test_tortls_openssl.c 62 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316
  1. /* Copyright (c) 2010-2019, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #define TORTLS_PRIVATE
  4. #define TORTLS_OPENSSL_PRIVATE
  5. #define TOR_X509_PRIVATE
  6. #define LOG_PRIVATE
  7. #include "orconfig.h"
  8. #ifdef _WIN32
  9. #include <winsock2.h>
  10. #endif
  11. #include <math.h>
  12. #include "lib/cc/compat_compiler.h"
  13. /* Some versions of OpenSSL declare SSL_get_selected_srtp_profile twice in
  14. * srtp.h. Suppress the GCC warning so we can build with -Wredundant-decl. */
  15. DISABLE_GCC_WARNING(redundant-decls)
  16. #include <openssl/opensslv.h>
  17. #include <openssl/ssl.h>
  18. #include <openssl/ssl3.h>
  19. #include <openssl/err.h>
  20. #include <openssl/asn1t.h>
  21. #include <openssl/x509.h>
  22. #include <openssl/rsa.h>
  23. #include <openssl/evp.h>
  24. #include <openssl/bn.h>
  25. ENABLE_GCC_WARNING(redundant-decls)
  26. #include "core/or/or.h"
  27. #include "lib/log/log.h"
  28. #include "app/config/config.h"
  29. #include "lib/crypt_ops/compat_openssl.h"
  30. #include "lib/tls/x509.h"
  31. #include "lib/tls/x509_internal.h"
  32. #include "lib/tls/tortls.h"
  33. #include "lib/tls/tortls_st.h"
  34. #include "lib/tls/tortls_internal.h"
  35. #include "app/config/or_state_st.h"
  36. #include "test/test.h"
  37. #include "test/log_test_helpers.h"
  38. #include "test/test_tortls.h"
  39. #define NS_MODULE tortls
  40. #ifndef HAVE_SSL_STATE
  41. #define OPENSSL_OPAQUE
  42. #endif
  43. #if defined(OPENSSL_OPAQUE) && !defined(LIBRESSL_VERSION_NUMBER)
  44. #define SSL_STATE_STR "before SSL initialization"
  45. #else
  46. #define SSL_STATE_STR "before/accept initialization"
  47. #endif
  48. #ifndef OPENSSL_OPAQUE
  49. static SSL_METHOD *
  50. give_me_a_test_method(void)
  51. {
  52. SSL_METHOD *method = tor_malloc_zero(sizeof(SSL_METHOD));
  53. memcpy(method, TLSv1_method(), sizeof(SSL_METHOD));
  54. return method;
  55. }
  56. static int
  57. fake_num_ciphers(void)
  58. {
  59. return 0;
  60. }
  61. #endif /* !defined(OPENSSL_OPAQUE) */
  62. static int
  63. mock_tls_cert_matches_key(const tor_tls_t *tls, const tor_x509_cert_t *cert)
  64. {
  65. (void) tls;
  66. (void) cert; // XXXX look at this.
  67. return 1;
  68. }
  69. static void
  70. test_tortls_tor_tls_new(void *data)
  71. {
  72. (void) data;
  73. MOCK(tor_tls_cert_matches_key, mock_tls_cert_matches_key);
  74. crypto_pk_t *key1 = NULL, *key2 = NULL;
  75. SSL_METHOD *method = NULL;
  76. key1 = pk_generate(2);
  77. key2 = pk_generate(3);
  78. tor_tls_t *tls = NULL;
  79. tt_int_op(tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
  80. key1, key2, 86400), OP_EQ, 0);
  81. tls = tor_tls_new(-1, 0);
  82. tt_want(tls);
  83. tor_tls_free(tls); tls = NULL;
  84. SSL_CTX_free(client_tls_context->ctx);
  85. client_tls_context->ctx = NULL;
  86. tls = tor_tls_new(-1, 0);
  87. tt_ptr_op(tls, OP_EQ, NULL);
  88. #ifndef OPENSSL_OPAQUE
  89. method = give_me_a_test_method();
  90. SSL_CTX *ctx = SSL_CTX_new(method);
  91. method->num_ciphers = fake_num_ciphers;
  92. client_tls_context->ctx = ctx;
  93. tls = tor_tls_new(-1, 0);
  94. tt_ptr_op(tls, OP_EQ, NULL);
  95. #endif /* !defined(OPENSSL_OPAQUE) */
  96. done:
  97. UNMOCK(tor_tls_cert_matches_key);
  98. crypto_pk_free(key1);
  99. crypto_pk_free(key2);
  100. tor_tls_free(tls);
  101. tor_free(method);
  102. tor_tls_free_all();
  103. }
  104. #define NS_MODULE tortls
  105. static void
  106. library_init(void)
  107. {
  108. #ifdef OPENSSL_1_1_API
  109. OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
  110. #else
  111. SSL_library_init();
  112. SSL_load_error_strings();
  113. #endif /* defined(OPENSSL_1_1_API) */
  114. }
  115. static void
  116. test_tortls_get_state_description(void *ignored)
  117. {
  118. (void)ignored;
  119. tor_tls_t *tls;
  120. char *buf;
  121. SSL_CTX *ctx;
  122. library_init();
  123. ctx = SSL_CTX_new(SSLv23_method());
  124. buf = tor_malloc_zero(1000);
  125. tls = tor_malloc_zero(sizeof(tor_tls_t));
  126. tor_tls_get_state_description(NULL, buf, 20);
  127. tt_str_op(buf, OP_EQ, "(No SSL object)");
  128. SSL_free(tls->ssl);
  129. tls->ssl = NULL;
  130. tor_tls_get_state_description(tls, buf, 20);
  131. tt_str_op(buf, OP_EQ, "(No SSL object)");
  132. tls->ssl = SSL_new(ctx);
  133. tor_tls_get_state_description(tls, buf, 200);
  134. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in HANDSHAKE");
  135. tls->state = TOR_TLS_ST_OPEN;
  136. tor_tls_get_state_description(tls, buf, 200);
  137. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in OPEN");
  138. tls->state = TOR_TLS_ST_GOTCLOSE;
  139. tor_tls_get_state_description(tls, buf, 200);
  140. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in GOTCLOSE");
  141. tls->state = TOR_TLS_ST_SENTCLOSE;
  142. tor_tls_get_state_description(tls, buf, 200);
  143. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in SENTCLOSE");
  144. tls->state = TOR_TLS_ST_CLOSED;
  145. tor_tls_get_state_description(tls, buf, 200);
  146. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in CLOSED");
  147. tls->state = TOR_TLS_ST_RENEGOTIATE;
  148. tor_tls_get_state_description(tls, buf, 200);
  149. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in RENEGOTIATE");
  150. tls->state = TOR_TLS_ST_BUFFEREVENT;
  151. tor_tls_get_state_description(tls, buf, 200);
  152. tt_str_op(buf, OP_EQ, SSL_STATE_STR);
  153. tls->state = 7;
  154. tor_tls_get_state_description(tls, buf, 200);
  155. tt_str_op(buf, OP_EQ, SSL_STATE_STR " in unknown TLS state");
  156. done:
  157. SSL_CTX_free(ctx);
  158. SSL_free(tls->ssl);
  159. tor_free(buf);
  160. tor_free(tls);
  161. }
  162. static void
  163. test_tortls_get_by_ssl(void *ignored)
  164. {
  165. (void)ignored;
  166. tor_tls_t *tls;
  167. tor_tls_t *res;
  168. SSL_CTX *ctx;
  169. SSL *ssl;
  170. library_init();
  171. tor_tls_allocate_tor_tls_object_ex_data_index();
  172. ctx = SSL_CTX_new(SSLv23_method());
  173. tls = tor_malloc_zero(sizeof(tor_tls_t));
  174. tls->magic = TOR_TLS_MAGIC;
  175. ssl = SSL_new(ctx);
  176. res = tor_tls_get_by_ssl(ssl);
  177. tt_assert(!res);
  178. SSL_set_ex_data(ssl, tor_tls_object_ex_data_index, tls);
  179. res = tor_tls_get_by_ssl(ssl);
  180. tt_assert(res == tls);
  181. done:
  182. SSL_free(ssl);
  183. SSL_CTX_free(ctx);
  184. tor_free(tls);
  185. }
  186. static void
  187. test_tortls_allocate_tor_tls_object_ex_data_index(void *ignored)
  188. {
  189. (void)ignored;
  190. int first;
  191. tor_tls_allocate_tor_tls_object_ex_data_index();
  192. first = tor_tls_object_ex_data_index;
  193. tor_tls_allocate_tor_tls_object_ex_data_index();
  194. tt_int_op(first, OP_EQ, tor_tls_object_ex_data_index);
  195. done:
  196. (void)0;
  197. }
  198. static void
  199. test_tortls_log_one_error(void *ignored)
  200. {
  201. (void)ignored;
  202. tor_tls_t *tls;
  203. SSL_CTX *ctx;
  204. SSL *ssl = NULL;
  205. library_init();
  206. ctx = SSL_CTX_new(SSLv23_method());
  207. tls = tor_malloc_zero(sizeof(tor_tls_t));
  208. setup_capture_of_logs(LOG_INFO);
  209. tor_tls_log_one_error(NULL, 0, LOG_WARN, 0, "something");
  210. expect_log_msg("TLS error while something: "
  211. "(null) (in (null):(null):---)\n");
  212. mock_clean_saved_logs();
  213. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  214. expect_log_msg("TLS error: (null) "
  215. "(in (null):(null):---)\n");
  216. mock_clean_saved_logs();
  217. tls->address = tor_strdup("127.hello");
  218. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  219. expect_log_msg("TLS error with 127.hello: "
  220. "(null) (in (null):(null):---)\n");
  221. tor_free(tls->address);
  222. mock_clean_saved_logs();
  223. tls->address = tor_strdup("127.hello");
  224. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, "blarg");
  225. expect_log_msg("TLS error while blarg with "
  226. "127.hello: (null) (in (null):(null):---)\n");
  227. mock_clean_saved_logs();
  228. tor_tls_log_one_error(tls, ERR_PACK(1, 2, 3), LOG_WARN, 0, NULL);
  229. expect_log_msg("TLS error with 127.hello: "
  230. "BN lib (in unknown library:(null):---)\n");
  231. mock_clean_saved_logs();
  232. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_HTTP_REQUEST),
  233. LOG_WARN, 0, NULL);
  234. expect_log_severity(LOG_INFO);
  235. mock_clean_saved_logs();
  236. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_HTTPS_PROXY_REQUEST),
  237. LOG_WARN, 0, NULL);
  238. expect_log_severity(LOG_INFO);
  239. mock_clean_saved_logs();
  240. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_RECORD_LENGTH_MISMATCH),
  241. LOG_WARN, 0, NULL);
  242. expect_log_severity(LOG_INFO);
  243. #ifndef OPENSSL_1_1_API
  244. mock_clean_saved_logs();
  245. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_RECORD_TOO_LARGE),
  246. LOG_WARN, 0, NULL);
  247. expect_log_severity(LOG_INFO);
  248. #endif /* !defined(OPENSSL_1_1_API) */
  249. mock_clean_saved_logs();
  250. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_UNKNOWN_PROTOCOL),
  251. LOG_WARN, 0, NULL);
  252. expect_log_severity(LOG_INFO);
  253. mock_clean_saved_logs();
