Skip to content

Commit 7c9bb61

Browse files
JeremiahM37JeremiahM37
committed
tests
1 parent 7976c03 commit 7c9bb61

9 files changed

Lines changed: 137 additions & 4 deletions

File tree

‎src/tls.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17180,8 +17180,8 @@ static word16 TLSX_GetMinSize_Server(const word16 *type)
1718017180

1718117181

1718217182
/** Parses a buffer of TLS extensions. */
17183-
int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length, byte msgType,
17184-
Suites *suites)
17183+
WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
17184+
byte msgType, Suites *suites)
1718517185
{
1718617186
int ret = 0;
1718717187
word16 offset = 0;

‎tests/api.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37368,6 +37368,8 @@ TEST_CASE testCases[] = {
3736837368
TEST_DECL(test_certificate_authorities_client_hello),
3736937369
TEST_DECL(test_TLSX_TCA_Find),
3737037370
TEST_DECL(test_TLSX_SNI_GetSize_overflow),
37371+
TEST_DECL(test_TLSX_ECH_msg_type_validation),
37372+
TEST_DECL(test_TLSX_SRTP_msg_type_validation),
3737137373
TEST_DECL(test_wolfSSL_wolfSSL_UseSecureRenegotiation),
3737237374
TEST_DECL(test_wolfSSL_clear_secure_renegotiation),
3737337375
TEST_DECL(test_wolfSSL_SCR_Reconnect),

‎tests/api/test_ossl_cipher.c‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,34 @@ int test_wolfSSL_DES_ncbc(void)
203203
return EXPECT_RESULT();
204204
}
205205

206+
int test_wolfSSL_DES_ncbc_zero_length(void)
207+
{
208+
EXPECT_DECLS;
209+
#if defined(OPENSSL_EXTRA) && !defined(NO_DES3)
210+
const_DES_cblock myDes;
211+
DES_cblock iv;
212+
DES_cblock ivSaved;
213+
DES_key_schedule key = {0};
214+
unsigned char msg[DES_BLOCK_SIZE] = {0};
215+
unsigned char out[DES_BLOCK_SIZE] = {0};
216+
217+
DES_set_key(&key, &myDes);
218+
219+
/* length == 0 must no-op: the offset math would otherwise underflow
220+
* size_t and read from a wild pointer. */
221+
XMEMSET((byte*)&iv, 0xAB, DES_BLOCK_SIZE);
222+
XMEMCPY(&ivSaved, &iv, DES_BLOCK_SIZE);
223+
DES_ncbc_encrypt(msg, out, 0, &myDes, &iv, DES_ENCRYPT);
224+
ExpectIntEQ(XMEMCMP(&iv, &ivSaved, DES_BLOCK_SIZE), 0);
225+
226+
XMEMSET((byte*)&iv, 0xAB, DES_BLOCK_SIZE);
227+
XMEMCPY(&ivSaved, &iv, DES_BLOCK_SIZE);
228+
DES_ncbc_encrypt(msg, out, 0, &myDes, &iv, DES_DECRYPT);
229+
ExpectIntEQ(XMEMCMP(&iv, &ivSaved, DES_BLOCK_SIZE), 0);
230+
#endif
231+
return EXPECT_RESULT();
232+
}
233+
206234
int test_wolfSSL_DES_ecb_encrypt(void)
207235
{
208236
EXPECT_DECLS;

‎tests/api/test_ossl_cipher.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626

2727
int test_wolfSSL_DES(void);
2828
int test_wolfSSL_DES_ncbc(void);
29+
int test_wolfSSL_DES_ncbc_zero_length(void);
2930
int test_wolfSSL_DES_ecb_encrypt(void);
3031
int test_wolfSSL_DES_ede3_cbc_encrypt(void);
3132
int test_wolfSSL_AES_encrypt(void);
@@ -38,6 +39,7 @@ int test_wolfSSL_RC4(void);
3839
#define TEST_OSSL_CIPHER_DECLS \
3940
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES), \
4041
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES_ncbc), \
42+
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES_ncbc_zero_length), \
4143
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES_ecb_encrypt), \
4244
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES_ede3_cbc_encrypt), \
4345
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_AES_encrypt), \

