
  1227. X509_free(c2);
  1228. }
  1229. #endif /* !defined(OPENSSL_OPAQUE) */
  1230. #ifndef OPENSSL_OPAQUE
  1231. static void
  1232. test_tortls_get_peer_cert(void *ignored)
  1233. {
  1234. (void)ignored;
  1235. tor_x509_cert_t *ret;
  1236. tor_tls_t *tls;
  1237. X509 *cert = NULL;
  1238. cert = read_cert_from(validCertString);
  1239. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1240. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1241. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1242. ret = tor_tls_get_peer_cert(tls);
  1243. tt_assert(!ret);
  1244. tls->ssl->session->peer = cert;
  1245. ret = tor_tls_get_peer_cert(tls);
  1246. tt_assert(ret);
  1247. tt_assert(ret->cert == cert);
  1248. done:
  1249. tor_x509_cert_free(ret);
  1250. tor_free(tls->ssl->session);
  1251. tor_free(tls->ssl);
  1252. tor_free(tls);
  1253. X509_free(cert);
  1254. }
  1255. #endif /* !defined(OPENSSL_OPAQUE) */
  1256. #ifndef OPENSSL_OPAQUE
  1257. static void
  1258. test_tortls_peer_has_cert(void *ignored)
  1259. {
  1260. (void)ignored;
  1261. int ret;
  1262. tor_tls_t *tls;
  1263. X509 *cert = NULL;
  1264. cert = read_cert_from(validCertString);
  1265. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1266. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1267. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  1268. ret = tor_tls_peer_has_cert(tls);
  1269. tt_assert(!ret);
  1270. tls->ssl->session->peer = cert;
  1271. ret = tor_tls_peer_has_cert(tls);
  1272. tt_assert(ret);
  1273. done:
  1274. tor_free(tls->ssl->session);
  1275. tor_free(tls->ssl);
  1276. tor_free(tls);
  1277. X509_free(cert);
  1278. }
  1279. #endif /* !defined(OPENSSL_OPAQUE) */
  1280. static void
  1281. test_tortls_is_server(void *ignored)
  1282. {
  1283. (void)ignored;
  1284. tor_tls_t *tls;
  1285. int ret;
  1286. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1287. tls->isServer = 1;
  1288. ret = tor_tls_is_server(tls);
  1289. tt_int_op(ret, OP_EQ, 1);
  1290. done:
  1291. tor_free(tls);
  1292. }
  1293. #ifndef OPENSSL_OPAQUE
  1294. static void
  1295. test_tortls_session_secret_cb(void *ignored)
  1296. {
  1297. (void)ignored;
  1298. tor_tls_t *tls;
  1299. SSL_CTX *ctx;
  1300. STACK_OF(SSL_CIPHER) *ciphers = NULL;
  1301. SSL_CIPHER *one;
  1302. library_init();
  1303. tor_tls_allocate_tor_tls_object_ex_data_index();
  1304. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1305. tls->magic = TOR_TLS_MAGIC;
  1306. ctx = SSL_CTX_new(TLSv1_method());
  1307. tls->ssl = SSL_new(ctx);
  1308. SSL_set_ex_data(tls->ssl, tor_tls_object_ex_data_index, tls);
  1309. SSL_set_session_secret_cb(tls->ssl, tor_tls_session_secret_cb, NULL);
  1310. tor_tls_session_secret_cb(tls->ssl, NULL, NULL, NULL, NULL, NULL);
  1311. tt_assert(!tls->ssl->tls_session_secret_cb);
  1312. one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384");
  1313. one->id = 0x00ff;
  1314. ciphers = sk_SSL_CIPHER_new_null();
  1315. sk_SSL_CIPHER_push(ciphers, one);
  1316. tls->client_cipher_list_type = 0;
  1317. tor_tls_session_secret_cb(tls->ssl, NULL, NULL, ciphers, NULL, NULL);
  1318. tt_assert(!tls->ssl->tls_session_secret_cb);
  1319. done:
  1320. sk_SSL_CIPHER_free(ciphers);
  1321. SSL_free(tls->ssl);
  1322. SSL_CTX_free(ctx);
  1323. tor_free(tls);
  1324. }
  1325. #endif /* !defined(OPENSSL_OPAQUE) */
  1326. #ifndef OPENSSL_OPAQUE
  1327. /* TODO: It seems block_renegotiation and unblock_renegotiation and
  1328. * using different blags. This might not be correct */
  1329. static void
  1330. test_tortls_block_renegotiation(void *ignored)
  1331. {
  1332. (void)ignored;
  1333. tor_tls_t *tls;
  1334. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1335. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1336. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  1337. #ifndef SUPPORT_UNSAFE_RENEGOTIATION_FLAG
  1338. #define SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0
  1339. #endif
  1340. tls->ssl->s3->flags = SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
  1341. tor_tls_block_renegotiation(tls);
  1342. #ifndef OPENSSL_1_1_API
  1343. tt_assert(!(tls->ssl->s3->flags &
  1344. SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION));
  1345. #endif
  1346. done:
  1347. tor_free(tls->ssl->s3);
  1348. tor_free(tls->ssl);
  1349. tor_free(tls);
  1350. }
  1351. static void
  1352. test_tortls_unblock_renegotiation(void *ignored)
  1353. {
  1354. (void)ignored;
  1355. tor_tls_t *tls;
  1356. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1357. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1358. tor_tls_unblock_renegotiation(tls);
  1359. tt_uint_op(SSL_get_options(tls->ssl) &
  1360. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, OP_EQ,
  1361. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
  1362. done:
  1363. tor_free(tls->ssl);
  1364. tor_free(tls);
  1365. }
  1366. #endif /* !defined(OPENSSL_OPAQUE) */
  1367. #ifndef OPENSSL_OPAQUE
  1368. static void
  1369. test_tortls_assert_renegotiation_unblocked(void *ignored)
  1370. {
  1371. (void)ignored;
  1372. tor_tls_t *tls;
  1373. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1374. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1375. tor_tls_unblock_renegotiation(tls);
  1376. tor_tls_assert_renegotiation_unblocked(tls);
  1377. /* No assertion here - this test will fail if tor_assert is turned on
  1378. * and things are bad. */
  1379. tor_free(tls->ssl);
  1380. tor_free(tls);
  1381. }
  1382. #endif /* !defined(OPENSSL_OPAQUE) */
  1383. static void
  1384. test_tortls_set_logged_address(void *ignored)
  1385. {
  1386. (void)ignored;
  1387. tor_tls_t *tls;