  254. tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_UNSUPPORTED_PROTOCOL),
  255. LOG_WARN, 0, NULL);
  256. expect_log_severity(LOG_INFO);
  257. tls->ssl = SSL_new(ctx);
  258. mock_clean_saved_logs();
  259. tor_tls_log_one_error(tls, 0, LOG_WARN, 0, NULL);
  260. expect_log_msg("TLS error with 127.hello: (null)"
  261. " (in (null):(null):" SSL_STATE_STR ")\n");
  262. done:
  263. teardown_capture_of_logs();
  264. SSL_free(ssl);
  265. SSL_CTX_free(ctx);
  266. if (tls && tls->ssl)
  267. SSL_free(tls->ssl);
  268. if (tls)
  269. tor_free(tls->address);
  270. tor_free(tls);
  271. }
  272. #ifndef OPENSSL_OPAQUE
  273. static void
  274. test_tortls_get_error(void *ignored)
  275. {
  276. (void)ignored;
  277. tor_tls_t *tls;
  278. int ret;
  279. SSL_CTX *ctx;
  280. library_init();
  281. ctx = SSL_CTX_new(SSLv23_method());
  282. setup_capture_of_logs(LOG_INFO);
  283. tls = tor_malloc_zero(sizeof(tor_tls_t));
  284. tls->ssl = SSL_new(ctx);
  285. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  286. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  287. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_IO);
  288. expect_log_msg("TLS error: unexpected close while"
  289. " something (before/accept initialization)\n");
  290. mock_clean_saved_logs();
  291. ret = tor_tls_get_error(tls, 2, 0, "something", LOG_WARN, 0);
  292. tt_int_op(ret, OP_EQ, 0);
  293. expect_no_log_entry();
  294. mock_clean_saved_logs();
  295. ret = tor_tls_get_error(tls, 0, 1, "something", LOG_WARN, 0);
  296. tt_int_op(ret, OP_EQ, -11);
  297. expect_no_log_entry();
  298. mock_clean_saved_logs();
  299. ERR_clear_error();
  300. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  301. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  302. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  303. expect_log_msg("TLS error while something: (null)"
  304. " (in bignum routines:(null):before/accept initialization)\n");
  305. mock_clean_saved_logs();
  306. ERR_clear_error();
  307. tls->ssl->rwstate = SSL_READING;
  308. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_READ;
  309. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  310. tt_int_op(ret, OP_EQ, TOR_TLS_WANTREAD);
  311. expect_no_log_entry();
  312. mock_clean_saved_logs();
  313. ERR_clear_error();
  314. tls->ssl->rwstate = SSL_READING;
  315. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_WRITE;
  316. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  317. tt_int_op(ret, OP_EQ, TOR_TLS_WANTWRITE);
  318. expect_no_log_entry();
  319. mock_clean_saved_logs();
  320. ERR_clear_error();
  321. tls->ssl->rwstate = 0;
  322. tls->ssl->shutdown = SSL_RECEIVED_SHUTDOWN;
  323. tls->ssl->s3->warn_alert =SSL_AD_CLOSE_NOTIFY;
  324. ret = tor_tls_get_error(tls, 0, 0, "something", LOG_WARN, 0);
  325. tt_int_op(ret, OP_EQ, TOR_TLS_CLOSE);
  326. expect_log_entry();
  327. mock_clean_saved_logs();
  328. ret = tor_tls_get_error(tls, 0, 2, "something", LOG_WARN, 0);
  329. tt_int_op(ret, OP_EQ, -10);
  330. expect_no_log_entry();
  331. mock_clean_saved_logs();
  332. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  333. ret = tor_tls_get_error(tls, -1, 0, "something", LOG_WARN, 0);
  334. tt_int_op(ret, OP_EQ, -9);
  335. expect_log_msg("TLS error while something: (null) (in system library:"
  336. "connect:before/accept initialization)\n");
  337. done:
  338. teardown_capture_of_logs();
  339. SSL_free(tls->ssl);
  340. tor_free(tls);
  341. SSL_CTX_free(ctx);
  342. }
  343. #endif /* !defined(OPENSSL_OPAQUE) */
  344. static void
  345. test_tortls_always_accept_verify_cb(void *ignored)
  346. {
  347. (void)ignored;
  348. int ret;
  349. ret = always_accept_verify_cb(0, NULL);
  350. tt_int_op(ret, OP_EQ, 1);
  351. done:
  352. (void)0;
  353. }
  354. #ifndef OPENSSL_OPAQUE
  355. static void
  356. test_tortls_x509_cert_free(void *ignored)
  357. {
  358. (void)ignored;
  359. tor_x509_cert_t *cert;
  360. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  361. tor_x509_cert_free(cert);
  362. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  363. cert->cert = X509_new();
  364. cert->encoded = tor_malloc_zero(1);
  365. tor_x509_cert_free(cert);
  366. }
  367. #endif /* !defined(OPENSSL_OPAQUE) */
  368. #ifndef OPENSSL_OPAQUE
  369. /*
  370. * Use only for the matching fake_x509_free() call
  371. */
  372. static X509 *
  373. fake_x509_malloc(void)
  374. {
  375. return tor_malloc_zero(sizeof(X509));
  376. }
  377. static void
  378. fake_x509_free(X509 *cert)
  379. {
  380. if (cert) {
  381. if (cert->cert_info) {
  382. if (cert->cert_info->key) {
  383. if (cert->cert_info->key->pkey) {
  384. tor_free(cert->cert_info->key->pkey);
  385. }
  386. tor_free(cert->cert_info->key);
  387. }
  388. tor_free(cert->cert_info);
  389. }
  390. tor_free(cert);
  391. }
  392. }
  393. #endif /* !defined(OPENSSL_OPAQUE) */
  394. static tor_x509_cert_t *fixed_x509_cert = NULL;
  395. static tor_x509_cert_t *
  396. get_peer_cert_mock_return_fixed(tor_tls_t *tls)
  397. {
  398. (void)tls;
  399. if (fixed_x509_cert)
  400. return tor_x509_cert_dup(fixed_x509_cert);
  401. else
  402. return NULL;
  403. }
  404. static void
  405. test_tortls_cert_matches_key(void *ignored)
  406. {
  407. (void)ignored;
  408. X509 *cert1 = NULL, *cert2 = NULL, *cert3 = NULL, *cert4 = NULL;
  409. tor_x509_cert_t *c1 = NULL, *c2 = NULL, *c3 = NULL, *c4 = NULL;
  410. crypto_pk_t *k1 = NULL, *k2 = NULL, *k3 = NULL;
  411. k1 = pk_generate(1);
  412. k2 = pk_generate(2);
  413. k3 = pk_generate(3);
  414. cert1 = tor_tls_create_certificate(k1, k2, "A", "B", 1000);
  415. cert2 = tor_tls_create_certificate(k1, k3, "C", "D", 1000);
  416. cert3 = tor_tls_create_certificate(k2, k3, "C", "D", 1000);
  417. cert4 = tor_tls_create_certificate(k3, k2, "E", "F", 1000);
  418. tt_assert(cert1 && cert2 && cert3 && cert4);
  419. c1 = tor_x509_cert_new(cert1); cert1 = NULL;
  420. c2 = tor_x509_cert_new(cert2); cert2 = NULL;
  421. c3 = tor_x509_cert_new(cert3); cert3 = NULL;
  422. c4 = tor_x509_cert_new(cert4); cert4 = NULL;
  423. tt_assert(c1 && c2 && c3 && c4);
  424. MOCK(tor_tls_get_peer_cert, get_peer_cert_mock_return_fixed);
  425. fixed_x509_cert = NULL;
  426. /* If the peer has no certificate, it shouldn't match anything. */
  427. tt_assert(! tor_tls_cert_matches_key(NULL, c1));
  428. tt_assert(! tor_tls_cert_matches_key(NULL, c2));
  429. tt_assert(! tor_tls_cert_matches_key(NULL, c3));
  430. tt_assert(! tor_tls_cert_matches_key(NULL, c4));
  431. fixed_x509_cert = c1;
  432. /* If the peer has a certificate, it should match every cert with the same
  433. * subject key. */
  434. tt_assert(tor_tls_cert_matches_key(NULL, c1));
  435. tt_assert(tor_tls_cert_matches_key(NULL, c2));
  436. tt_assert(! tor_tls_cert_matches_key(NULL, c3));
  437. tt_assert(! tor_tls_cert_matches_key(NULL, c4));
  438. done:
  439. tor_x509_cert_free(c1);
  440. tor_x509_cert_free(c2);
  441. tor_x509_cert_free(c3);
  442. tor_x509_cert_free(c4);
  443. if (cert1) X509_free(cert1);
  444. if (cert2) X509_free(cert2);
  445. if (cert3) X509_free(cert3);
  446. if (cert4) X509_free(cert4);
  447. crypto_pk_free(k1);
  448. crypto_pk_free(k2);
  449. crypto_pk_free(k3);
  450. UNMOCK(tor_tls_get_peer_cert);
  451. }
  452. #ifndef OPENSSL_OPAQUE
  453. static void
  454. test_tortls_cert_get_key(void *ignored)
  455. {
  456. (void)ignored;
  457. tor_x509_cert_t *cert = NULL;
  458. crypto_pk_t *res = NULL;
  459. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  460. X509 *key = NULL;
  461. key = fake_x509_malloc();
  462. key->references = 1;
  463. res = tor_tls_cert_get_key(cert);
  464. tt_assert(!res);
  465. cert->cert = key;
  466. key->cert_info = tor_malloc_zero(sizeof(X509_CINF));
  467. key->cert_info->key = tor_malloc_zero(sizeof(X509_PUBKEY));
  468. key->cert_info->key->pkey = tor_malloc_zero(sizeof(EVP_PKEY));
  469. key->cert_info->key->pkey->references = 1;
  470. key->cert_info->key->pkey->type = 2;
  471. res = tor_tls_cert_get_key(cert);
  472. tt_assert(!res);
  473. done:
  474. fake_x509_free(key);
  475. tor_free(cert);
  476. crypto_pk_free(res);
  477. }
  478. #endif /* !defined(OPENSSL_OPAQUE) */
  479. static void
  480. test_tortls_get_my_client_auth_key(void *ignored)
  481. {
  482. (void)ignored;
  483. crypto_pk_t *ret;
  484. crypto_pk_t *expected;
  485. tor_tls_context_t *ctx;
  486. RSA *k = RSA_new();
  487. ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
  488. expected = crypto_new_pk_from_openssl_rsa_(k);
  489. ctx->auth_key = expected;
  490. client_tls_context = NULL;
  491. ret = tor_tls_get_my_client_auth_key();
  492. tt_assert(!ret);
  493. client_tls_context = ctx;
  494. ret = tor_tls_get_my_client_auth_key();
  495. tt_assert(ret == expected);
  496. done:
  497. crypto_pk_free(expected);
  498. tor_free(ctx);
  499. }
  500. #ifndef HAVE_SSL_GET_CLIENT_CIPHERS
  501. static SSL_CIPHER *
  502. get_cipher_by_name(const char *name)
  503. {
  504. int i;
  505. const SSL_METHOD *method = SSLv23_method();
  506. int num = method->num_ciphers();
  507. for (i = 0; i < num; ++i) {
  508. const SSL_CIPHER *cipher = method->get_cipher(i);