‎tests/api/test_tls13.c‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5254,3 +5254,47 @@ int test_tls13_serverhello_bad_cipher_suites(void)
52545254
#endif
52555255
return EXPECT_RESULT();
52565256
}
5257+
5258+
int test_tls13_cipher_list_on_tls12_ctx(void)
5259+
{
5260+
EXPECT_DECLS;
5261+
#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_TLS13) && \
5262+
!defined(WOLFSSL_NO_TLS12) && !defined(NO_WOLFSSL_CLIENT)
5263+
WOLFSSL_CTX* ctx = NULL;
5264+
5265+
/* A TLS 1.3-only cipher list on a TLS 1.2 context must fail rather
5266+
* than silently succeed while leaving default suites active. */
5267+
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method()));
5268+
ExpectIntEQ(wolfSSL_CTX_set_cipher_list(ctx, "TLS_AES_128_GCM_SHA256"),
5269+
WOLFSSL_FAILURE);
5270+
5271+
wolfSSL_CTX_free(ctx);
5272+
#endif
5273+
return EXPECT_RESULT();
5274+
}
5275+
5276+
int test_tls13_clear_preserves_psk_dhe(void)
5277+
{
5278+
EXPECT_DECLS;
5279+
#if (defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)) && \
5280+
defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) && \
5281+
(defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)) && \
5282+
!defined(NO_WOLFSSL_CLIENT)
5283+
WOLFSSL_CTX* ctx = NULL;
5284+
WOLFSSL* ssl = NULL;
5285+
5286+
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
5287+
ExpectIntEQ(wolfSSL_CTX_no_dhe_psk(ctx), 0);
5288+
ExpectNotNull(ssl = wolfSSL_new(ctx));
5289+
ExpectIntEQ(ssl->options.noPskDheKe, 1);
5290+
5291+
/* SSL reuse must preserve the CTX-level noPskDheKe; resetting to 0
5292+
* would silently re-enable psk_dhe_ke for the next handshake. */
5293+
ExpectIntEQ(wolfSSL_clear(ssl), WOLFSSL_SUCCESS);
5294+
ExpectIntEQ(ssl->options.noPskDheKe, 1);
5295+
5296+
wolfSSL_free(ssl);
5297+
wolfSSL_CTX_free(ctx);
5298+
#endif
5299+
return EXPECT_RESULT();
5300+
}

‎tests/api/test_tls13.h‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ int test_tls13_cert_with_extern_psk_requires_key_share(void);
6060
int test_tls13_cert_with_extern_psk_rejects_resumption(void);
6161
int test_tls13_cert_with_extern_psk_sh_missing_key_share(void);
6262
int test_tls13_cert_with_extern_psk_sh_confirms_resumption(void);
63+
int test_tls13_cipher_list_on_tls12_ctx(void);
64+
int test_tls13_clear_preserves_psk_dhe(void);
6365

6466
#define TEST_TLS13_DECLS \
6567
TEST_DECL_GROUP("tls13", test_tls13_apis), \
@@ -97,6 +99,8 @@ int test_tls13_cert_with_extern_psk_sh_confirms_resumption(void);
9799
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_requires_key_share), \
98100
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_rejects_resumption), \
99101
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_sh_missing_key_share), \
100-
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_sh_confirms_resumption)
102+
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_sh_confirms_resumption), \
103+
TEST_DECL_GROUP("tls13", test_tls13_cipher_list_on_tls12_ctx), \
104+
TEST_DECL_GROUP("tls13", test_tls13_clear_preserves_psk_dhe)
101105