  1388. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1389. tor_tls_set_logged_address(tls, "foo bar");
  1390. tt_str_op(tls->address, OP_EQ, "foo bar");
  1391. tor_tls_set_logged_address(tls, "foo bar 2");
  1392. tt_str_op(tls->address, OP_EQ, "foo bar 2");
  1393. done:
  1394. tor_free(tls->address);
  1395. tor_free(tls);
  1396. }
  1397. #ifndef OPENSSL_OPAQUE
  1398. static void
  1399. example_cb(tor_tls_t *t, void *arg)
  1400. {
  1401. (void)t;
  1402. (void)arg;
  1403. }
  1404. static void
  1405. test_tortls_set_renegotiate_callback(void *ignored)
  1406. {
  1407. (void)ignored;
  1408. tor_tls_t *tls;
  1409. const char *arg = "hello";
  1410. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1411. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1412. tor_tls_set_renegotiate_callback(tls, example_cb, (void*)arg);
  1413. tt_assert(tls->negotiated_callback == example_cb);
  1414. tt_assert(tls->callback_arg == arg);
  1415. tt_assert(!tls->got_renegotiate);
  1416. /* Assumes V2_HANDSHAKE_SERVER */
  1417. tt_assert(tls->ssl->info_callback == tor_tls_server_info_callback);
  1418. tor_tls_set_renegotiate_callback(tls, NULL, (void*)arg);
  1419. tt_assert(tls->ssl->info_callback == tor_tls_debug_state_callback);
  1420. done:
  1421. tor_free(tls->ssl);
  1422. tor_free(tls);
  1423. }
  1424. #endif /* !defined(OPENSSL_OPAQUE) */
  1425. #ifndef OPENSSL_OPAQUE
  1426. static SSL_CIPHER *fixed_cipher1 = NULL;
  1427. static SSL_CIPHER *fixed_cipher2 = NULL;
  1428. static const SSL_CIPHER *
  1429. fake_get_cipher(unsigned ncipher)
  1430. {
  1431. switch (ncipher) {
  1432. case 1:
  1433. return fixed_cipher1;
  1434. case 2:
  1435. return fixed_cipher2;
  1436. default:
  1437. return NULL;
  1438. }
  1439. }
  1440. #endif /* !defined(OPENSSL_OPAQUE) */
  1441. #ifndef OPENSSL_OPAQUE
  1442. static void
  1443. test_tortls_find_cipher_by_id(void *ignored)
  1444. {
  1445. (void)ignored;
  1446. int ret;
  1447. SSL *ssl;
  1448. SSL_CTX *ctx;
  1449. const SSL_METHOD *m = TLSv1_method();
  1450. SSL_METHOD *empty_method = tor_malloc_zero(sizeof(SSL_METHOD));
  1451. fixed_cipher1 = tor_malloc_zero(sizeof(SSL_CIPHER));
  1452. fixed_cipher2 = tor_malloc_zero(sizeof(SSL_CIPHER));
  1453. fixed_cipher2->id = 0xC00A;
  1454. library_init();
  1455. ctx = SSL_CTX_new(m);
  1456. ssl = SSL_new(ctx);
  1457. ret = find_cipher_by_id(ssl, NULL, 0xC00A);
  1458. tt_int_op(ret, OP_EQ, 1);
  1459. ret = find_cipher_by_id(ssl, m, 0xC00A);
  1460. tt_int_op(ret, OP_EQ, 1);
  1461. ret = find_cipher_by_id(ssl, m, 0xFFFF);
  1462. tt_int_op(ret, OP_EQ, 0);
  1463. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1464. tt_int_op(ret, OP_EQ, 1);
  1465. ret = find_cipher_by_id(ssl, empty_method, 0xFFFF);
  1466. #ifdef HAVE_SSL_CIPHER_FIND
  1467. tt_int_op(ret, OP_EQ, 0);
  1468. #else
  1469. tt_int_op(ret, OP_EQ, 1);
  1470. #endif
  1471. empty_method->get_cipher = fake_get_cipher;
  1472. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1473. tt_int_op(ret, OP_EQ, 1);
  1474. empty_method->get_cipher = m->get_cipher;
  1475. empty_method->num_ciphers = m->num_ciphers;
  1476. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1477. tt_int_op(ret, OP_EQ, 1);
  1478. empty_method->get_cipher = fake_get_cipher;
  1479. empty_method->num_ciphers = m->num_ciphers;
  1480. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1481. tt_int_op(ret, OP_EQ, 1);
  1482. empty_method->num_ciphers = fake_num_ciphers;
  1483. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1484. #ifdef HAVE_SSL_CIPHER_FIND
  1485. tt_int_op(ret, OP_EQ, 1);
  1486. #else
  1487. tt_int_op(ret, OP_EQ, 0);
  1488. #endif
  1489. done:
  1490. tor_free(empty_method);
  1491. SSL_free(ssl);
  1492. SSL_CTX_free(ctx);
  1493. tor_free(fixed_cipher1);
  1494. }
  1495. #endif /* !defined(OPENSSL_OPAQUE) */
  1496. #ifndef OPENSSL_OPAQUE
  1497. static void
  1498. test_tortls_debug_state_callback(void *ignored)
  1499. {
  1500. (void)ignored;
  1501. SSL *ssl;
  1502. char *buf = tor_malloc_zero(1000);
  1503. int n;
  1504. setup_capture_of_logs(LOG_DEBUG);
  1505. ssl = tor_malloc_zero(sizeof(SSL));
  1506. tor_tls_debug_state_callback(ssl, 32, 45);
  1507. n = tor_snprintf(buf, 1000, "SSL %p is now in state unknown"
  1508. " state [type=32,val=45].\n", ssl);
  1509. /* tor's snprintf returns -1 on error */
  1510. tt_int_op(n, OP_NE, -1);
  1511. expect_log_msg(buf);
  1512. done:
  1513. teardown_capture_of_logs();
  1514. tor_free(buf);
  1515. tor_free(ssl);
  1516. }
  1517. #endif /* !defined(OPENSSL_OPAQUE) */
  1518. #ifndef OPENSSL_OPAQUE
  1519. static void
  1520. test_tortls_server_info_callback(void *ignored)
  1521. {
  1522. (void)ignored;
  1523. tor_tls_t *tls;
  1524. SSL_CTX *ctx;
  1525. SSL *ssl;
  1526. library_init();
  1527. ctx = SSL_CTX_new(TLSv1_method());
  1528. ssl = SSL_new(ctx);
  1529. tor_tls_allocate_tor_tls_object_ex_data_index();
  1530. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1531. tls->magic = TOR_TLS_MAGIC;
  1532. tls->ssl = ssl;
  1533. setup_full_capture_of_logs(LOG_WARN);
  1534. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_A);
  1535. mock_clean_saved_logs();
  1536. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1537. expect_single_log_msg("Couldn't look up the tls for an SSL*. How odd!\n");
  1538. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_B);
  1539. mock_clean_saved_logs();
  1540. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1541. expect_single_log_msg("Couldn't look up the tls for an SSL*. How odd!\n");
  1542. SSL_set_state(ssl, 99);
  1543. mock_clean_saved_logs();
  1544. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1545. expect_no_log_entry();
  1546. teardown_capture_of_logs();