  509. const char *ciphername = SSL_CIPHER_get_name(cipher);
  510. if (!strcmp(ciphername, name)) {
  511. return (SSL_CIPHER *)cipher;
  512. }
  513. }
  514. return NULL;
  515. }
  516. #endif /* !defined(HAVE_SSL_GET_CLIENT_CIPHERS) */
  517. #ifndef OPENSSL_OPAQUE
  518. static void
  519. test_tortls_get_ciphersuite_name(void *ignored)
  520. {
  521. (void)ignored;
  522. const char *ret;
  523. tor_tls_t *ctx;
  524. ctx = tor_malloc_zero(sizeof(tor_tls_t));
  525. ctx->ssl = tor_malloc_zero(sizeof(SSL));
  526. ret = tor_tls_get_ciphersuite_name(ctx);
  527. tt_str_op(ret, OP_EQ, "(NONE)");
  528. done:
  529. tor_free(ctx->ssl);
  530. tor_free(ctx);
  531. }
  532. static SSL_CIPHER *
  533. get_cipher_by_id(uint16_t id)
  534. {
  535. int i;
  536. const SSL_METHOD *method = SSLv23_method();
  537. int num = method->num_ciphers();
  538. for (i = 0; i < num; ++i) {
  539. const SSL_CIPHER *cipher = method->get_cipher(i);
  540. if (id == (SSL_CIPHER_get_id(cipher) & 0xffff)) {
  541. return (SSL_CIPHER *)cipher;
  542. }
  543. }
  544. return NULL;
  545. }
  546. static void
  547. test_tortls_classify_client_ciphers(void *ignored)
  548. {
  549. (void)ignored;
  550. int i;
  551. int ret;
  552. SSL_CTX *ctx;
  553. SSL *ssl;
  554. tor_tls_t *tls;
  555. STACK_OF(SSL_CIPHER) *ciphers;
  556. SSL_CIPHER *tmp_cipher;
  557. library_init();
  558. tor_tls_allocate_tor_tls_object_ex_data_index();
  559. tls = tor_malloc_zero(sizeof(tor_tls_t));
  560. tls->magic = TOR_TLS_MAGIC;
  561. ctx = SSL_CTX_new(TLSv1_method());
  562. ssl = SSL_new(ctx);
  563. tls->ssl = ssl;
  564. ciphers = sk_SSL_CIPHER_new_null();
  565. ret = tor_tls_classify_client_ciphers(ssl, NULL);
  566. tt_int_op(ret, OP_EQ, -1);
  567. SSL_set_ex_data(ssl, tor_tls_object_ex_data_index, tls);
  568. tls->client_cipher_list_type = 42;
  569. ret = tor_tls_classify_client_ciphers(ssl, NULL);
  570. tt_int_op(ret, OP_EQ, 42);
  571. tls->client_cipher_list_type = 0;
  572. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  573. tt_int_op(ret, OP_EQ, 1);
  574. tt_int_op(tls->client_cipher_list_type, OP_EQ, 1);
  575. tls->client_cipher_list_type = 0;
  576. ret = tor_tls_classify_client_ciphers(ssl, SSL_get_ciphers(ssl));
  577. tt_int_op(ret, OP_EQ, 3);
  578. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  579. SSL_CIPHER *one = get_cipher_by_name(TLS1_TXT_DHE_RSA_WITH_AES_128_SHA),
  580. *two = get_cipher_by_name(TLS1_TXT_DHE_RSA_WITH_AES_256_SHA),
  581. *three = get_cipher_by_name(SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA),
  582. *four = NULL;
  583. sk_SSL_CIPHER_push(ciphers, one);
  584. sk_SSL_CIPHER_push(ciphers, two);
  585. sk_SSL_CIPHER_push(ciphers, three);
  586. sk_SSL_CIPHER_push(ciphers, four);
  587. tls->client_cipher_list_type = 0;
  588. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  589. tt_int_op(ret, OP_EQ, 1);
  590. tt_int_op(tls->client_cipher_list_type, OP_EQ, 1);
  591. sk_SSL_CIPHER_zero(ciphers);
  592. one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384");
  593. tt_assert(one);
  594. one->id = 0x00ff;
  595. two = get_cipher_by_name("ECDHE-RSA-AES128-GCM-SHA256");
  596. tt_assert(two);
  597. two->id = 0x0000;
  598. sk_SSL_CIPHER_push(ciphers, one);
  599. tls->client_cipher_list_type = 0;
  600. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  601. tt_int_op(ret, OP_EQ, 3);
  602. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  603. sk_SSL_CIPHER_push(ciphers, two);
  604. tls->client_cipher_list_type = 0;
  605. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  606. tt_int_op(ret, OP_EQ, 3);
  607. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  608. one->id = 0xC00A;
  609. tls->client_cipher_list_type = 0;
  610. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  611. tt_int_op(ret, OP_EQ, 3);
  612. tt_int_op(tls->client_cipher_list_type, OP_EQ, 3);
  613. sk_SSL_CIPHER_zero(ciphers);
  614. for (i=0; v2_cipher_list[i]; i++) {
  615. tmp_cipher = get_cipher_by_id(v2_cipher_list[i]);
  616. tt_assert(tmp_cipher);
  617. sk_SSL_CIPHER_push(ciphers, tmp_cipher);
  618. }
  619. tls->client_cipher_list_type = 0;
  620. ret = tor_tls_classify_client_ciphers(ssl, ciphers);
  621. tt_int_op(ret, OP_EQ, 2);
  622. tt_int_op(tls->client_cipher_list_type, OP_EQ, 2);
  623. done:
  624. sk_SSL_CIPHER_free(ciphers);
  625. SSL_free(tls->ssl);
  626. tor_free(tls);
  627. SSL_CTX_free(ctx);
  628. }
  629. #endif /* !defined(OPENSSL_OPAQUE) */
  630. static void
  631. test_tortls_client_is_using_v2_ciphers(void *ignored)
  632. {
  633. (void)ignored;
  634. #ifdef HAVE_SSL_GET_CLIENT_CIPHERS
  635. tt_skip();
  636. done:
  637. (void)1;
  638. #else
  639. int ret;
  640. SSL_CTX *ctx;
  641. SSL *ssl;
  642. SSL_SESSION *sess;
  643. STACK_OF(SSL_CIPHER) *ciphers;
  644. library_init();
  645. ctx = SSL_CTX_new(TLSv1_method());
  646. ssl = SSL_new(ctx);
  647. sess = SSL_SESSION_new();
  648. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  649. tt_int_op(ret, OP_EQ, -1);
  650. ssl->session = sess;
  651. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  652. tt_int_op(ret, OP_EQ, 0);
  653. ciphers = sk_SSL_CIPHER_new_null();
  654. SSL_CIPHER *one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384");
  655. tt_assert(one);
  656. one->id = 0x00ff;
  657. sk_SSL_CIPHER_push(ciphers, one);
  658. sess->ciphers = ciphers;
  659. ret = tor_tls_client_is_using_v2_ciphers(ssl);
  660. tt_int_op(ret, OP_EQ, 1);
  661. done:
  662. SSL_free(ssl);
  663. SSL_CTX_free(ctx);
  664. #endif /* defined(HAVE_SSL_GET_CLIENT_CIPHERS) */
  665. }
  666. #ifndef OPENSSL_OPAQUE
  667. static int fixed_ssl_pending_result = 0;
  668. static int
  669. fixed_ssl_pending(const SSL *ignored)
  670. {
  671. (void)ignored;
  672. return fixed_ssl_pending_result;
  673. }
  674. static void
  675. test_tortls_get_pending_bytes(void *ignored)
  676. {
  677. (void)ignored;
  678. int ret;
  679. tor_tls_t *tls;
  680. SSL_METHOD *method;
  681. tls = tor_malloc_zero(sizeof(tor_tls_t));
  682. tls->ssl = tor_malloc_zero(sizeof(SSL));
  683. method = tor_malloc_zero(sizeof(SSL_METHOD));
  684. method->ssl_pending = fixed_ssl_pending;
  685. tls->ssl->method = method;
  686. fixed_ssl_pending_result = 42;
  687. ret = tor_tls_get_pending_bytes(tls);
  688. tt_int_op(ret, OP_EQ, 42);
  689. done:
  690. tor_free(method);
  691. tor_free(tls->ssl);
  692. tor_free(tls);
  693. }
  694. #endif /* !defined(OPENSSL_OPAQUE) */
  695. #ifndef OPENSSL_OPAQUE
  696. static void
  697. test_tortls_SSL_SESSION_get_master_key(void *ignored)
  698. {
  699. (void)ignored;
  700. size_t ret;
  701. tor_tls_t *tls;
  702. uint8_t *out;
  703. out = tor_malloc_zero(1);
  704. tls = tor_malloc_zero(sizeof(tor_tls_t));
  705. tls->ssl = tor_malloc_zero(sizeof(SSL));
  706. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  707. tls->ssl->session->master_key_length = 1;
  708. #ifndef HAVE_SSL_SESSION_GET_MASTER_KEY
  709. tls->ssl->session->master_key[0] = 43;
  710. ret = SSL_SESSION_get_master_key(tls->ssl->session, out, 0);
  711. tt_int_op(ret, OP_EQ, 1);
  712. tt_int_op(out[0], OP_EQ, 0);
  713. ret = SSL_SESSION_get_master_key(tls->ssl->session, out, 1);
  714. tt_int_op(ret, OP_EQ, 1);
  715. tt_int_op(out[0], OP_EQ, 43);
  716. done:
  717. #endif /* !defined(HAVE_SSL_SESSION_GET_MASTER_KEY) */
  718. tor_free(tls->ssl->session);
  719. tor_free(tls->ssl);
  720. tor_free(tls);
  721. tor_free(out);
  722. }
  723. #endif /* !defined(OPENSSL_OPAQUE) */
  724. #ifndef OPENSSL_OPAQUE
  725. static void
  726. test_tortls_get_tlssecrets(void *ignored)
  727. {
  728. (void)ignored;
  729. int ret;
  730. uint8_t *secret_out = tor_malloc_zero(DIGEST256_LEN);
  731. tor_tls_t *tls;
  732. tls = tor_malloc_zero(sizeof(tor_tls_t));
  733. tls->ssl = tor_malloc_zero(sizeof(SSL));
  734. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  735. tls->ssl->session->master_key_length = 1;
  736. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  737. ret = tor_tls_get_tlssecrets(tls, secret_out);
  738. tt_int_op(ret, OP_EQ, 0);
  739. done:
  740. tor_free(secret_out);
  741. tor_free(tls->ssl->s3);
  742. tor_free(tls->ssl->session);
  743. tor_free(tls->ssl);
  744. tor_free(tls);
  745. }
  746. #endif /* !defined(OPENSSL_OPAQUE) */
  747. #ifndef OPENSSL_OPAQUE
  748. static void
  749. test_tortls_get_buffer_sizes(void *ignored)
  750. {
  751. (void)ignored;
  752. int ret;
  753. tor_tls_t *tls;
  754. size_t rbuf_c=-1, rbuf_b=-1, wbuf_c=-1, wbuf_b=-1;
  755. tls = tor_malloc_zero(sizeof(tor_tls_t));
  756. tls->ssl = tor_malloc_zero(sizeof(SSL));
  757. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  758. tls->ssl->s3->rbuf.buf = NULL;
  759. tls->ssl->s3->rbuf.len = 1;
  760. tls->ssl->s3->rbuf.offset = 0;
  761. tls->ssl->s3->rbuf.left = 42;
  762. tls->ssl->s3->wbuf.buf = NULL;
  763. tls->ssl->s3->wbuf.len = 2;
  764. tls->ssl->s3->wbuf.offset = 0;
  765. tls->ssl->s3->wbuf.left = 43;
  766. ret = tor_tls_get_buffer_sizes(tls, &rbuf_c, &rbuf_b, &wbuf_c, &wbuf_b);
  767. #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0)
  768. tt_int_op(ret, OP_EQ, -1);
  769. #else
  770. tt_int_op(ret, OP_EQ, 0);
