Skip to content

Commit 10ef2af

Browse files
JeremiahM37JeremiahM37
committed
tests
1 parent 9a176b2 commit 10ef2af

9 files changed

Lines changed: 120 additions & 4 deletions

File tree

‎src/tls.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17211,8 +17211,8 @@ static word16 TLSX_GetMinSize_Server(const word16 *type)
1721117211

1721217212

1721317213
/** Parses a buffer of TLS extensions. */
17214-
int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length, byte msgType,
17215-
Suites *suites)
17214+
WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
17215+
byte msgType, Suites *suites)
1721617216
{
1721717217
int ret = 0;
1721817218
word16 offset = 0;

‎tests/api.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39692,6 +39692,8 @@ TEST_CASE testCases[] = {
3969239692
TEST_DECL(test_certificate_authorities_client_hello),
3969339693
TEST_DECL(test_TLSX_TCA_Find),
3969439694
TEST_DECL(test_TLSX_SNI_GetSize_overflow),
39695+
TEST_DECL(test_TLSX_ECH_msg_type_validation),
39696+
TEST_DECL(test_TLSX_SRTP_msg_type_validation),
3969539697
TEST_DECL(test_wolfSSL_wolfSSL_UseSecureRenegotiation),
3969639698
TEST_DECL(test_wolfSSL_clear_secure_renegotiation),
3969739699
TEST_DECL(test_wolfSSL_SCR_Reconnect),

‎tests/api/test_ossl_cipher.c‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,34 @@ int test_wolfSSL_DES_ncbc(void)
203203
return EXPECT_RESULT();
204204
}
205205

206+
int test_wolfSSL_DES_ncbc_zero_length(void)
207+
{
208+
EXPECT_DECLS;
209+
#if defined(OPENSSL_EXTRA) && !defined(NO_DES3)
210+
const_DES_cblock myDes;
211+
DES_cblock iv;
212+
DES_cblock ivSaved;
213+
DES_key_schedule key = {0};
214+
unsigned char msg[DES_BLOCK_SIZE] = {0};
215+
unsigned char out[DES_BLOCK_SIZE] = {0};
216+
217+
DES_set_key(&key, &myDes);
218+
219+
/* length == 0 must no-op: the offset math would otherwise underflow
220+
* size_t and read from a wild pointer. */
221+
XMEMSET((byte*)&iv, 0xAB, DES_BLOCK_SIZE);
222+
XMEMCPY(&ivSaved, &iv, DES_BLOCK_SIZE);
223+
DES_ncbc_encrypt(msg, out, 0, &myDes, &iv, DES_ENCRYPT);
224+
ExpectIntEQ(XMEMCMP(&iv, &ivSaved, DES_BLOCK_SIZE), 0);
225+
226+
XMEMSET((byte*)&iv, 0xAB, DES_BLOCK_SIZE);
227+
XMEMCPY(&ivSaved, &iv, DES_BLOCK_SIZE);
228+
DES_ncbc_encrypt(msg, out, 0, &myDes, &iv, DES_DECRYPT);
229+
ExpectIntEQ(XMEMCMP(&iv, &ivSaved, DES_BLOCK_SIZE), 0);
230+
#endif
231+
return EXPECT_RESULT();
232+
}
233+
206234
int test_wolfSSL_DES_ecb_encrypt(void)
207235
{
208236
EXPECT_DECLS;

‎tests/api/test_ossl_cipher.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626

2727
int test_wolfSSL_DES(void);
2828
int test_wolfSSL_DES_ncbc(void);
29+
int test_wolfSSL_DES_ncbc_zero_length(void);
2930
int test_wolfSSL_DES_ecb_encrypt(void);
3031
int test_wolfSSL_DES_ede3_cbc_encrypt(void);
3132
int test_wolfSSL_AES_encrypt(void);
@@ -38,6 +39,7 @@ int test_wolfSSL_RC4(void);
3839
#define TEST_OSSL_CIPHER_DECLS \
3940
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES), \
4041
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES_ncbc), \
42+
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES_ncbc_zero_length), \
4143
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES_ecb_encrypt), \
4244
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_DES_ede3_cbc_encrypt), \
4345
TEST_DECL_GROUP("ossl_cipher", test_wolfSSL_AES_encrypt), \

‎tests/api/test_tls13.c‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5732,3 +5732,29 @@ int test_tls13_serverhello_bad_cipher_suites(void)
57325732
#endif
57335733
return EXPECT_RESULT();
57345734
}
5735+
5736+
int test_tls13_clear_preserves_psk_dhe(void)
5737+
{
5738+
EXPECT_DECLS;
5739+
#if (defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)) && \
5740+
defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) && \
5741+
(defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)) && \
5742+
!defined(NO_WOLFSSL_CLIENT)
5743+
WOLFSSL_CTX* ctx = NULL;
5744+
WOLFSSL* ssl = NULL;
5745+
5746+
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
5747+
ExpectIntEQ(wolfSSL_CTX_no_dhe_psk(ctx), 0);
5748+
ExpectNotNull(ssl = wolfSSL_new(ctx));
5749+
ExpectIntEQ(ssl->options.noPskDheKe, 1);
5750+
5751+
/* SSL reuse must preserve the CTX-level noPskDheKe; resetting to 0
5752+
* would silently re-enable psk_dhe_ke for the next handshake. */
5753+
ExpectIntEQ(wolfSSL_clear(ssl), WOLFSSL_SUCCESS);
5754+
ExpectIntEQ(ssl->options.noPskDheKe, 1);
5755+
5756+
wolfSSL_free(ssl);
5757+
wolfSSL_CTX_free(ctx);
5758+
#endif
5759+
return EXPECT_RESULT();
5760+
}