  1547. SSL_set_ex_data(tls->ssl, tor_tls_object_ex_data_index, tls);
  1548. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_B);
  1549. tls->negotiated_callback = 0;
  1550. tls->server_handshake_count = 120;
  1551. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1552. tt_int_op(tls->server_handshake_count, OP_EQ, 121);
  1553. tls->server_handshake_count = 127;
  1554. tls->negotiated_callback = (void *)1;
  1555. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1556. tt_int_op(tls->server_handshake_count, OP_EQ, 127);
  1557. tt_int_op(tls->got_renegotiate, OP_EQ, 1);
  1558. tls->ssl->session = SSL_SESSION_new();
  1559. tls->wasV2Handshake = 0;
  1560. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1561. tt_int_op(tls->wasV2Handshake, OP_EQ, 0);
  1562. done:
  1563. teardown_capture_of_logs();
  1564. SSL_free(ssl);
  1565. SSL_CTX_free(ctx);
  1566. tor_free(tls);
  1567. }
  1568. #endif /* !defined(OPENSSL_OPAQUE) */
  1569. #ifndef OPENSSL_OPAQUE
  1570. static int fixed_ssl_read_result_index;
  1571. static int fixed_ssl_read_result[5];
  1572. static int fixed_ssl_shutdown_result;
  1573. static int
  1574. fixed_ssl_read(SSL *s, void *buf, int len)
  1575. {
  1576. (void)s;
  1577. (void)buf;
  1578. (void)len;
  1579. return fixed_ssl_read_result[fixed_ssl_read_result_index++];
  1580. }
  1581. static int
  1582. fixed_ssl_shutdown(SSL *s)
  1583. {
  1584. (void)s;
  1585. return fixed_ssl_shutdown_result;
  1586. }
  1587. #ifndef LIBRESSL_VERSION_NUMBER
  1588. static int fixed_ssl_state_to_set;
  1589. static tor_tls_t *fixed_tls;
  1590. static int
  1591. setting_version_ssl_shutdown(SSL *s)
  1592. {
  1593. s->version = SSL2_VERSION;
  1594. return fixed_ssl_shutdown_result;
  1595. }
  1596. static int
  1597. setting_version_and_state_ssl_shutdown(SSL *s)
  1598. {
  1599. fixed_tls->state = fixed_ssl_state_to_set;
  1600. s->version = SSL2_VERSION;
  1601. return fixed_ssl_shutdown_result;
  1602. }
  1603. #endif /* !defined(LIBRESSL_VERSION_NUMBER) */
  1604. static int
  1605. dummy_handshake_func(SSL *s)
  1606. {
  1607. (void)s;
  1608. return 1;
  1609. }
  1610. static void
  1611. test_tortls_shutdown(void *ignored)
  1612. {
  1613. (void)ignored;
  1614. int ret;
  1615. tor_tls_t *tls;
  1616. SSL_METHOD *method = give_me_a_test_method();
  1617. setup_capture_of_logs(LOG_WARN);
  1618. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1619. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1620. tls->ssl->method = method;
  1621. method->ssl_read = fixed_ssl_read;
  1622. method->ssl_shutdown = fixed_ssl_shutdown;
  1623. ret = tor_tls_shutdown(tls);
  1624. tt_int_op(ret, OP_EQ, -9);
  1625. tls->state = TOR_TLS_ST_SENTCLOSE;
  1626. fixed_ssl_read_result_index = 0;
  1627. fixed_ssl_read_result[0] = 10;
  1628. fixed_ssl_read_result[1] = -1;
  1629. ret = tor_tls_shutdown(tls);
  1630. tt_int_op(ret, OP_EQ, -9);
  1631. #ifndef LIBRESSL_VERSION_NUMBER
  1632. tls->ssl->handshake_func = dummy_handshake_func;
  1633. fixed_ssl_read_result_index = 0;
  1634. fixed_ssl_read_result[0] = 10;
  1635. fixed_ssl_read_result[1] = 42;
  1636. fixed_ssl_read_result[2] = 0;
  1637. fixed_ssl_shutdown_result = 1;
  1638. ERR_clear_error();
  1639. tls->ssl->version = SSL2_VERSION;
  1640. ret = tor_tls_shutdown(tls);
  1641. tt_int_op(ret, OP_EQ, TOR_TLS_DONE);
  1642. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_CLOSED);
  1643. fixed_ssl_read_result_index = 0;
  1644. fixed_ssl_read_result[0] = 10;
  1645. fixed_ssl_read_result[1] = 42;
  1646. fixed_ssl_read_result[2] = 0;
  1647. fixed_ssl_shutdown_result = 0;
  1648. ERR_clear_error();
  1649. tls->ssl->version = 0;
  1650. ret = tor_tls_shutdown(tls);
  1651. tt_int_op(ret, OP_EQ, TOR_TLS_DONE);
  1652. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_CLOSED);
  1653. fixed_ssl_read_result_index = 0;
  1654. fixed_ssl_read_result[0] = 10;
  1655. fixed_ssl_read_result[1] = 42;
  1656. fixed_ssl_read_result[2] = 0;
  1657. fixed_ssl_shutdown_result = 0;
  1658. ERR_clear_error();
  1659. tls->ssl->version = 0;
  1660. method->ssl_shutdown = setting_version_ssl_shutdown;
  1661. ret = tor_tls_shutdown(tls);
  1662. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1663. fixed_ssl_read_result_index = 0;
  1664. fixed_ssl_read_result[0] = 10;
  1665. fixed_ssl_read_result[1] = 42;
  1666. fixed_ssl_read_result[2] = 0;
  1667. fixed_ssl_shutdown_result = 0;
  1668. fixed_tls = tls;
  1669. fixed_ssl_state_to_set = TOR_TLS_ST_GOTCLOSE;
  1670. ERR_clear_error();
  1671. tls->ssl->version = 0;
  1672. method->ssl_shutdown = setting_version_and_state_ssl_shutdown;
  1673. ret = tor_tls_shutdown(tls);
  1674. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1675. fixed_ssl_read_result_index = 0;
  1676. fixed_ssl_read_result[0] = 10;
  1677. fixed_ssl_read_result[1] = 42;
  1678. fixed_ssl_read_result[2] = 0;
  1679. fixed_ssl_read_result[3] = -1;
  1680. fixed_ssl_shutdown_result = 0;
  1681. fixed_tls = tls;
  1682. fixed_ssl_state_to_set = 0;
  1683. ERR_clear_error();
  1684. tls->ssl->version = 0;
  1685. method->ssl_shutdown = setting_version_and_state_ssl_shutdown;
  1686. ret = tor_tls_shutdown(tls);
  1687. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1688. #endif /* !defined(LIBRESSL_VERSION_NUMBER) */
  1689. done:
  1690. teardown_capture_of_logs();
  1691. tor_free(method);
  1692. tor_free(tls->ssl);
  1693. tor_free(tls);
  1694. }
  1695. static int negotiated_callback_called;
  1696. static void
  1697. negotiated_callback_setter(tor_tls_t *t, void *arg)
  1698. {
  1699. (void)t;
  1700. (void)arg;
  1701. negotiated_callback_called++;
  1702. }
  1703. static void
  1704. test_tortls_read(void *ignored)
  1705. {
  1706. (void)ignored;
  1707. int ret;