  771. tt_int_op(rbuf_c, OP_EQ, 0);
  772. tt_int_op(wbuf_c, OP_EQ, 0);
  773. tt_int_op(rbuf_b, OP_EQ, 42);
  774. tt_int_op(wbuf_b, OP_EQ, 43);
  775. tls->ssl->s3->rbuf.buf = tor_malloc_zero(1);
  776. tls->ssl->s3->wbuf.buf = tor_malloc_zero(1);
  777. ret = tor_tls_get_buffer_sizes(tls, &rbuf_c, &rbuf_b, &wbuf_c, &wbuf_b);
  778. tt_int_op(ret, OP_EQ, 0);
  779. tt_int_op(rbuf_c, OP_EQ, 1);
  780. tt_int_op(wbuf_c, OP_EQ, 2);
  781. #endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) */
  782. done:
  783. tor_free(tls->ssl->s3->rbuf.buf);
  784. tor_free(tls->ssl->s3->wbuf.buf);
  785. tor_free(tls->ssl->s3);
  786. tor_free(tls->ssl);
  787. tor_free(tls);
  788. }
  789. #endif /* !defined(OPENSSL_OPAQUE) */
  790. #ifndef OPENSSL_OPAQUE
  791. typedef struct cert_pkey_st_local
  792. {
  793. X509 *x509;
  794. EVP_PKEY *privatekey;
  795. const EVP_MD *digest;
  796. } CERT_PKEY_local;
  797. typedef struct sess_cert_st_local
  798. {
  799. STACK_OF(X509) *cert_chain;
  800. int peer_cert_type;
  801. CERT_PKEY_local *peer_key;
  802. CERT_PKEY_local peer_pkeys[8];
  803. int references;
  804. } SESS_CERT_local;
  805. static void
  806. test_tortls_try_to_extract_certs_from_tls(void *ignored)
  807. {
  808. (void)ignored;
  809. tor_tls_t *tls;
  810. X509 *cert = NULL, *id_cert = NULL, *c1 = NULL, *c2 = NULL;
  811. SESS_CERT_local *sess = NULL;
  812. c1 = read_cert_from(validCertString);
  813. c2 = read_cert_from(caCertString);
  814. tls = tor_malloc_zero(sizeof(tor_tls_t));
  815. tls->ssl = tor_malloc_zero(sizeof(SSL));
  816. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  817. sess = tor_malloc_zero(sizeof(SESS_CERT_local));
  818. tls->ssl->session->sess_cert = (void *)sess;
  819. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  820. tt_assert(!cert);
  821. tt_assert(!id_cert);
  822. tls->ssl->session->peer = c1;
  823. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  824. tt_assert(cert == c1);
  825. tt_assert(!id_cert);
  826. X509_free(cert); /* decrease refcnt */
  827. sess->cert_chain = sk_X509_new_null();
  828. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  829. tt_assert(cert == c1);
  830. tt_assert(!id_cert);
  831. X509_free(cert); /* decrease refcnt */
  832. sk_X509_push(sess->cert_chain, c1);
  833. sk_X509_push(sess->cert_chain, c2);
  834. try_to_extract_certs_from_tls(LOG_WARN, tls, &cert, &id_cert);
  835. tt_assert(cert == c1);
  836. tt_assert(id_cert);
  837. X509_free(cert); /* decrease refcnt */
  838. X509_free(id_cert); /* decrease refcnt */
  839. done:
  840. sk_X509_free(sess->cert_chain);
  841. tor_free(sess);
  842. tor_free(tls->ssl->session);
  843. tor_free(tls->ssl);
  844. tor_free(tls);
  845. X509_free(c1);
  846. X509_free(c2);
  847. }
  848. #endif /* !defined(OPENSSL_OPAQUE) */
  849. #ifndef OPENSSL_OPAQUE
  850. static void
  851. test_tortls_get_peer_cert(void *ignored)
  852. {
  853. (void)ignored;
  854. tor_x509_cert_t *ret;
  855. tor_tls_t *tls;
  856. X509 *cert = NULL;
  857. cert = read_cert_from(validCertString);
  858. tls = tor_malloc_zero(sizeof(tor_tls_t));
  859. tls->ssl = tor_malloc_zero(sizeof(SSL));
  860. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  861. ret = tor_tls_get_peer_cert(tls);
  862. tt_assert(!ret);
  863. tls->ssl->session->peer = cert;
  864. ret = tor_tls_get_peer_cert(tls);
  865. tt_assert(ret);
  866. tt_assert(ret->cert == cert);
  867. done:
  868. tor_x509_cert_free(ret);
  869. tor_free(tls->ssl->session);
  870. tor_free(tls->ssl);
  871. tor_free(tls);
  872. X509_free(cert);
  873. }
  874. #endif /* !defined(OPENSSL_OPAQUE) */
  875. #ifndef OPENSSL_OPAQUE
  876. static void
  877. test_tortls_peer_has_cert(void *ignored)
  878. {
  879. (void)ignored;
  880. int ret;
  881. tor_tls_t *tls;
  882. X509 *cert = NULL;
  883. cert = read_cert_from(validCertString);
  884. tls = tor_malloc_zero(sizeof(tor_tls_t));
  885. tls->ssl = tor_malloc_zero(sizeof(SSL));
  886. tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION));
  887. ret = tor_tls_peer_has_cert(tls);
  888. tt_assert(!ret);
  889. tls->ssl->session->peer = cert;
  890. ret = tor_tls_peer_has_cert(tls);
  891. tt_assert(ret);
  892. done:
  893. tor_free(tls->ssl->session);
  894. tor_free(tls->ssl);
  895. tor_free(tls);
  896. X509_free(cert);
  897. }
  898. #endif /* !defined(OPENSSL_OPAQUE) */
  899. static void
  900. test_tortls_get_write_overhead_ratio(void *ignored)
  901. {
  902. (void)ignored;
  903. double ret;
  904. total_bytes_written_over_tls = 0;
  905. ret = tls_get_write_overhead_ratio();
  906. tt_double_op(fabs(ret - 1.0), OP_LT, 1E-12);
  907. total_bytes_written_by_tls = 10;
  908. total_bytes_written_over_tls = 1;
  909. ret = tls_get_write_overhead_ratio();
  910. tt_double_op(fabs(ret - 10.0), OP_LT, 1E-12);
  911. total_bytes_written_by_tls = 10;
  912. total_bytes_written_over_tls = 2;
  913. ret = tls_get_write_overhead_ratio();
  914. tt_double_op(fabs(ret - 5.0), OP_LT, 1E-12);
  915. done:
  916. (void)0;
  917. }
  918. static void
  919. test_tortls_is_server(void *ignored)
  920. {
  921. (void)ignored;
  922. tor_tls_t *tls;
  923. int ret;
  924. tls = tor_malloc_zero(sizeof(tor_tls_t));
  925. tls->isServer = 1;
  926. ret = tor_tls_is_server(tls);
  927. tt_int_op(ret, OP_EQ, 1);
  928. done:
  929. tor_free(tls);
  930. }
  931. #ifndef OPENSSL_OPAQUE
  932. static void
  933. test_tortls_session_secret_cb(void *ignored)
  934. {
  935. (void)ignored;
  936. tor_tls_t *tls;
  937. SSL_CTX *ctx;
  938. STACK_OF(SSL_CIPHER) *ciphers = NULL;
  939. SSL_CIPHER *one;
  940. library_init();
  941. tor_tls_allocate_tor_tls_object_ex_data_index();
  942. tls = tor_malloc_zero(sizeof(tor_tls_t));
  943. tls->magic = TOR_TLS_MAGIC;
  944. ctx = SSL_CTX_new(TLSv1_method());
  945. tls->ssl = SSL_new(ctx);
  946. SSL_set_ex_data(tls->ssl, tor_tls_object_ex_data_index, tls);
  947. SSL_set_session_secret_cb(tls->ssl, tor_tls_session_secret_cb, NULL);
  948. tor_tls_session_secret_cb(tls->ssl, NULL, NULL, NULL, NULL, NULL);
  949. tt_assert(!tls->ssl->tls_session_secret_cb);
  950. one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384");
  951. one->id = 0x00ff;
  952. ciphers = sk_SSL_CIPHER_new_null();
  953. sk_SSL_CIPHER_push(ciphers, one);
  954. tls->client_cipher_list_type = 0;
  955. tor_tls_session_secret_cb(tls->ssl, NULL, NULL, ciphers, NULL, NULL);
  956. tt_assert(!tls->ssl->tls_session_secret_cb);
  957. done:
  958. sk_SSL_CIPHER_free(ciphers);
  959. SSL_free(tls->ssl);
  960. SSL_CTX_free(ctx);
  961. tor_free(tls);
  962. }
  963. #endif /* !defined(OPENSSL_OPAQUE) */
  964. #ifndef OPENSSL_OPAQUE
  965. /* TODO: It seems block_renegotiation and unblock_renegotiation and
  966. * using different blags. This might not be correct */
  967. static void
  968. test_tortls_block_renegotiation(void *ignored)
  969. {
  970. (void)ignored;
  971. tor_tls_t *tls;
  972. tls = tor_malloc_zero(sizeof(tor_tls_t));
  973. tls->ssl = tor_malloc_zero(sizeof(SSL));
  974. tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE));
  975. #ifndef SUPPORT_UNSAFE_RENEGOTIATION_FLAG
  976. #define SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0
  977. #endif
  978. tls->ssl->s3->flags = SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
  979. tor_tls_block_renegotiation(tls);
  980. #ifndef OPENSSL_1_1_API
  981. tt_assert(!(tls->ssl->s3->flags &
  982. SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION));
  983. #endif
  984. done:
  985. tor_free(tls->ssl->s3);
  986. tor_free(tls->ssl);
  987. tor_free(tls);
  988. }
  989. static void
  990. test_tortls_unblock_renegotiation(void *ignored)
  991. {
  992. (void)ignored;
  993. tor_tls_t *tls;
  994. tls = tor_malloc_zero(sizeof(tor_tls_t));
  995. tls->ssl = tor_malloc_zero(sizeof(SSL));
  996. tor_tls_unblock_renegotiation(tls);
  997. tt_uint_op(SSL_get_options(tls->ssl) &
  998. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, OP_EQ,
  999. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
  1000. done:
  1001. tor_free(tls->ssl);
  1002. tor_free(tls);
  1003. }
  1004. #endif /* !defined(OPENSSL_OPAQUE) */
  1005. #ifndef OPENSSL_OPAQUE
  1006. static void
  1007. test_tortls_assert_renegotiation_unblocked(void *ignored)
  1008. {
  1009. (void)ignored;
  1010. tor_tls_t *tls;
  1011. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1012. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1013. tor_tls_unblock_renegotiation(tls);
  1014. tor_tls_assert_renegotiation_unblocked(tls);
  1015. /* No assertion here - this test will fail if tor_assert is turned on
  1016. * and things are bad. */
  1017. tor_free(tls->ssl);
  1018. tor_free(tls);
  1019. }
  1020. #endif /* !defined(OPENSSL_OPAQUE) */
  1021. static void
  1022. test_tortls_set_logged_address(void *ignored)
  1023. {
  1024. (void)ignored;
  1025. tor_tls_t *tls;
  1026. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1027. tor_tls_set_logged_address(tls, "foo bar");
  1028. tt_str_op(tls->address, OP_EQ, "foo bar");
  1029. tor_tls_set_logged_address(tls, "foo bar 2");
  1030. tt_str_op(tls->address, OP_EQ, "foo bar 2");
  1031. done:
  1032. tor_free(tls->address);