102106
#endif /* WOLFCRYPT_TEST_TLS13_H */

‎tests/api/test_tls_ext.c‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -609,3 +609,54 @@ int test_TLSX_SNI_GetSize_overflow(void)
609609
#endif
610610
return EXPECT_RESULT();
611611
}
612+
613+
/* ECH is only valid in ClientHello, EncryptedExtensions, or
614+
* HelloRetryRequest per RFC 9460. Feeding it in a Certificate message must
615+
* be rejected with EXT_NOT_ALLOWED rather than being silently accepted. */
616+
int test_TLSX_ECH_msg_type_validation(void)
617+
{
618+
EXPECT_DECLS;
619+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) && \
620+
!defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
621+
WOLFSSL_CTX* ctx = NULL;
622+
WOLFSSL* ssl = NULL;
623+
/* type = TLSX_ECH (0xfe0d), size = 0x0000 */
624+
const byte extBytes[] = { 0xfe, 0x0d, 0x00, 0x00 };
625+
626+
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
627+
ExpectNotNull(ssl = wolfSSL_new(ctx));
628+
629+
ExpectIntEQ(TLSX_Parse(ssl, extBytes, (word16)sizeof(extBytes),
630+
certificate, NULL),
631+
WC_NO_ERR_TRACE(EXT_NOT_ALLOWED));
632+
633+
wolfSSL_free(ssl);
634+
wolfSSL_CTX_free(ctx);
635+
#endif
636+
return EXPECT_RESULT();
637+
}
638+
639+
/* use_srtp is only valid in ClientHello/ServerHello (pre-TLS 1.3) or
640+
* ClientHello/EncryptedExtensions (TLS 1.3) per RFC 5764. Feeding it in a
641+
* Certificate message must be rejected with EXT_NOT_ALLOWED. */
642+
int test_TLSX_SRTP_msg_type_validation(void)
643+
{
644+
EXPECT_DECLS;
645+
#if defined(WOLFSSL_SRTP) && !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
646+
WOLFSSL_CTX* ctx = NULL;
647+
WOLFSSL* ssl = NULL;
648+
/* type = TLSX_USE_SRTP (0x000e), size = 0x0000 */
649+
const byte extBytes[] = { 0x00, 0x0e, 0x00, 0x00 };
650+
651+
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));
652+
ExpectNotNull(ssl = wolfSSL_new(ctx));
653+
654+
ExpectIntEQ(TLSX_Parse(ssl, extBytes, (word16)sizeof(extBytes),
655+
certificate, NULL),
656+
WC_NO_ERR_TRACE(EXT_NOT_ALLOWED));
657+
658+
wolfSSL_free(ssl);
659+
wolfSSL_CTX_free(ctx);
660+
#endif
661+
return EXPECT_RESULT();
662+
}

‎tests/api/test_tls_ext.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,5 +28,7 @@ int test_certificate_authorities_certificate_request(void);
2828
int test_certificate_authorities_client_hello(void);
2929
int test_TLSX_TCA_Find(void);
3030
int test_TLSX_SNI_GetSize_overflow(void);
31+
int test_TLSX_ECH_msg_type_validation(void);
32+
int test_TLSX_SRTP_msg_type_validation(void);
3133

3234
#endif /* TESTS_API_TEST_TLS_EMS_H */

‎wolfssl/internal.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3208,7 +3208,7 @@ WOLFSSL_LOCAL int TLSX_ParseVersion(WOLFSSL* ssl, const byte* input,
32083208
WOLFSSL_LOCAL int TLSX_SupportedVersions_Parse(const WOLFSSL* ssl,
32093209
const byte* input, word16 length, byte msgType, ProtocolVersion* pv,
32103210
Options* opts, TLSX** exts);
3211-
WOLFSSL_LOCAL int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
3211+
WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
32123212
byte msgType, Suites *suites);
32133213
WOLFSSL_LOCAL int TLSX_Push(TLSX** list, TLSX_Type type,
32143214
const void* data, void* heap);

0 commit comments

Comments
 (0)