  1708. tor_tls_t *tls;
  1709. char buf[100];
  1710. SSL_METHOD *method = give_me_a_test_method();
  1711. setup_capture_of_logs(LOG_WARN);
  1712. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1713. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1714. tls->state = TOR_TLS_ST_OPEN;
  1715. ret = tor_tls_read(tls, buf, 10);
  1716. tt_int_op(ret, OP_EQ, -9);
  1717. /* These tests assume that V2_HANDSHAKE_SERVER is set */
  1718. tls->ssl->handshake_func = dummy_handshake_func;
  1719. tls->ssl->method = method;
  1720. method->ssl_read = fixed_ssl_read;
  1721. fixed_ssl_read_result_index = 0;
  1722. fixed_ssl_read_result[0] = 42;
  1723. tls->state = TOR_TLS_ST_OPEN;
  1724. ERR_clear_error();
  1725. ret = tor_tls_read(tls, buf, 10);
  1726. tt_int_op(ret, OP_EQ, 42);
  1727. tls->state = TOR_TLS_ST_OPEN;
  1728. tls->got_renegotiate = 1;
  1729. fixed_ssl_read_result_index = 0;
  1730. ERR_clear_error();
  1731. ret = tor_tls_read(tls, buf, 10);
  1732. tt_int_op(tls->got_renegotiate, OP_EQ, 0);
  1733. tls->state = TOR_TLS_ST_OPEN;
  1734. tls->got_renegotiate = 1;
  1735. negotiated_callback_called = 0;
  1736. tls->negotiated_callback = negotiated_callback_setter;
  1737. fixed_ssl_read_result_index = 0;
  1738. ERR_clear_error();
  1739. ret = tor_tls_read(tls, buf, 10);
  1740. tt_int_op(negotiated_callback_called, OP_EQ, 1);
  1741. #ifndef LIBRESSL_VERSION_NUMBER
  1742. fixed_ssl_read_result_index = 0;
  1743. fixed_ssl_read_result[0] = 0;
  1744. tls->ssl->version = SSL2_VERSION;
  1745. ERR_clear_error();
  1746. ret = tor_tls_read(tls, buf, 10);
  1747. tt_int_op(ret, OP_EQ, TOR_TLS_CLOSE);
  1748. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_CLOSED);
  1749. #endif /* !defined(LIBRESSL_VERSION_NUMBER) */
  1750. // TODO: fill up
  1751. done:
  1752. teardown_capture_of_logs();
  1753. tor_free(tls->ssl);
  1754. tor_free(tls);
  1755. tor_free(method);
  1756. }
  1757. static int fixed_ssl_write_result;
  1758. static int
  1759. fixed_ssl_write(SSL *s, const void *buf, int len)
  1760. {
  1761. (void)s;
  1762. (void)buf;
  1763. (void)len;
  1764. return fixed_ssl_write_result;
  1765. }
  1766. static void
  1767. test_tortls_write(void *ignored)
  1768. {
  1769. (void)ignored;
  1770. int ret;
  1771. tor_tls_t *tls;
  1772. SSL_METHOD *method = give_me_a_test_method();
  1773. char buf[100];
  1774. setup_capture_of_logs(LOG_WARN);
  1775. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1776. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1777. tls->state = TOR_TLS_ST_OPEN;
  1778. ret = tor_tls_write(tls, buf, 0);
  1779. tt_int_op(ret, OP_EQ, 0);
  1780. ret = tor_tls_write(tls, buf, 10);
  1781. tt_int_op(ret, OP_EQ, -9);
  1782. tls->ssl->method = method;
  1783. tls->wantwrite_n = 1;
  1784. ret = tor_tls_write(tls, buf, 10);
  1785. tt_int_op(tls->wantwrite_n, OP_EQ, 0);
  1786. method->ssl_write = fixed_ssl_write;
  1787. tls->ssl->handshake_func = dummy_handshake_func;
  1788. fixed_ssl_write_result = 1;
  1789. ERR_clear_error();
  1790. ret = tor_tls_write(tls, buf, 10);
  1791. tt_int_op(ret, OP_EQ, 1);
  1792. fixed_ssl_write_result = -1;
  1793. ERR_clear_error();
  1794. tls->ssl->rwstate = SSL_READING;
  1795. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  1796. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_READ;
  1797. ret = tor_tls_write(tls, buf, 10);
  1798. tt_int_op(ret, OP_EQ, TOR_TLS_WANTREAD);
  1799. ERR_clear_error();
  1800. tls->ssl->rwstate = SSL_READING;
  1801. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  1802. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_WRITE;
  1803. ret = tor_tls_write(tls, buf, 10);
  1804. tt_int_op(ret, OP_EQ, TOR_TLS_WANTWRITE);
  1805. done:
  1806. teardown_capture_of_logs();
  1807. BIO_free(tls->ssl->rbio);
  1808. tor_free(tls->ssl);
  1809. tor_free(tls);
  1810. tor_free(method);
  1811. }
  1812. #endif /* !defined(OPENSSL_OPAQUE) */
  1813. #ifndef OPENSSL_OPAQUE
  1814. static int fixed_ssl_accept_result;
  1815. static int fixed_ssl_connect_result;
  1816. static int
  1817. setting_error_ssl_accept(SSL *ssl)
  1818. {
  1819. (void)ssl;
  1820. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  1821. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  1822. return fixed_ssl_accept_result;
  1823. }
  1824. static int
  1825. setting_error_ssl_connect(SSL *ssl)
  1826. {
  1827. (void)ssl;
  1828. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  1829. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  1830. return fixed_ssl_connect_result;
  1831. }
  1832. static int
  1833. fixed_ssl_accept(SSL *ssl)
  1834. {
  1835. (void) ssl;
  1836. return fixed_ssl_accept_result;
  1837. }
  1838. static void
  1839. test_tortls_handshake(void *ignored)
  1840. {
  1841. (void)ignored;
  1842. int ret;
  1843. tor_tls_t *tls;
  1844. SSL_CTX *ctx;
  1845. SSL_METHOD *method = give_me_a_test_method();
  1846. setup_capture_of_logs(LOG_INFO);
  1847. SSL_library_init();
  1848. SSL_load_error_strings();
  1849. ctx = SSL_CTX_new(TLSv1_method());
  1850. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1851. tls->ssl = SSL_new(ctx);
  1852. tls->state = TOR_TLS_ST_HANDSHAKE;
  1853. ret = tor_tls_handshake(tls);
  1854. tt_int_op(ret, OP_EQ, -9);
  1855. tls->isServer = 1;
  1856. tls->state = TOR_TLS_ST_HANDSHAKE;
  1857. ret = tor_tls_handshake(tls);
  1858. tt_int_op(ret, OP_EQ, -9);
  1859. tls->ssl->method = method;
  1860. method->ssl_accept = fixed_ssl_accept;
  1861. fixed_ssl_accept_result = 2;
  1862. ERR_clear_error();
  1863. tls->state = TOR_TLS_ST_HANDSHAKE;
  1864. ret = tor_tls_handshake(tls);
  1865. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_OPEN);
  1866. method->ssl_accept = setting_error_ssl_accept;