  1033. tor_free(tls);
  1034. }
  1035. #ifndef OPENSSL_OPAQUE
  1036. static void
  1037. example_cb(tor_tls_t *t, void *arg)
  1038. {
  1039. (void)t;
  1040. (void)arg;
  1041. }
  1042. static void
  1043. test_tortls_set_renegotiate_callback(void *ignored)
  1044. {
  1045. (void)ignored;
  1046. tor_tls_t *tls;
  1047. const char *arg = "hello";
  1048. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1049. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1050. tor_tls_set_renegotiate_callback(tls, example_cb, (void*)arg);
  1051. tt_assert(tls->negotiated_callback == example_cb);
  1052. tt_assert(tls->callback_arg == arg);
  1053. tt_assert(!tls->got_renegotiate);
  1054. /* Assumes V2_HANDSHAKE_SERVER */
  1055. tt_assert(tls->ssl->info_callback == tor_tls_server_info_callback);
  1056. tor_tls_set_renegotiate_callback(tls, NULL, (void*)arg);
  1057. tt_assert(tls->ssl->info_callback == tor_tls_debug_state_callback);
  1058. done:
  1059. tor_free(tls->ssl);
  1060. tor_free(tls);
  1061. }
  1062. #endif /* !defined(OPENSSL_OPAQUE) */
  1063. #ifndef OPENSSL_OPAQUE
  1064. static SSL_CIPHER *fixed_cipher1 = NULL;
  1065. static SSL_CIPHER *fixed_cipher2 = NULL;
  1066. static const SSL_CIPHER *
  1067. fake_get_cipher(unsigned ncipher)
  1068. {
  1069. switch (ncipher) {
  1070. case 1:
  1071. return fixed_cipher1;
  1072. case 2:
  1073. return fixed_cipher2;
  1074. default:
  1075. return NULL;
  1076. }
  1077. }
  1078. #endif /* !defined(OPENSSL_OPAQUE) */
  1079. #ifndef OPENSSL_OPAQUE
  1080. static void
  1081. test_tortls_find_cipher_by_id(void *ignored)
  1082. {
  1083. (void)ignored;
  1084. int ret;
  1085. SSL *ssl;
  1086. SSL_CTX *ctx;
  1087. const SSL_METHOD *m = TLSv1_method();
  1088. SSL_METHOD *empty_method = tor_malloc_zero(sizeof(SSL_METHOD));
  1089. fixed_cipher1 = tor_malloc_zero(sizeof(SSL_CIPHER));
  1090. fixed_cipher2 = tor_malloc_zero(sizeof(SSL_CIPHER));
  1091. fixed_cipher2->id = 0xC00A;
  1092. library_init();
  1093. ctx = SSL_CTX_new(m);
  1094. ssl = SSL_new(ctx);
  1095. ret = find_cipher_by_id(ssl, NULL, 0xC00A);
  1096. tt_int_op(ret, OP_EQ, 1);
  1097. ret = find_cipher_by_id(ssl, m, 0xC00A);
  1098. tt_int_op(ret, OP_EQ, 1);
  1099. ret = find_cipher_by_id(ssl, m, 0xFFFF);
  1100. tt_int_op(ret, OP_EQ, 0);
  1101. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1102. tt_int_op(ret, OP_EQ, 1);
  1103. ret = find_cipher_by_id(ssl, empty_method, 0xFFFF);
  1104. #ifdef HAVE_SSL_CIPHER_FIND
  1105. tt_int_op(ret, OP_EQ, 0);
  1106. #else
  1107. tt_int_op(ret, OP_EQ, 1);
  1108. #endif
  1109. empty_method->get_cipher = fake_get_cipher;
  1110. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1111. tt_int_op(ret, OP_EQ, 1);
  1112. empty_method->get_cipher = m->get_cipher;
  1113. empty_method->num_ciphers = m->num_ciphers;
  1114. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1115. tt_int_op(ret, OP_EQ, 1);
  1116. empty_method->get_cipher = fake_get_cipher;
  1117. empty_method->num_ciphers = m->num_ciphers;
  1118. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1119. tt_int_op(ret, OP_EQ, 1);
  1120. empty_method->num_ciphers = fake_num_ciphers;
  1121. ret = find_cipher_by_id(ssl, empty_method, 0xC00A);
  1122. #ifdef HAVE_SSL_CIPHER_FIND
  1123. tt_int_op(ret, OP_EQ, 1);
  1124. #else
  1125. tt_int_op(ret, OP_EQ, 0);
  1126. #endif
  1127. done:
  1128. tor_free(empty_method);
  1129. SSL_free(ssl);
  1130. SSL_CTX_free(ctx);
  1131. tor_free(fixed_cipher1);
  1132. }
  1133. #endif /* !defined(OPENSSL_OPAQUE) */
  1134. #ifndef OPENSSL_OPAQUE
  1135. static void
  1136. test_tortls_debug_state_callback(void *ignored)
  1137. {
  1138. (void)ignored;
  1139. SSL *ssl;
  1140. char *buf = tor_malloc_zero(1000);
  1141. int n;
  1142. setup_capture_of_logs(LOG_DEBUG);
  1143. ssl = tor_malloc_zero(sizeof(SSL));
  1144. tor_tls_debug_state_callback(ssl, 32, 45);
  1145. n = tor_snprintf(buf, 1000, "SSL %p is now in state unknown"
  1146. " state [type=32,val=45].\n", ssl);
  1147. /* tor's snprintf returns -1 on error */
  1148. tt_int_op(n, OP_NE, -1);
  1149. expect_log_msg(buf);
  1150. done:
  1151. teardown_capture_of_logs();
  1152. tor_free(buf);
  1153. tor_free(ssl);
  1154. }
  1155. #endif /* !defined(OPENSSL_OPAQUE) */
  1156. #ifndef OPENSSL_OPAQUE
  1157. static void
  1158. test_tortls_server_info_callback(void *ignored)
  1159. {
  1160. (void)ignored;
  1161. tor_tls_t *tls;
  1162. SSL_CTX *ctx;
  1163. SSL *ssl;
  1164. library_init();
  1165. ctx = SSL_CTX_new(TLSv1_method());
  1166. ssl = SSL_new(ctx);
  1167. tor_tls_allocate_tor_tls_object_ex_data_index();
  1168. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1169. tls->magic = TOR_TLS_MAGIC;
  1170. tls->ssl = ssl;
  1171. setup_full_capture_of_logs(LOG_WARN);
  1172. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_A);
  1173. mock_clean_saved_logs();
  1174. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1175. expect_single_log_msg("Couldn't look up the tls for an SSL*. How odd!\n");
  1176. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_B);
  1177. mock_clean_saved_logs();
  1178. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1179. expect_single_log_msg("Couldn't look up the tls for an SSL*. How odd!\n");
  1180. SSL_set_state(ssl, 99);
  1181. mock_clean_saved_logs();
  1182. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1183. expect_no_log_entry();
  1184. teardown_capture_of_logs();
  1185. SSL_set_ex_data(tls->ssl, tor_tls_object_ex_data_index, tls);
  1186. SSL_set_state(ssl, SSL3_ST_SW_SRVR_HELLO_B);
  1187. tls->negotiated_callback = 0;
  1188. //tls->server_handshake_count = 120;
  1189. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1190. //tt_int_op(tls->server_handshake_count, OP_EQ, 121);
  1191. //tls->server_handshake_count = 127;
  1192. tls->negotiated_callback = (void *)1;
  1193. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1194. //tt_int_op(tls->server_handshake_count, OP_EQ, 127);
  1195. tt_int_op(tls->got_renegotiate, OP_EQ, 1);
  1196. tls->ssl->session = SSL_SESSION_new();
  1197. tls->wasV2Handshake = 0;
  1198. tor_tls_server_info_callback(ssl, SSL_CB_ACCEPT_LOOP, 0);
  1199. tt_int_op(tls->wasV2Handshake, OP_EQ, 0);
  1200. done:
  1201. teardown_capture_of_logs();
  1202. SSL_free(ssl);
  1203. SSL_CTX_free(ctx);
  1204. tor_free(tls);
  1205. }
  1206. #endif /* !defined(OPENSSL_OPAQUE) */
  1207. #ifndef OPENSSL_OPAQUE
  1208. static int fixed_ssl_read_result_index;
  1209. static int fixed_ssl_read_result[5];
  1210. static int
  1211. fixed_ssl_read(SSL *s, void *buf, int len)
  1212. {
  1213. (void)s;
  1214. (void)buf;
  1215. (void)len;
  1216. return fixed_ssl_read_result[fixed_ssl_read_result_index++];
  1217. }
  1218. static int
  1219. dummy_handshake_func(SSL *s)
  1220. {
  1221. (void)s;
  1222. return 1;
  1223. }
  1224. static int negotiated_callback_called;
  1225. static void
  1226. negotiated_callback_setter(tor_tls_t *t, void *arg)
  1227. {
  1228. (void)t;
  1229. (void)arg;
  1230. negotiated_callback_called++;
  1231. }
  1232. static void
  1233. test_tortls_read(void *ignored)
  1234. {
  1235. (void)ignored;
  1236. int ret;
  1237. tor_tls_t *tls;
  1238. char buf[100];
  1239. SSL_METHOD *method = give_me_a_test_method();
  1240. setup_capture_of_logs(LOG_WARN);
  1241. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1242. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1243. tls->state = TOR_TLS_ST_OPEN;
  1244. ret = tor_tls_read(tls, buf, 10);
  1245. tt_int_op(ret, OP_EQ, -9);
  1246. /* These tests assume that V2_HANDSHAKE_SERVER is set */
  1247. tls->ssl->handshake_func = dummy_handshake_func;
  1248. tls->ssl->method = method;
  1249. method->ssl_read = fixed_ssl_read;
  1250. fixed_ssl_read_result_index = 0;
  1251. fixed_ssl_read_result[0] = 42;
  1252. tls->state = TOR_TLS_ST_OPEN;
  1253. ERR_clear_error();
  1254. ret = tor_tls_read(tls, buf, 10);
  1255. tt_int_op(ret, OP_EQ, 42);
  1256. tls->state = TOR_TLS_ST_OPEN;
  1257. tls->got_renegotiate = 1;
  1258. fixed_ssl_read_result_index = 0;
  1259. ERR_clear_error();
  1260. ret = tor_tls_read(tls, buf, 10);
  1261. tt_int_op(tls->got_renegotiate, OP_EQ, 0);
  1262. tls->state = TOR_TLS_ST_OPEN;
  1263. tls->got_renegotiate = 1;
  1264. negotiated_callback_called = 0;
  1265. tls->negotiated_callback = negotiated_callback_setter;
  1266. fixed_ssl_read_result_index = 0;
  1267. ERR_clear_error();
  1268. ret = tor_tls_read(tls, buf, 10);
  1269. tt_int_op(negotiated_callback_called, OP_EQ, 1);
  1270. #ifndef LIBRESSL_VERSION_NUMBER
  1271. fixed_ssl_read_result_index = 0;
  1272. fixed_ssl_read_result[0] = 0;
  1273. tls->ssl->version = SSL2_VERSION;
  1274. ERR_clear_error();
  1275. ret = tor_tls_read(tls, buf, 10);
  1276. tt_int_op(ret, OP_EQ, TOR_TLS_CLOSE);
  1277. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_CLOSED);
  1278. #endif /* !defined(LIBRESSL_VERSION_NUMBER) */
  1279. // TODO: fill up
  1280. done:
  1281. teardown_capture_of_logs();
  1282. tor_free(tls->ssl);
  1283. tor_free(tls);
  1284. tor_free(method);
  1285. }
  1286. static int fixed_ssl_write_result;
  1287. static int
  1288. fixed_ssl_write(SSL *s, const void *buf, int len)