‎tests/api/test_tls13.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ int test_tls13_cert_with_extern_psk_requires_key_share(void);
6666
int test_tls13_cert_with_extern_psk_rejects_resumption(void);
6767
int test_tls13_cert_with_extern_psk_sh_missing_key_share(void);
6868
int test_tls13_cert_with_extern_psk_sh_confirms_resumption(void);
69+
int test_tls13_clear_preserves_psk_dhe(void);
6970

7071
#define TEST_TLS13_DECLS \
7172
TEST_DECL_GROUP("tls13", test_tls13_apis), \
@@ -109,6 +110,7 @@ int test_tls13_cert_with_extern_psk_sh_confirms_resumption(void);
109110
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_requires_key_share), \
110111
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_rejects_resumption), \
111112
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_sh_missing_key_share), \
112-
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_sh_confirms_resumption)
113+
TEST_DECL_GROUP("tls13", test_tls13_cert_with_extern_psk_sh_confirms_resumption), \
114+
TEST_DECL_GROUP("tls13", test_tls13_clear_preserves_psk_dhe)
113115

114116
#endif /* WOLFCRYPT_TEST_TLS13_H */

‎tests/api/test_tls_ext.c‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -982,3 +982,54 @@ int test_TLSX_SNI_GetSize_overflow(void)
982982
#endif
983983
return EXPECT_RESULT();
984984
}
985+
986+
/* ECH is only valid in ClientHello, EncryptedExtensions, or
987+
* HelloRetryRequest per RFC 9460. Feeding it in a Finished message must
988+
* be rejected with EXT_NOT_ALLOWED rather than being silently accepted. */
989+
int test_TLSX_ECH_msg_type_validation(void)
990+
{
991+
EXPECT_DECLS;
992+
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) && \
993+
!defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
994+
WOLFSSL_CTX* ctx = NULL;
995+
WOLFSSL* ssl = NULL;
996+
/* type = TLSX_ECH (0xfe0d), size = 0x0000 */
997+
const byte extBytes[] = { 0xfe, 0x0d, 0x00, 0x00 };
998+
999+
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1000+
ExpectNotNull(ssl = wolfSSL_new(ctx));
1001+
1002+
ExpectIntEQ(TLSX_Parse(ssl, extBytes, (word16)sizeof(extBytes),
1003+
finished, NULL),
1004+
WC_NO_ERR_TRACE(EXT_NOT_ALLOWED));
1005+
1006+
wolfSSL_free(ssl);
1007+
wolfSSL_CTX_free(ctx);
1008+
#endif
1009+
return EXPECT_RESULT();
1010+
}
1011+
1012+
/* use_srtp is only valid in ClientHello/ServerHello (pre-TLS 1.3) or
1013+
* ClientHello/EncryptedExtensions (TLS 1.3) per RFC 5764. Feeding it in a
1014+
* Finished message must be rejected with EXT_NOT_ALLOWED. */
1015+
int test_TLSX_SRTP_msg_type_validation(void)
1016+
{
1017+
EXPECT_DECLS;
1018+
#if defined(WOLFSSL_SRTP) && !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
1019+
WOLFSSL_CTX* ctx = NULL;
1020+
WOLFSSL* ssl = NULL;
1021+
/* type = TLSX_USE_SRTP (0x000e), size = 0x0000 */
1022+
const byte extBytes[] = { 0x00, 0x0e, 0x00, 0x00 };
1023+
1024+
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));
1025+
ExpectNotNull(ssl = wolfSSL_new(ctx));
1026+
1027+
ExpectIntEQ(TLSX_Parse(ssl, extBytes, (word16)sizeof(extBytes),
1028+
finished, NULL),
1029+
WC_NO_ERR_TRACE(EXT_NOT_ALLOWED));
1030+
1031+
wolfSSL_free(ssl);
1032+
wolfSSL_CTX_free(ctx);
1033+
#endif
1034+
return EXPECT_RESULT();
1035+
}

‎tests/api/test_tls_ext.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,7 @@ int test_certificate_authorities_certificate_request(void);
3434
int test_certificate_authorities_client_hello(void);
3535
int test_TLSX_TCA_Find(void);
3636
int test_TLSX_SNI_GetSize_overflow(void);
37+
int test_TLSX_ECH_msg_type_validation(void);
38+
int test_TLSX_SRTP_msg_type_validation(void);
3739

3840
#endif /* TESTS_API_TEST_TLS_EMS_H */

‎wolfssl/internal.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3231,7 +3231,10 @@ WOLFSSL_LOCAL int TLSX_ParseVersion(WOLFSSL* ssl, const byte* input,
32313231
WOLFSSL_LOCAL int TLSX_SupportedVersions_Parse(const WOLFSSL* ssl,
32323232
const byte* input, word16 length, byte msgType, ProtocolVersion* pv,
32333233
Options* opts, TLSX** exts);
3234-
WOLFSSL_LOCAL int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
3234+
#ifdef WOLFSSL_API_PREFIX_MAP
3235+
#define TLSX_Parse wolfSSL_TLSX_Parse
3236+
#endif
3237+
WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
32353238
byte msgType, Suites *suites);
32363239
WOLFSSL_LOCAL int TLSX_Push(TLSX** list, TLSX_Type type,
32373240
const void* data, void* heap);

0 commit comments

Comments
 (0)