  1867. fixed_ssl_accept_result = 1;
  1868. ERR_clear_error();
  1869. mock_clean_saved_logs();
  1870. tls->state = TOR_TLS_ST_HANDSHAKE;
  1871. ret = tor_tls_handshake(tls);
  1872. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1873. expect_log_entry();
  1874. /* This fails on jessie. Investigate why! */
  1875. #if 0
  1876. expect_log_msg("TLS error while handshaking: (null) (in bignum routines:"
  1877. "(null):SSLv3 write client hello B)\n");
  1878. expect_log_msg("TLS error while handshaking: (null) (in system library:"
  1879. "connect:SSLv3 write client hello B)\n");
  1880. #endif /* 0 */
  1881. expect_log_severity(LOG_INFO);
  1882. tls->isServer = 0;
  1883. method->ssl_connect = setting_error_ssl_connect;
  1884. fixed_ssl_connect_result = 1;
  1885. ERR_clear_error();
  1886. mock_clean_saved_logs();
  1887. tls->state = TOR_TLS_ST_HANDSHAKE;
  1888. ret = tor_tls_handshake(tls);
  1889. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1890. expect_log_entry();
  1891. #if 0
  1892. /* See above */
  1893. expect_log_msg("TLS error while handshaking: "
  1894. "(null) (in bignum routines:(null):SSLv3 write client hello B)\n");
  1895. expect_log_msg("TLS error while handshaking: "
  1896. "(null) (in system library:connect:SSLv3 write client hello B)\n");
  1897. #endif /* 0 */
  1898. expect_log_severity(LOG_WARN);
  1899. done:
  1900. teardown_capture_of_logs();
  1901. SSL_free(tls->ssl);
  1902. SSL_CTX_free(ctx);
  1903. tor_free(tls);
  1904. tor_free(method);
  1905. }
  1906. #endif /* !defined(OPENSSL_OPAQUE) */
  1907. #ifndef OPENSSL_OPAQUE
  1908. static void
  1909. test_tortls_finish_handshake(void *ignored)
  1910. {
  1911. (void)ignored;
  1912. int ret;
  1913. tor_tls_t *tls;
  1914. SSL_CTX *ctx;
  1915. SSL_METHOD *method = give_me_a_test_method();
  1916. SSL_library_init();
  1917. SSL_load_error_strings();
  1918. X509 *c1 = read_cert_from(validCertString);
  1919. SESS_CERT_local *sess = NULL;
  1920. ctx = SSL_CTX_new(method);
  1921. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1922. tls->ssl = SSL_new(ctx);
  1923. tls->state = TOR_TLS_ST_OPEN;
  1924. ret = tor_tls_finish_handshake(tls);
  1925. tt_int_op(ret, OP_EQ, 0);
  1926. tls->isServer = 1;
  1927. tls->wasV2Handshake = 0;
  1928. setup_full_capture_of_logs(LOG_WARN);
  1929. ret = tor_tls_finish_handshake(tls);
  1930. tt_int_op(ret, OP_EQ, 0);
  1931. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1932. expect_single_log_msg_containing("For some reason, wasV2Handshake didn't "
  1933. "get set.");
  1934. teardown_capture_of_logs();
  1935. tls->wasV2Handshake = 1;
  1936. ret = tor_tls_finish_handshake(tls);
  1937. tt_int_op(ret, OP_EQ, 0);
  1938. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1939. tls->wasV2Handshake = 1;
  1940. tls->ssl->session = SSL_SESSION_new();
  1941. ret = tor_tls_finish_handshake(tls);
  1942. tt_int_op(ret, OP_EQ, 0);
  1943. tt_int_op(tls->wasV2Handshake, OP_EQ, 0);
  1944. tls->isServer = 0;
  1945. sess = tor_malloc_zero(sizeof(SESS_CERT_local));
  1946. tls->ssl->session->sess_cert = (void *)sess;
  1947. sess->cert_chain = sk_X509_new_null();
  1948. sk_X509_push(sess->cert_chain, c1);
  1949. tls->ssl->session->peer = c1;
  1950. tls->wasV2Handshake = 0;
  1951. ret = tor_tls_finish_handshake(tls);
  1952. tt_int_op(ret, OP_EQ, 0);
  1953. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1954. method->num_ciphers = fake_num_ciphers;
  1955. ret = tor_tls_finish_handshake(tls);
  1956. tt_int_op(ret, OP_EQ, -9);
  1957. done:
  1958. if (sess)
  1959. sk_X509_free(sess->cert_chain);
  1960. if (tls->ssl && tls->ssl->session) {
  1961. tor_free(tls->ssl->session->sess_cert);
  1962. }
  1963. SSL_free(tls->ssl);
  1964. tor_free(tls);
  1965. SSL_CTX_free(ctx);
  1966. tor_free(method);
  1967. teardown_capture_of_logs();
  1968. }
  1969. #endif /* !defined(OPENSSL_OPAQUE) */
  1970. static int fixed_crypto_pk_new_result_index;
  1971. static crypto_pk_t *fixed_crypto_pk_new_result[5];
  1972. static crypto_pk_t *
  1973. fixed_crypto_pk_new(void)
  1974. {
  1975. return fixed_crypto_pk_new_result[fixed_crypto_pk_new_result_index++];
  1976. }
  1977. #ifndef OPENSSL_OPAQUE
  1978. static int fixed_crypto_pk_generate_key_with_bits_result_index;
  1979. static int fixed_crypto_pk_generate_key_with_bits_result[5];
  1980. static int fixed_tor_tls_create_certificate_result_index;
  1981. static X509 *fixed_tor_tls_create_certificate_result[5];
  1982. static int fixed_tor_x509_cert_new_result_index;
  1983. static tor_x509_cert_t *fixed_tor_x509_cert_new_result[5];
  1984. static int
  1985. fixed_crypto_pk_generate_key_with_bits(crypto_pk_t *env, int bits)
  1986. {
  1987. (void)env;
  1988. (void)bits;
  1989. return fixed_crypto_pk_generate_key_with_bits_result[
  1990. fixed_crypto_pk_generate_key_with_bits_result_index++];
  1991. }
  1992. static X509 *
  1993. fixed_tor_tls_create_certificate(crypto_pk_t *rsa,
  1994. crypto_pk_t *rsa_sign,
  1995. const char *cname,
  1996. const char *cname_sign,
  1997. unsigned int cert_lifetime)
  1998. {
  1999. (void)rsa;
  2000. (void)rsa_sign;
  2001. (void)cname;
  2002. (void)cname_sign;
  2003. (void)cert_lifetime;
  2004. return fixed_tor_tls_create_certificate_result[
  2005. fixed_tor_tls_create_certificate_result_index++];
  2006. }
  2007. static tor_x509_cert_t *
  2008. fixed_tor_x509_cert_new(X509 *x509_cert)
  2009. {
  2010. (void) x509_cert;
  2011. return fixed_tor_x509_cert_new_result[
  2012. fixed_tor_x509_cert_new_result_index++];
  2013. }
  2014. static void
  2015. test_tortls_context_new(void *ignored)
  2016. {
  2017. (void)ignored;
  2018. tor_tls_context_t *ret;