  1289. {
  1290. (void)s;
  1291. (void)buf;
  1292. (void)len;
  1293. return fixed_ssl_write_result;
  1294. }
  1295. static void
  1296. test_tortls_write(void *ignored)
  1297. {
  1298. (void)ignored;
  1299. int ret;
  1300. tor_tls_t *tls;
  1301. SSL_METHOD *method = give_me_a_test_method();
  1302. char buf[100];
  1303. setup_capture_of_logs(LOG_WARN);
  1304. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1305. tls->ssl = tor_malloc_zero(sizeof(SSL));
  1306. tls->state = TOR_TLS_ST_OPEN;
  1307. ret = tor_tls_write(tls, buf, 0);
  1308. tt_int_op(ret, OP_EQ, 0);
  1309. ret = tor_tls_write(tls, buf, 10);
  1310. tt_int_op(ret, OP_EQ, -9);
  1311. tls->ssl->method = method;
  1312. tls->wantwrite_n = 1;
  1313. ret = tor_tls_write(tls, buf, 10);
  1314. tt_int_op(tls->wantwrite_n, OP_EQ, 0);
  1315. method->ssl_write = fixed_ssl_write;
  1316. tls->ssl->handshake_func = dummy_handshake_func;
  1317. fixed_ssl_write_result = 1;
  1318. ERR_clear_error();
  1319. ret = tor_tls_write(tls, buf, 10);
  1320. tt_int_op(ret, OP_EQ, 1);
  1321. fixed_ssl_write_result = -1;
  1322. ERR_clear_error();
  1323. tls->ssl->rwstate = SSL_READING;
  1324. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  1325. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_READ;
  1326. ret = tor_tls_write(tls, buf, 10);
  1327. tt_int_op(ret, OP_EQ, TOR_TLS_WANTREAD);
  1328. ERR_clear_error();
  1329. tls->ssl->rwstate = SSL_READING;
  1330. SSL_set_bio(tls->ssl, BIO_new(BIO_s_mem()), NULL);
  1331. SSL_get_rbio(tls->ssl)->flags = BIO_FLAGS_WRITE;
  1332. ret = tor_tls_write(tls, buf, 10);
  1333. tt_int_op(ret, OP_EQ, TOR_TLS_WANTWRITE);
  1334. done:
  1335. teardown_capture_of_logs();
  1336. BIO_free(tls->ssl->rbio);
  1337. tor_free(tls->ssl);
  1338. tor_free(tls);
  1339. tor_free(method);
  1340. }
  1341. #endif /* !defined(OPENSSL_OPAQUE) */
  1342. #ifndef OPENSSL_OPAQUE
  1343. static int fixed_ssl_accept_result;
  1344. static int fixed_ssl_connect_result;
  1345. static int
  1346. setting_error_ssl_accept(SSL *ssl)
  1347. {
  1348. (void)ssl;
  1349. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  1350. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  1351. return fixed_ssl_accept_result;
  1352. }
  1353. static int
  1354. setting_error_ssl_connect(SSL *ssl)
  1355. {
  1356. (void)ssl;
  1357. ERR_put_error(ERR_LIB_BN, 2, -1, "somewhere.c", 99);
  1358. ERR_put_error(ERR_LIB_SYS, 2, -1, "somewhere.c", 99);
  1359. return fixed_ssl_connect_result;
  1360. }
  1361. static int
  1362. fixed_ssl_accept(SSL *ssl)
  1363. {
  1364. (void) ssl;
  1365. return fixed_ssl_accept_result;
  1366. }
  1367. static void
  1368. test_tortls_handshake(void *ignored)
  1369. {
  1370. (void)ignored;
  1371. int ret;
  1372. tor_tls_t *tls;
  1373. SSL_CTX *ctx;
  1374. SSL_METHOD *method = give_me_a_test_method();
  1375. setup_capture_of_logs(LOG_INFO);
  1376. SSL_library_init();
  1377. SSL_load_error_strings();
  1378. ctx = SSL_CTX_new(TLSv1_method());
  1379. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1380. tls->ssl = SSL_new(ctx);
  1381. tls->state = TOR_TLS_ST_HANDSHAKE;
  1382. ret = tor_tls_handshake(tls);
  1383. tt_int_op(ret, OP_EQ, -9);
  1384. tls->isServer = 1;
  1385. tls->state = TOR_TLS_ST_HANDSHAKE;
  1386. ret = tor_tls_handshake(tls);
  1387. tt_int_op(ret, OP_EQ, -9);
  1388. tls->ssl->method = method;
  1389. method->ssl_accept = fixed_ssl_accept;
  1390. fixed_ssl_accept_result = 2;
  1391. ERR_clear_error();
  1392. tls->state = TOR_TLS_ST_HANDSHAKE;
  1393. ret = tor_tls_handshake(tls);
  1394. tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_OPEN);
  1395. method->ssl_accept = setting_error_ssl_accept;
  1396. fixed_ssl_accept_result = 1;
  1397. ERR_clear_error();
  1398. mock_clean_saved_logs();
  1399. tls->state = TOR_TLS_ST_HANDSHAKE;
  1400. ret = tor_tls_handshake(tls);
  1401. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1402. expect_log_entry();
  1403. /* This fails on jessie. Investigate why! */
  1404. #if 0
  1405. expect_log_msg("TLS error while handshaking: (null) (in bignum routines:"
  1406. "(null):SSLv3 write client hello B)\n");
  1407. expect_log_msg("TLS error while handshaking: (null) (in system library:"
  1408. "connect:SSLv3 write client hello B)\n");
  1409. #endif /* 0 */
  1410. expect_log_severity(LOG_INFO);
  1411. tls->isServer = 0;
  1412. method->ssl_connect = setting_error_ssl_connect;
  1413. fixed_ssl_connect_result = 1;
  1414. ERR_clear_error();
  1415. mock_clean_saved_logs();
  1416. tls->state = TOR_TLS_ST_HANDSHAKE;
  1417. ret = tor_tls_handshake(tls);
  1418. tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC);
  1419. expect_log_entry();
  1420. #if 0
  1421. /* See above */
  1422. expect_log_msg("TLS error while handshaking: "
  1423. "(null) (in bignum routines:(null):SSLv3 write client hello B)\n");
  1424. expect_log_msg("TLS error while handshaking: "
  1425. "(null) (in system library:connect:SSLv3 write client hello B)\n");
  1426. #endif /* 0 */
  1427. expect_log_severity(LOG_WARN);
  1428. done:
  1429. teardown_capture_of_logs();
  1430. SSL_free(tls->ssl);
  1431. SSL_CTX_free(ctx);
  1432. tor_free(tls);
  1433. tor_free(method);
  1434. }
  1435. #endif /* !defined(OPENSSL_OPAQUE) */
  1436. #ifndef OPENSSL_OPAQUE
  1437. static void
  1438. test_tortls_finish_handshake(void *ignored)
  1439. {
  1440. (void)ignored;
  1441. int ret;
  1442. tor_tls_t *tls;
  1443. SSL_CTX *ctx;
  1444. SSL_METHOD *method = give_me_a_test_method();
  1445. SSL_library_init();
  1446. SSL_load_error_strings();
  1447. X509 *c1 = read_cert_from(validCertString);
  1448. SESS_CERT_local *sess = NULL;
  1449. ctx = SSL_CTX_new(method);
  1450. tls = tor_malloc_zero(sizeof(tor_tls_t));
  1451. tls->ssl = SSL_new(ctx);
  1452. tls->state = TOR_TLS_ST_OPEN;
  1453. ret = tor_tls_finish_handshake(tls);
  1454. tt_int_op(ret, OP_EQ, 0);
  1455. tls->isServer = 1;
  1456. tls->wasV2Handshake = 0;
  1457. setup_full_capture_of_logs(LOG_WARN);
  1458. ret = tor_tls_finish_handshake(tls);
  1459. tt_int_op(ret, OP_EQ, 0);
  1460. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1461. expect_single_log_msg_containing("For some reason, wasV2Handshake didn't "
  1462. "get set.");
  1463. teardown_capture_of_logs();
  1464. tls->wasV2Handshake = 1;
  1465. ret = tor_tls_finish_handshake(tls);
  1466. tt_int_op(ret, OP_EQ, 0);
  1467. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1468. tls->wasV2Handshake = 1;
  1469. tls->ssl->session = SSL_SESSION_new();
  1470. ret = tor_tls_finish_handshake(tls);
  1471. tt_int_op(ret, OP_EQ, 0);
  1472. tt_int_op(tls->wasV2Handshake, OP_EQ, 0);
  1473. tls->isServer = 0;
  1474. sess = tor_malloc_zero(sizeof(SESS_CERT_local));
  1475. tls->ssl->session->sess_cert = (void *)sess;
  1476. sess->cert_chain = sk_X509_new_null();
  1477. sk_X509_push(sess->cert_chain, c1);
  1478. tls->ssl->session->peer = c1;
  1479. tls->wasV2Handshake = 0;
  1480. ret = tor_tls_finish_handshake(tls);
  1481. tt_int_op(ret, OP_EQ, 0);
  1482. tt_int_op(tls->wasV2Handshake, OP_EQ, 1);
  1483. method->num_ciphers = fake_num_ciphers;
  1484. ret = tor_tls_finish_handshake(tls);
  1485. tt_int_op(ret, OP_EQ, -9);
  1486. done:
  1487. if (sess)
  1488. sk_X509_free(sess->cert_chain);
  1489. if (tls->ssl && tls->ssl->session) {
  1490. tor_free(tls->ssl->session->sess_cert);
  1491. }
  1492. SSL_free(tls->ssl);
  1493. tor_free(tls);
  1494. SSL_CTX_free(ctx);
  1495. tor_free(method);
  1496. teardown_capture_of_logs();
  1497. }
  1498. #endif /* !defined(OPENSSL_OPAQUE) */
  1499. static int fixed_crypto_pk_new_result_index;
  1500. static crypto_pk_t *fixed_crypto_pk_new_result[5];
  1501. static crypto_pk_t *
  1502. fixed_crypto_pk_new(void)
  1503. {
  1504. return fixed_crypto_pk_new_result[fixed_crypto_pk_new_result_index++];
  1505. }
  1506. #ifndef OPENSSL_OPAQUE
  1507. static int fixed_crypto_pk_generate_key_with_bits_result_index;
  1508. static int fixed_crypto_pk_generate_key_with_bits_result[5];
  1509. static int fixed_tor_tls_create_certificate_result_index;
  1510. static X509 *fixed_tor_tls_create_certificate_result[5];
  1511. static int fixed_tor_x509_cert_new_result_index;
  1512. static tor_x509_cert_t *fixed_tor_x509_cert_new_result[5];
  1513. static int
  1514. fixed_crypto_pk_generate_key_with_bits(crypto_pk_t *env, int bits)
  1515. {
  1516. (void)env;
  1517. (void)bits;
  1518. return fixed_crypto_pk_generate_key_with_bits_result[
  1519. fixed_crypto_pk_generate_key_with_bits_result_index++];
  1520. }
  1521. static X509 *
  1522. fixed_tor_tls_create_certificate(crypto_pk_t *rsa,
  1523. crypto_pk_t *rsa_sign,
  1524. const char *cname,
  1525. const char *cname_sign,
  1526. unsigned int cert_lifetime)
  1527. {
  1528. (void)rsa;
  1529. (void)rsa_sign;
  1530. (void)cname;
  1531. (void)cname_sign;
  1532. (void)cert_lifetime;
  1533. X509 *result = fixed_tor_tls_create_certificate_result[
  1534. fixed_tor_tls_create_certificate_result_index++];
  1535. if (result)
  1536. return X509_dup(result);
  1537. else
  1538. return NULL;
  1539. }
  1540. static void
  1541. fixed_tor_tls_create_certificate_results_free(void)
  1542. {
  1543. unsigned i;
  1544. for (i = 0; i < ARRAY_LENGTH(fixed_tor_tls_create_certificate_result); ++i) {
  1545. X509 *cert = fixed_tor_tls_create_certificate_result[i];
  1546. if (cert)
  1547. X509_free(cert);
  1548. fixed_tor_tls_create_certificate_result[i] = NULL;
  1549. }
  1550. }
  1551. static void
  1552. fixed_tor_x509_cert_new_results_free(void)
  1553. {
  1554. unsigned i;
  1555. for (i = 0; i < ARRAY_LENGTH(fixed_tor_x509_cert_new_result); ++i) {
  1556. tor_x509_cert_free(fixed_tor_x509_cert_new_result[i]);
  1557. }
  1558. }
  1559. static tor_x509_cert_t *
  1560. fixed_tor_x509_cert_new(tor_x509_cert_impl_t *x509_cert)
  1561. {
  1562. (void) x509_cert;
  1563. tor_x509_cert_t **certp =
  1564. &fixed_tor_x509_cert_new_result[fixed_tor_x509_cert_new_result_index++];
  1565. tor_x509_cert_t *cert = *certp;
  1566. *certp = NULL;
  1567. return cert;
  1568. }
  1569. static void
  1570. test_tortls_context_new(void *ignored)
  1571. {
  1572. (void)ignored;
  1573. tor_tls_context_t *ret;
  1574. crypto_pk_t *pk1, *pk2, *pk3, *pk4, *pk5, *pk6, *pk7, *pk8, *pk9, *pk10,
  1575. *pk11, *pk12, *pk13, *pk14, *pk15, *pk16, *pk17, *pk18;
  1576. pk1 = crypto_pk_new();
  1577. pk2 = crypto_pk_new();
  1578. pk3 = crypto_pk_new();
  1579. pk4 = crypto_pk_new();
  1580. pk5 = crypto_pk_new();
  1581. pk6 = crypto_pk_new();
  1582. pk7 = crypto_pk_new();
  1583. pk8 = crypto_pk_new();
  1584. pk9 = crypto_pk_new();
  1585. pk10 = crypto_pk_new();
  1586. pk11 = crypto_pk_new();
  1587. pk12 = crypto_pk_new();
  1588. pk13 = crypto_pk_new();
  1589. pk14 = crypto_pk_new();
  1590. pk15 = crypto_pk_new();
  1591. pk16 = crypto_pk_new();
  1592. pk17 = crypto_pk_new();
  1593. pk18 = crypto_pk_new();
  1594. fixed_crypto_pk_new_result_index = 0;
  1595. fixed_crypto_pk_new_result[0] = NULL;
  1596. MOCK(crypto_pk_new, fixed_crypto_pk_new);
  1597. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1598. tt_assert(!ret);
  1599. /* note: we already override this in testing_common.c, so we
  1600. * run this unit test in a subprocess. */
  1601. MOCK(crypto_pk_generate_key_with_bits,
  1602. fixed_crypto_pk_generate_key_with_bits);
  1603. fixed_crypto_pk_new_result_index = 0;
  1604. fixed_crypto_pk_new_result[0] = pk1;
  1605. fixed_crypto_pk_new_result[1] = NULL;
  1606. fixed_crypto_pk_generate_key_with_bits_result[0] = -1;
  1607. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1608. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1609. tt_assert(!ret);
  1610. fixed_crypto_pk_new_result_index = 0;
  1611. fixed_crypto_pk_new_result[0] = pk2;
  1612. fixed_crypto_pk_new_result[1] = NULL;
  1613. fixed_crypto_pk_generate_key_with_bits_result[0] = 0;
  1614. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1615. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1616. tt_assert(!ret);
  1617. fixed_crypto_pk_new_result_index = 0;
  1618. fixed_crypto_pk_new_result[0] = pk3;
  1619. fixed_crypto_pk_new_result[1] = pk4;
  1620. fixed_crypto_pk_new_result[2] = NULL;
  1621. fixed_crypto_pk_generate_key_with_bits_result[0] = 0;
  1622. fixed_crypto_pk_generate_key_with_bits_result[1] = -1;
  1623. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1624. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1625. tt_assert(!ret);
  1626. MOCK(tor_tls_create_certificate, fixed_tor_tls_create_certificate);
  1627. fixed_crypto_pk_new_result_index = 0;
  1628. fixed_crypto_pk_new_result[0] = pk5;
  1629. fixed_crypto_pk_new_result[1] = pk6;
  1630. fixed_crypto_pk_new_result[2] = NULL;
  1631. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1632. fixed_crypto_pk_generate_key_with_bits_result[1] = 0;
  1633. fixed_tor_tls_create_certificate_result_index = 0;
  1634. fixed_tor_tls_create_certificate_result[0] = NULL;
  1635. fixed_tor_tls_create_certificate_result[1] = X509_new();
  1636. fixed_tor_tls_create_certificate_result[2] = X509_new();
  1637. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1638. tt_assert(!ret);
  1639. fixed_tor_tls_create_certificate_results_free();
  1640. fixed_crypto_pk_new_result_index = 0;
  1641. fixed_crypto_pk_new_result[0] = pk7;
  1642. fixed_crypto_pk_new_result[1] = pk8;
  1643. fixed_crypto_pk_new_result[2] = NULL;
  1644. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1645. fixed_tor_tls_create_certificate_result_index = 0;
  1646. fixed_tor_tls_create_certificate_result[0] = X509_new();
  1647. fixed_tor_tls_create_certificate_result[1] = NULL;
  1648. fixed_tor_tls_create_certificate_result[2] = X509_new();
  1649. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1650. tt_assert(!ret);
  1651. fixed_tor_tls_create_certificate_results_free();
  1652. fixed_crypto_pk_new_result_index = 0;
  1653. fixed_crypto_pk_new_result[0] = pk9;
  1654. fixed_crypto_pk_new_result[1] = pk10;
  1655. fixed_crypto_pk_new_result[2] = NULL;
  1656. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1657. fixed_tor_tls_create_certificate_result_index = 0;
  1658. fixed_tor_tls_create_certificate_result[0] = X509_new();
  1659. fixed_tor_tls_create_certificate_result[1] = X509_new();
  1660. fixed_tor_tls_create_certificate_result[2] = NULL;
  1661. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1662. tt_assert(!ret);
  1663. fixed_tor_tls_create_certificate_results_free();
  1664. MOCK(tor_x509_cert_new, fixed_tor_x509_cert_new);
  1665. fixed_crypto_pk_new_result_index = 0;
  1666. fixed_crypto_pk_new_result[0] = pk11;
  1667. fixed_crypto_pk_new_result[1] = pk12;
  1668. fixed_crypto_pk_new_result[2] = NULL;
  1669. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1670. fixed_tor_tls_create_certificate_result_index = 0;
  1671. fixed_tor_tls_create_certificate_result[0] = X509_new();
  1672. fixed_tor_tls_create_certificate_result[1] = X509_new();
  1673. fixed_tor_tls_create_certificate_result[2] = X509_new();
  1674. fixed_tor_x509_cert_new_result_index = 0;
  1675. fixed_tor_x509_cert_new_result[0] = NULL;
  1676. fixed_tor_x509_cert_new_result[1] = NULL;
  1677. fixed_tor_x509_cert_new_result[2] = NULL;
  1678. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1679. tt_assert(!ret);
  1680. fixed_tor_tls_create_certificate_results_free();
  1681. fixed_crypto_pk_new_result_index = 0;
  1682. fixed_crypto_pk_new_result[0] = pk13;
  1683. fixed_crypto_pk_new_result[1] = pk14;
  1684. fixed_crypto_pk_new_result[2] = NULL;
  1685. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1686. fixed_tor_tls_create_certificate_result_index = 0;
  1687. fixed_tor_tls_create_certificate_result[0] = X509_new();
  1688. fixed_tor_tls_create_certificate_result[1] = X509_new();
  1689. fixed_tor_tls_create_certificate_result[2] = X509_new();
  1690. fixed_tor_x509_cert_new_result_index = 0;
  1691. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  1692. fixed_tor_x509_cert_new_result[1] = NULL;
  1693. fixed_tor_x509_cert_new_result[2] = NULL;
  1694. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1695. tt_assert(!ret);
  1696. fixed_tor_tls_create_certificate_results_free();
  1697. fixed_tor_x509_cert_new_results_free();
  1698. fixed_crypto_pk_new_result_index = 0;
  1699. fixed_crypto_pk_new_result[0] = pk15;
  1700. fixed_crypto_pk_new_result[1] = pk16;
  1701. fixed_crypto_pk_new_result[2] = NULL;
  1702. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1703. fixed_tor_tls_create_certificate_result_index = 0;
  1704. fixed_tor_tls_create_certificate_result[0] = X509_new();
  1705. fixed_tor_tls_create_certificate_result[1] = X509_new();
  1706. fixed_tor_tls_create_certificate_result[2] = X509_new();
  1707. fixed_tor_x509_cert_new_result_index = 0;
  1708. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  1709. fixed_tor_x509_cert_new_result[1] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  1710. fixed_tor_x509_cert_new_result[2] = NULL;
  1711. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1712. tt_assert(!ret);
  1713. fixed_tor_tls_create_certificate_results_free();
  1714. fixed_tor_x509_cert_new_results_free();
  1715. fixed_crypto_pk_new_result_index = 0;
  1716. fixed_crypto_pk_new_result[0] = pk17;
  1717. fixed_crypto_pk_new_result[1] = pk18;
  1718. fixed_crypto_pk_new_result[2] = NULL;
  1719. fixed_crypto_pk_generate_key_with_bits_result_index = 0;
  1720. fixed_tor_tls_create_certificate_result_index = 0;
  1721. fixed_tor_tls_create_certificate_result[0] = X509_new();
  1722. fixed_tor_tls_create_certificate_result[1] = X509_new();
  1723. fixed_tor_tls_create_certificate_result[2] = X509_new();
  1724. fixed_tor_x509_cert_new_result_index = 0;
  1725. fixed_tor_x509_cert_new_result[0] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  1726. fixed_tor_x509_cert_new_result[1] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  1727. fixed_tor_x509_cert_new_result[2] = tor_malloc_zero(sizeof(tor_x509_cert_t));
  1728. ret = tor_tls_context_new(NULL, 0, 0, 0);
  1729. tt_assert(!ret);
  1730. done:
  1731. fixed_tor_tls_create_certificate_results_free();
  1732. fixed_tor_x509_cert_new_results_free();
  1733. UNMOCK(tor_x509_cert_new);
  1734. UNMOCK(tor_tls_create_certificate);
  1735. UNMOCK(crypto_pk_generate_key_with_bits);