  2019. crypto_pk_t *pk1, *pk2, *pk3, *pk4, *pk5, *pk6, *pk7, *pk8, *pk9, *pk10,
  2020. *pk11, *pk12, *pk13, *pk14, *pk15, *pk16, *pk17, *pk18;
  2021. pk1 = crypto_pk_new();
  2022. pk2 = crypto_pk_new();
  2023. pk3 = crypto_pk_new();
  2024. pk4 = crypto_pk_new();
  2025. pk5 = crypto_pk_new();
  2026. pk6 = crypto_pk_new();
  2027. pk7 = crypto_pk_new();
  2028. pk8 = crypto_pk_new();
  2029. pk9 = crypto_pk_new();
  2030. pk10 = crypto_pk_new();
  2031. pk11 = crypto_pk_new();
  2032. pk12 = crypto_pk_new();
  2033. pk13 = crypto_pk_new();
  2034. pk14 = crypto_pk_new();
  2035. pk15 = crypto_pk_new();
  2036. pk16 = crypto_pk_new();
  2037. pk17 = crypto_pk_new();
  2038. pk18 = crypto_pk_new();
  2039. fixed_crypto_pk_new_result_index = 0;
  2040. fixed_crypto_pk_new_result[0] = NULL;
  2041. MOCK(crypto_pk_new, fixed_crypto_pk_new);
  2042. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2043. tt_assert(!ret);
  2044. /* note: we already override this in testing_common.c, so we
  2045. * run this unit test in a subprocess. */
  2046. MOCK(crypto_pk_generate_key_with_bits,
  2047. fixed_crypto_pk_generate_key_with_bits);
  2048. fixed_crypto_pk_new_result_index = 0;
  2049. fixed_crypto_pk_new_result[0] = pk1;
  2050. fixed_crypto_pk_new_result[1] = NULL;
  2051. fixed_crypto_pk_generate_key_with_bits_result[0] = -1;
  2052. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2053. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2054. tt_assert(!ret);
  2055. fixed_crypto_pk_new_result_index = 0;
  2056. fixed_crypto_pk_new_result[0] = pk2;
  2057. fixed_crypto_pk_new_result[1] = NULL;
  2058. fixed_crypto_pk_generate_key_with_bits_result[0] = 0;
  2059. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2060. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2061. tt_assert(!ret);
  2062. fixed_crypto_pk_new_result_index = 0;
  2063. fixed_crypto_pk_new_result[0] = pk3;
  2064. fixed_crypto_pk_new_result[1] = pk4;
  2065. fixed_crypto_pk_new_result[2] = NULL;
  2066. fixed_crypto_pk_generate_key_with_bits_result[0] = 0;
  2067. fixed_crypto_pk_generate_key_with_bits_result[1] = -1;
  2068. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2069. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2070. tt_assert(!ret);
  2071. MOCK(tor_tls_create_certificate, fixed_tor_tls_create_certificate);
  2072. fixed_crypto_pk_new_result_index = 0;
  2073. fixed_crypto_pk_new_result[0] = pk5;
  2074. fixed_crypto_pk_new_result[1] = pk6;
  2075. fixed_crypto_pk_new_result[2] = NULL;
  2076. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2077. fixed_crypto_pk_generate_key_with_bits_result[1] = 0;
  2078. fixed_tor_tls_create_certificate_result_index = 0;
  2079. fixed_tor_tls_create_certificate_result[0] = NULL;
  2080. fixed_tor_tls_create_certificate_result[1] = X509_new();
  2081. fixed_tor_tls_create_certificate_result[2] = X509_new();
  2082. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2083. tt_assert(!ret);
  2084. fixed_crypto_pk_new_result_index = 0;
  2085. fixed_crypto_pk_new_result[0] = pk7;
  2086. fixed_crypto_pk_new_result[1] = pk8;
  2087. fixed_crypto_pk_new_result[2] = NULL;
  2088. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2089. fixed_tor_tls_create_certificate_result_index = 0;
  2090. fixed_tor_tls_create_certificate_result[0] = X509_new();
  2091. fixed_tor_tls_create_certificate_result[1] = NULL;
  2092. fixed_tor_tls_create_certificate_result[2] = X509_new();
  2093. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2094. tt_assert(!ret);
  2095. fixed_crypto_pk_new_result_index = 0;
  2096. fixed_crypto_pk_new_result[0] = pk9;
  2097. fixed_crypto_pk_new_result[1] = pk10;
  2098. fixed_crypto_pk_new_result[2] = NULL;
  2099. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2100. fixed_tor_tls_create_certificate_result_index = 0;
  2101. fixed_tor_tls_create_certificate_result[0] = X509_new();
  2102. fixed_tor_tls_create_certificate_result[1] = X509_new();
  2103. fixed_tor_tls_create_certificate_result[2] = NULL;
  2104. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2105. tt_assert(!ret);
  2106. MOCK(tor_x509_cert_new, fixed_tor_x509_cert_new);
  2107. fixed_crypto_pk_new_result_index = 0;
  2108. fixed_crypto_pk_new_result[0] = pk11;
  2109. fixed_crypto_pk_new_result[1] = pk12;
  2110. fixed_crypto_pk_new_result[2] = NULL;
  2111. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2112. fixed_tor_tls_create_certificate_result_index = 0;
  2113. fixed_tor_tls_create_certificate_result[0] = X509_new();
  2114. fixed_tor_tls_create_certificate_result[1] = X509_new();
  2115. fixed_tor_tls_create_certificate_result[2] = X509_new();
  2116. fixed_tor_x509_cert_new_result_index = 0;
  2117. fixed_tor_x509_cert_new_result[0] = NULL;
  2118. fixed_tor_x509_cert_new_result[1] = NULL;
  2119. fixed_tor_x509_cert_new_result[2] = NULL;
  2120. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2121. tt_assert(!ret);
  2122. fixed_crypto_pk_new_result_index = 0;
  2123. fixed_crypto_pk_new_result[0] = pk13;
  2124. fixed_crypto_pk_new_result[1] = pk14;
  2125. fixed_crypto_pk_new_result[2] = NULL;
  2126. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2127. fixed_tor_tls_create_certificate_result_index = 0;
  2128. fixed_tor_tls_create_certificate_result[0] = X509_new();
  2129. fixed_tor_tls_create_certificate_result[1] = X509_new();
  2130. fixed_tor_tls_create_certificate_result[2] = X509_new();
  2131. fixed_tor_x509_cert_new_result_index = 0;
  2132. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2133. fixed_tor_x509_cert_new_result[1] = NULL;
  2134. fixed_tor_x509_cert_new_result[2] = NULL;
  2135. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2136. tt_assert(!ret);
  2137. fixed_crypto_pk_new_result_index = 0;