  1736. UNMOCK(crypto_pk_new);
  1737. }
  1738. #endif /* !defined(OPENSSL_OPAQUE) */
  1739. static int fixed_crypto_pk_get_evp_pkey_result_index = 0;
  1740. static EVP_PKEY *fixed_crypto_pk_get_evp_pkey_result[5];
  1741. static EVP_PKEY *
  1742. fixed_crypto_pk_get_evp_pkey_(crypto_pk_t *env, int private)
  1743. {
  1744. (void) env;
  1745. (void) private;
  1746. return fixed_crypto_pk_get_evp_pkey_result[
  1747. fixed_crypto_pk_get_evp_pkey_result_index++];
  1748. }
  1749. static void
  1750. test_tortls_create_certificate(void *ignored)
  1751. {
  1752. (void)ignored;
  1753. X509 *ret;
  1754. crypto_pk_t *pk1, *pk2;
  1755. pk1 = crypto_pk_new();
  1756. pk2 = crypto_pk_new();
  1757. MOCK(crypto_pk_get_openssl_evp_pkey_, fixed_crypto_pk_get_evp_pkey_);
  1758. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  1759. fixed_crypto_pk_get_evp_pkey_result[0] = NULL;
  1760. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  1761. tt_assert(!ret);
  1762. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  1763. fixed_crypto_pk_get_evp_pkey_result[0] = EVP_PKEY_new();
  1764. fixed_crypto_pk_get_evp_pkey_result[1] = NULL;
  1765. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  1766. tt_assert(!ret);
  1767. fixed_crypto_pk_get_evp_pkey_result_index = 0;
  1768. fixed_crypto_pk_get_evp_pkey_result[0] = EVP_PKEY_new();
  1769. fixed_crypto_pk_get_evp_pkey_result[1] = EVP_PKEY_new();
  1770. ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
  1771. tt_assert(!ret);
  1772. done:
  1773. UNMOCK(crypto_pk_get_openssl_evp_pkey_);
  1774. crypto_pk_free(pk1);
  1775. crypto_pk_free(pk2);
  1776. }
  1777. static void
  1778. test_tortls_cert_new(void *ignored)
  1779. {
  1780. (void)ignored;
  1781. tor_x509_cert_t *ret;
  1782. X509 *cert = read_cert_from(validCertString);
  1783. ret = tor_x509_cert_new(NULL);
  1784. tt_assert(!ret);
  1785. ret = tor_x509_cert_new(cert);
  1786. tt_assert(ret);
  1787. tor_x509_cert_free(ret);
  1788. ret = NULL;
  1789. #if 0
  1790. cert = read_cert_from(validCertString);
  1791. /* XXX this doesn't do what you think: it alters a copy of the pubkey. */
  1792. X509_get_pubkey(cert)->type = EVP_PKEY_DSA;
  1793. ret = tor_x509_cert_new(cert);
  1794. tt_assert(ret);
  1795. #endif /* 0 */
  1796. #ifndef OPENSSL_OPAQUE
  1797. cert = read_cert_from(validCertString);
  1798. X509_CINF_free(cert->cert_info);
  1799. cert->cert_info = NULL;
  1800. ret = tor_x509_cert_new(cert);
  1801. tt_assert(ret);
  1802. #endif /* !defined(OPENSSL_OPAQUE) */
  1803. done:
  1804. tor_x509_cert_free(ret);
  1805. }
  1806. static void
  1807. test_tortls_cert_is_valid(void *ignored)
  1808. {
  1809. (void)ignored;
  1810. int ret;
  1811. tor_x509_cert_t *cert = NULL, *scert = NULL;
  1812. scert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  1813. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  1814. tt_int_op(ret, OP_EQ, 0);
  1815. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  1816. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  1817. tt_int_op(ret, OP_EQ, 0);
  1818. tor_free(scert);
  1819. tor_free(cert);
  1820. cert = tor_x509_cert_new(read_cert_from(validCertString));
  1821. scert = tor_x509_cert_new(read_cert_from(caCertString));
  1822. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  1823. tt_int_op(ret, OP_EQ, 1);
  1824. #ifndef OPENSSL_OPAQUE
  1825. tor_x509_cert_free(cert);
  1826. tor_x509_cert_free(scert);
  1827. cert = tor_x509_cert_new(read_cert_from(validCertString));
  1828. scert = tor_x509_cert_new(read_cert_from(caCertString));
  1829. ASN1_TIME_free(cert->cert->cert_info->validity->notAfter);
  1830. cert->cert->cert_info->validity->notAfter =
  1831. ASN1_TIME_set(NULL, time(NULL)-1000000);
  1832. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  1833. tt_int_op(ret, OP_EQ, 0);
  1834. tor_x509_cert_free(cert);
  1835. tor_x509_cert_free(scert);
  1836. cert = tor_x509_cert_new(read_cert_from(validCertString));
  1837. scert = tor_x509_cert_new(read_cert_from(caCertString));
  1838. X509_PUBKEY_free(cert->cert->cert_info->key);
  1839. cert->cert->cert_info->key = NULL;
  1840. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 1);
  1841. tt_int_op(ret, OP_EQ, 0);
  1842. #endif /* !defined(OPENSSL_OPAQUE) */
  1843. #if 0
  1844. tor_x509_cert_free(cert);
  1845. tor_x509_cert_free(scert);
  1846. cert = tor_x509_cert_new(read_cert_from(validCertString));
  1847. scert = tor_x509_cert_new(read_cert_from(caCertString));
  1848. /* This doesn't actually change the key in the cert. XXXXXX */
  1849. BN_one(EVP_PKEY_get1_RSA(X509_get_pubkey(cert->cert))->n);
  1850. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 1);
  1851. tt_int_op(ret, OP_EQ, 0);
  1852. tor_x509_cert_free(cert);
  1853. tor_x509_cert_free(scert);
  1854. cert = tor_x509_cert_new(read_cert_from(validCertString));
  1855. scert = tor_x509_cert_new(read_cert_from(caCertString));
  1856. /* This doesn't actually change the key in the cert. XXXXXX */
  1857. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  1858. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 1);
  1859. tt_int_op(ret, OP_EQ, 0);
  1860. tor_x509_cert_free(cert);
  1861. tor_x509_cert_free(scert);
  1862. cert = tor_x509_cert_new(read_cert_from(validCertString));
  1863. scert = tor_x509_cert_new(read_cert_from(caCertString));
  1864. /* This doesn't actually change the key in the cert. XXXXXX */
  1865. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  1866. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  1867. tt_int_op(ret, OP_EQ, 1);
  1868. tor_x509_cert_free(cert);
  1869. tor_x509_cert_free(scert);
  1870. cert = tor_x509_cert_new(read_cert_from(validCertString));
  1871. scert = tor_x509_cert_new(read_cert_from(caCertString));
  1872. /* This doesn't actually change the key in the cert. XXXXXX */
  1873. X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC;
  1874. X509_get_pubkey(cert->cert)->ameth = NULL;
  1875. ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, time(NULL), 0);
  1876. tt_int_op(ret, OP_EQ, 0);
  1877. #endif /* 0 */
  1878. done:
  1879. tor_x509_cert_free(cert);
  1880. tor_x509_cert_free(scert);
  1881. }
  1882. static void
  1883. test_tortls_context_init_one(void *ignored)
  1884. {
  1885. (void)ignored;
  1886. int ret;
  1887. tor_tls_context_t *old = NULL;
  1888. MOCK(crypto_pk_new, fixed_crypto_pk_new);
  1889. fixed_crypto_pk_new_result_index = 0;
  1890. fixed_crypto_pk_new_result[0] = NULL;
  1891. ret = tor_tls_context_init_one(&old, NULL, 0, 0, 0);
  1892. tt_int_op(ret, OP_EQ, -1);
  1893. done:
  1894. UNMOCK(crypto_pk_new);
  1895. }
  1896. #define LOCAL_TEST_CASE(name, flags) \
  1897. { #name, test_tortls_##name, (flags|TT_FORK), NULL, NULL }
  1898. #ifdef OPENSSL_OPAQUE
  1899. #define INTRUSIVE_TEST_CASE(name, flags) \
  1900. { #name, NULL, TT_SKIP, NULL, NULL }
  1901. #else
  1902. #define INTRUSIVE_TEST_CASE(name, flags) LOCAL_TEST_CASE(name, flags)
  1903. #endif /* defined(OPENSSL_OPAQUE) */
  1904. struct testcase_t tortls_openssl_tests[] = {
  1905. LOCAL_TEST_CASE(tor_tls_new, TT_FORK),
  1906. LOCAL_TEST_CASE(get_state_description, TT_FORK),
  1907. LOCAL_TEST_CASE(get_by_ssl, TT_FORK),
  1908. LOCAL_TEST_CASE(allocate_tor_tls_object_ex_data_index, TT_FORK),
  1909. LOCAL_TEST_CASE(log_one_error, TT_FORK),
  1910. INTRUSIVE_TEST_CASE(get_error, TT_FORK),
  1911. LOCAL_TEST_CASE(always_accept_verify_cb, 0),
  1912. INTRUSIVE_TEST_CASE(x509_cert_free, 0),
  1913. LOCAL_TEST_CASE(cert_matches_key, 0),
  1914. INTRUSIVE_TEST_CASE(cert_get_key, 0),
  1915. LOCAL_TEST_CASE(get_my_client_auth_key, TT_FORK),
  1916. INTRUSIVE_TEST_CASE(get_ciphersuite_name, 0),
  1917. INTRUSIVE_TEST_CASE(classify_client_ciphers, 0),
  1918. LOCAL_TEST_CASE(client_is_using_v2_ciphers, 0),
  1919. INTRUSIVE_TEST_CASE(get_pending_bytes, 0),
  1920. INTRUSIVE_TEST_CASE(SSL_SESSION_get_master_key, 0),
  1921. INTRUSIVE_TEST_CASE(get_tlssecrets, 0),
  1922. INTRUSIVE_TEST_CASE(get_buffer_sizes, 0),
  1923. INTRUSIVE_TEST_CASE(try_to_extract_certs_from_tls, 0),
  1924. INTRUSIVE_TEST_CASE(get_peer_cert, 0),
  1925. INTRUSIVE_TEST_CASE(peer_has_cert, 0),
  1926. INTRUSIVE_TEST_CASE(finish_handshake, 0),
  1927. INTRUSIVE_TEST_CASE(handshake, 0),
  1928. INTRUSIVE_TEST_CASE(write, 0),
  1929. INTRUSIVE_TEST_CASE(read, 0),
  1930. INTRUSIVE_TEST_CASE(server_info_callback, 0),
  1931. LOCAL_TEST_CASE(get_write_overhead_ratio, TT_FORK),
  1932. LOCAL_TEST_CASE(is_server, 0),
  1933. INTRUSIVE_TEST_CASE(assert_renegotiation_unblocked, 0),
  1934. INTRUSIVE_TEST_CASE(block_renegotiation, 0),
  1935. INTRUSIVE_TEST_CASE(unblock_renegotiation, 0),
  1936. INTRUSIVE_TEST_CASE(set_renegotiate_callback, 0),
  1937. LOCAL_TEST_CASE(set_logged_address, 0),
  1938. INTRUSIVE_TEST_CASE(find_cipher_by_id, 0),
  1939. INTRUSIVE_TEST_CASE(session_secret_cb, 0),
  1940. INTRUSIVE_TEST_CASE(debug_state_callback, 0),
  1941. INTRUSIVE_TEST_CASE(context_new, TT_FORK /* redundant */),
  1942. LOCAL_TEST_CASE(create_certificate, 0),
  1943. LOCAL_TEST_CASE(cert_new, 0),
  1944. LOCAL_TEST_CASE(cert_is_valid, 0),
  1945. LOCAL_TEST_CASE(context_init_one, 0),
  1946. END_OF_TESTCASES
  1947. };