  2138. fixed_crypto_pk_new_result[0] = pk15;
  2139. fixed_crypto_pk_new_result[1] = pk16;
  2140. fixed_crypto_pk_new_result[2] = NULL;
  2141. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2142. fixed_tor_tls_create_certificate_result_index = 0;
  2143. fixed_tor_tls_create_certificate_result[0] = X509_new();
  2144. fixed_tor_tls_create_certificate_result[1] = X509_new();
  2145. fixed_tor_tls_create_certificate_result[2] = X509_new();
  2146. fixed_tor_x509_cert_new_result_index = 0;
  2147. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2148. fixed_tor_x509_cert_new_result[1] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2149. fixed_tor_x509_cert_new_result[2] = NULL;
  2150. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2151. tt_assert(!ret);
  2152. fixed_crypto_pk_new_result_index = 0;
  2153. fixed_crypto_pk_new_result[0] = pk17;
  2154. fixed_crypto_pk_new_result[1] = pk18;
  2155. fixed_crypto_pk_new_result[2] = NULL;
  2156. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  2157. fixed_tor_tls_create_certificate_result_index = 0;
  2158. fixed_tor_tls_create_certificate_result[0] = X509_new();
  2159. fixed_tor_tls_create_certificate_result[1] = X509_new();
  2160. fixed_tor_tls_create_certificate_result[2] = X509_new();
  2161. fixed_tor_x509_cert_new_result_index = 0;
  2162. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2163. fixed_tor_x509_cert_new_result[1] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2164. fixed_tor_x509_cert_new_result[2] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2165. ret = tor_tls_context_new(NULL, 0, 0, 0);
  2166. tt_assert(!ret);
  2167. done:
  2168. UNMOCK(tor_x509_cert_new);
  2169. UNMOCK(tor_tls_create_certificate);
  2170. UNMOCK(crypto_pk_generate_key_with_bits);
  2171. UNMOCK(crypto_pk_new);
  2172. }
  2173. #endif /* !defined(OPENSSL_OPAQUE) */
  2174. static int fixed_crypto_pk_get_evp_pkey_result_index = 0;
  2175. static EVP_PKEY *fixed_crypto_pk_get_evp_pkey_result[5];
  2176. static EVP_PKEY *
  2177. fixed_crypto_pk_get_evp_pkey_(crypto_pk_t *env, int private)
  2178. {
  2179. (void) env;
  2180. (void) private;
  2181. return fixed_crypto_pk_get_evp_pkey_result[
  2182. fixed_crypto_pk_get_evp_pkey_result_index++];
  2183. }
  2184. static void
  2185. test_tortls_create_certificate(void *ignored)
  2186. {
  2187. (void)ignored;
  2188. X509 *ret;
  2189. crypto_pk_t *pk1, *pk2;
  2190. pk1 = crypto_pk_new();
  2191. pk2 = crypto_pk_new();
  2192. MOCK(crypto_pk_get_evp_pkey_, fixed_crypto_pk_get_evp_pkey_);
  2193. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  2194. fixed_crypto_pk_get_evp_pkey_result[0] = NULL;
  2195. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  2196. tt_assert(!ret);
  2197. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  2198. fixed_crypto_pk_get_evp_pkey_result[0] = EVP_PKEY_new();
  2199. fixed_crypto_pk_get_evp_pkey_result[1] = NULL;
  2200. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  2201. tt_assert(!ret);
  2202. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  2203. fixed_crypto_pk_get_evp_pkey_result[0] = EVP_PKEY_new();
  2204. fixed_crypto_pk_get_evp_pkey_result[1] = EVP_PKEY_new();
  2205. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  2206. tt_assert(!ret);
  2207. done:
  2208. UNMOCK(crypto_pk_get_evp_pkey_);
  2209. crypto_pk_free(pk1);
  2210. crypto_pk_free(pk2);
  2211. }
  2212. static void
  2213. test_tortls_cert_new(void *ignored)
  2214. {
  2215. (void)ignored;
  2216. tor_x509_cert_t *ret;
  2217. X509 *cert = read_cert_from(validCertString);
  2218. ret = tor_x509_cert_new(NULL);
  2219. tt_assert(!ret);
  2220. ret = tor_x509_cert_new(cert);
  2221. tt_assert(ret);
  2222. tor_x509_cert_free(ret);
  2223. ret = NULL;
  2224. #if 0
  2225. cert = read_cert_from(validCertString);
  2226. /* XXX this doesn't do what you think: it alters a copy of the pubkey. */
  2227. X509_get_pubkey(cert)->type = EVP_PKEY_DSA;
  2228. ret = tor_x509_cert_new(cert);
  2229. tt_assert(ret);
  2230. #endif /* 0 */
  2231. #ifndef OPENSSL_OPAQUE
  2232. cert = read_cert_from(validCertString);
  2233. X509_CINF_free(cert->cert_info);
  2234. cert->cert_info = NULL;
  2235. ret = tor_x509_cert_new(cert);
  2236. tt_assert(ret);
  2237. #endif /* !defined(OPENSSL_OPAQUE) */
  2238. done:
  2239. tor_x509_cert_free(ret);
  2240. }
  2241. static void
  2242. test_tortls_cert_is_valid(void *ignored)
  2243. {
  2244. (void)ignored;
  2245. int ret;
  2246. tor_x509_cert_t *cert = NULL, *scert = NULL;
  2247. scert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2248. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  2249. tt_int_op(ret, OP_EQ, 0);
  2250. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  2251. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  2252. tt_int_op(ret, OP_EQ, 0);
  2253. tor_free(scert);
  2254. tor_free(cert);
  2255. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2256. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2257. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  2258. tt_int_op(ret, OP_EQ, 1);
  2259. #ifndef OPENSSL_OPAQUE
  2260. tor_x509_cert_free(cert);
  2261. tor_x509_cert_free(scert);
  2262. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2263. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2264. ASN1_TIME_free(cert->cert->cert_info->validity->notAfter);
  2265. cert->cert->cert_info->validity->notAfter =
  2266. ASN1_TIME_set(NULL, time(NULL)-1000000);
  2267. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  2268. tt_int_op(ret, OP_EQ, 0);
  2269. tor_x509_cert_free(cert);
  2270. tor_x509_cert_free(scert);
  2271. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2272. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2273. X509_PUBKEY_free(cert->cert->cert_info->key);
  2274. cert->cert->cert_info->key = NULL;
  2275. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 1);
  2276. tt_int_op(ret, OP_EQ, 0);
  2277. #endif /* !defined(OPENSSL_OPAQUE) */
  2278. #if 0
  2279. tor_x509_cert_free(cert);
  2280. tor_x509_cert_free(scert);
  2281. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2282. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2283. /* This doesn't actually change the key in the cert. XXXXXX */
  2284. BN_one(EVP_PKEY_get1_RSA(X509_get_pubkey(cert->cert))->n);
  2285. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 1);
  2286. tt_int_op(ret, OP_EQ, 0);
  2287. tor_x509_cert_free(cert);
  2288. tor_x509_cert_free(scert);
  2289. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2290. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2291. /* This doesn't actually change the key in the cert. XXXXXX */
  2292. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  2293. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 1);
  2294. tt_int_op(ret, OP_EQ, 0);
  2295. tor_x509_cert_free(cert);
  2296. tor_x509_cert_free(scert);
  2297. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2298. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2299. /* This doesn't actually change the key in the cert. XXXXXX */
  2300. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  2301. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  2302. tt_int_op(ret, OP_EQ, 1);
  2303. tor_x509_cert_free(cert);
  2304. tor_x509_cert_free(scert);
  2305. cert = tor_x509_cert_new(read_cert_from(validCertString));
  2306. scert = tor_x509_cert_new(read_cert_from(caCertString));
  2307. /* This doesn't actually change the key in the cert. XXXXXX */
  2308. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  2309. X509_get_pubkey(cert->cert)->ameth = NULL;
  2310. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  2311. tt_int_op(ret, OP_EQ, 0);
  2312. #endif /* 0 */
  2313. done:
  2314. tor_x509_cert_free(cert);
  2315. tor_x509_cert_free(scert);
  2316. }
  2317. static void
  2318. test_tortls_context_init_one(void *ignored)
  2319. {
  2320. (void)ignored;
  2321. int ret;
  2322. tor_tls_context_t *old = NULL;
  2323. MOCK(crypto_pk_new, fixed_crypto_pk_new);
  2324. fixed_crypto_pk_new_result_index = 0;
  2325. fixed_crypto_pk_new_result[0] = NULL;
  2326. ret = tor_tls_context_init_one(&old, NULL, 0, 0, 0);
  2327. tt_int_op(ret, OP_EQ, -1);
  2328. done:
  2329. UNMOCK(crypto_pk_new);
  2330. }
  2331. #define LOCAL_TEST_CASE(name, flags) \
  2332. { #name, test_tortls_##name, (flags|TT_FORK), NULL, NULL }
  2333. #ifdef OPENSSL_OPAQUE
  2334. #define INTRUSIVE_TEST_CASE(name, flags) \
  2335. { #name, NULL, TT_SKIP, NULL, NULL }
  2336. #else
  2337. #define INTRUSIVE_TEST_CASE(name, flags) LOCAL_TEST_CASE(name, flags)
  2338. #endif /* defined(OPENSSL_OPAQUE) */
  2339. struct testcase_t tortls_tests[] = {
  2340. LOCAL_TEST_CASE(errno_to_tls_error, 0),
  2341. LOCAL_TEST_CASE(err_to_string, 0),
  2342. LOCAL_TEST_CASE(tor_tls_new, TT_FORK),
  2343. LOCAL_TEST_CASE(tor_tls_get_error, 0),
  2344. LOCAL_TEST_CASE(get_state_description, TT_FORK),
  2345. LOCAL_TEST_CASE(get_by_ssl, TT_FORK),
  2346. LOCAL_TEST_CASE(allocate_tor_tls_object_ex_data_index, TT_FORK),
  2347. LOCAL_TEST_CASE(log_one_error, TT_FORK),
  2348. INTRUSIVE_TEST_CASE(get_error, TT_FORK),
  2349. LOCAL_TEST_CASE(always_accept_verify_cb, 0),
  2350. INTRUSIVE_TEST_CASE(x509_cert_free, 0),
  2351. LOCAL_TEST_CASE(x509_cert_get_id_digests, 0),
  2352. INTRUSIVE_TEST_CASE(cert_matches_key, 0),
  2353. INTRUSIVE_TEST_CASE(cert_get_key, 0),
  2354. LOCAL_TEST_CASE(get_my_client_auth_key, TT_FORK),
  2355. LOCAL_TEST_CASE(get_my_certs, TT_FORK),
  2356. INTRUSIVE_TEST_CASE(get_ciphersuite_name, 0),
  2357. INTRUSIVE_TEST_CASE(classify_client_ciphers, 0),
  2358. LOCAL_TEST_CASE(client_is_using_v2_ciphers, 0),
  2359. INTRUSIVE_TEST_CASE(verify, 0),
  2360. INTRUSIVE_TEST_CASE(check_lifetime, 0),
  2361. INTRUSIVE_TEST_CASE(get_pending_bytes, 0),
  2362. LOCAL_TEST_CASE(get_forced_write_size, 0),
  2363. LOCAL_TEST_CASE(get_write_overhead_ratio, TT_FORK),
  2364. LOCAL_TEST_CASE(used_v1_handshake, TT_FORK),
  2365. LOCAL_TEST_CASE(get_num_server_handshakes, 0),
  2366. LOCAL_TEST_CASE(server_got_renegotiate, 0),
  2367. INTRUSIVE_TEST_CASE(SSL_SESSION_get_master_key, 0),
  2368. INTRUSIVE_TEST_CASE(get_tlssecrets, 0),
  2369. INTRUSIVE_TEST_CASE(get_buffer_sizes, 0),
  2370. LOCAL_TEST_CASE(evaluate_ecgroup_for_tls, 0),
  2371. INTRUSIVE_TEST_CASE(try_to_extract_certs_from_tls, 0),
  2372. INTRUSIVE_TEST_CASE(get_peer_cert, 0),
  2373. INTRUSIVE_TEST_CASE(peer_has_cert, 0),
  2374. INTRUSIVE_TEST_CASE(shutdown, 0),
  2375. INTRUSIVE_TEST_CASE(finish_handshake, 0),
  2376. INTRUSIVE_TEST_CASE(handshake, 0),
  2377. INTRUSIVE_TEST_CASE(write, 0),
  2378. INTRUSIVE_TEST_CASE(read, 0),
  2379. INTRUSIVE_TEST_CASE(server_info_callback, 0),
  2380. LOCAL_TEST_CASE(is_server, 0),
  2381. INTRUSIVE_TEST_CASE(assert_renegotiation_unblocked, 0),
  2382. INTRUSIVE_TEST_CASE(block_renegotiation, 0),
  2383. INTRUSIVE_TEST_CASE(unblock_renegotiation, 0),
  2384. INTRUSIVE_TEST_CASE(set_renegotiate_callback, 0),
  2385. LOCAL_TEST_CASE(set_logged_address, 0),
  2386. INTRUSIVE_TEST_CASE(find_cipher_by_id, 0),
  2387. INTRUSIVE_TEST_CASE(session_secret_cb, 0),
  2388. INTRUSIVE_TEST_CASE(debug_state_callback, 0),
  2389. INTRUSIVE_TEST_CASE(context_new, TT_FORK /* redundant */),
  2390. LOCAL_TEST_CASE(create_certificate, 0),
  2391. LOCAL_TEST_CASE(cert_new, 0),
  2392. LOCAL_TEST_CASE(cert_is_valid, 0),
  2393. LOCAL_TEST_CASE(context_init_one, 0),
  2394. END_OF_TESTCASES
  2395. };