From 142fd3e3359fd805134b4048f2143781c3773800 Mon Sep 17 00:00:00 2001 From: jsing Date: Wed, 5 Jan 2022 09:59:39 +0000 Subject: [PATCH] Provide regress for SSL public APIs. This will largely test curly and inconsistent APIs that are not covered by other regress tests. Currently, this tests the wonder that is SSL_get_peer_cert_chain(). --- regress/lib/libssl/Makefile | 3 +- regress/lib/libssl/api/Makefile | 16 ++ regress/lib/libssl/api/apitest.c | 369 +++++++++++++++++++++++++++++++ 3 files changed, 387 insertions(+), 1 deletion(-) create mode 100644 regress/lib/libssl/api/Makefile create mode 100644 regress/lib/libssl/api/apitest.c diff --git a/regress/lib/libssl/Makefile b/regress/lib/libssl/Makefile index ff06e0b0ba1..1b852968f2f 100644 --- a/regress/lib/libssl/Makefile +++ b/regress/lib/libssl/Makefile @@ -1,5 +1,6 @@ -# $OpenBSD: Makefile,v 1.47 2021/10/23 14:34:10 jsing Exp $ +# $OpenBSD: Makefile,v 1.48 2022/01/05 09:59:39 jsing Exp $ +SUBDIR += api SUBDIR += asn1 SUBDIR += buffer SUBDIR += bytestring diff --git a/regress/lib/libssl/api/Makefile b/regress/lib/libssl/api/Makefile new file mode 100644 index 00000000000..0989fc22643 --- /dev/null +++ b/regress/lib/libssl/api/Makefile @@ -0,0 +1,16 @@ +# $OpenBSD: Makefile,v 1.1 2022/01/05 09:59:39 jsing Exp $ + +PROG= apitest +LDADD= -lssl -lcrypto +DPADD= ${LIBSSL} ${LIBCRYPTO} +WARNINGS= Yes +CFLAGS+= -DLIBRESSL_INTERNAL -Werror + +REGRESS_TARGETS= \ + regress-apitest + +regress-apitest: ${PROG} + ./apitest \ + ${.CURDIR}/../../libssl/certs + +.include diff --git a/regress/lib/libssl/api/apitest.c b/regress/lib/libssl/api/apitest.c new file mode 100644 index 00000000000..b5a5c544e2f --- /dev/null +++ b/regress/lib/libssl/api/apitest.c @@ -0,0 +1,369 @@ +/* $OpenBSD: apitest.c,v 1.1 2022/01/05 09:59:39 jsing Exp $ */ +/* + * Copyright (c) 2020, 2021 Joel Sing + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include + +#include +#include +#include + +const char *certs_path; + +int debug = 0; + +static int +ssl_ctx_use_ca_file(SSL_CTX *ssl_ctx, const char *ca_file) +{ + char *ca_path = NULL; + int ret = 0; + + if (asprintf(&ca_path, "%s/%s", certs_path, ca_file) == -1) + goto err; + if (!SSL_CTX_load_verify_locations(ssl_ctx, ca_path, NULL)) { + fprintf(stderr, "load_verify_locations(%s) failed\n", ca_path); + goto err; + } + + ret = 1; + + err: + free(ca_path); + + return ret; +} + +static int +ssl_ctx_use_keypair(SSL_CTX *ssl_ctx, const char *chain_file, + const char *key_file) +{ + char *chain_path = NULL, *key_path = NULL; + int ret = 0; + + if (asprintf(&chain_path, "%s/%s", certs_path, chain_file) == -1) + goto err; + if (SSL_CTX_use_certificate_chain_file(ssl_ctx, chain_path) != 1) { + fprintf(stderr, "FAIL: Failed to load certificates\n"); + goto err; + } + if (asprintf(&key_path, "%s/%s", certs_path, key_file) == -1) + goto err; + if (SSL_CTX_use_PrivateKey_file(ssl_ctx, key_path, + SSL_FILETYPE_PEM) != 1) { + fprintf(stderr, "FAIL: Failed to load private key\n"); + goto err; + } + + ret = 1; + + err: + free(chain_path); + free(key_path); + + return ret; +} + +static SSL * +tls_client(BIO *rbio, BIO *wbio) +{ + SSL_CTX *ssl_ctx = NULL; + SSL *ssl = NULL; + + if ((ssl_ctx = SSL_CTX_new(TLS_method())) == NULL) + errx(1, "client context"); + + SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL); + + if (!ssl_ctx_use_ca_file(ssl_ctx, "ca-root-rsa.pem")) + goto failure; + if (!ssl_ctx_use_keypair(ssl_ctx, "client1-rsa-chain.pem", + "client1-rsa.pem")) + goto failure; + + if ((ssl = SSL_new(ssl_ctx)) == NULL) + errx(1, "client ssl"); + + BIO_up_ref(rbio); + BIO_up_ref(wbio); + + SSL_set_bio(ssl, rbio, wbio); + + failure: + SSL_CTX_free(ssl_ctx); + + return ssl; +} + +static SSL * +tls_server(BIO *rbio, BIO *wbio) +{ + SSL_CTX *ssl_ctx = NULL; + SSL *ssl = NULL; + + if ((ssl_ctx = SSL_CTX_new(TLS_method())) == NULL) + errx(1, "server context"); + + SSL_CTX_set_dh_auto(ssl_ctx, 2); + + SSL_CTX_set_verify(ssl_ctx, + SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL); + + if (!ssl_ctx_use_ca_file(ssl_ctx, "ca-root-rsa.pem")) + goto failure; + if (!ssl_ctx_use_keypair(ssl_ctx, "server1-rsa-chain.pem", + "server1-rsa.pem")) + goto failure; + + if ((ssl = SSL_new(ssl_ctx)) == NULL) + errx(1, "server ssl"); + + BIO_up_ref(rbio); + BIO_up_ref(wbio); + + SSL_set_bio(ssl, rbio, wbio); + + failure: + SSL_CTX_free(ssl_ctx); + + return ssl; +} + +static int +ssl_error(SSL *ssl, const char *name, const char *desc, int ssl_ret) +{ + int ssl_err; + + ssl_err = SSL_get_error(ssl, ssl_ret); + + if (ssl_err == SSL_ERROR_WANT_READ) { + return 1; + } else if (ssl_err == SSL_ERROR_WANT_WRITE) { + return 1; + } else if (ssl_err == SSL_ERROR_SYSCALL && errno == 0) { + /* Yup, this is apparently a thing... */ + } else { + fprintf(stderr, "FAIL: %s %s failed - ssl err = %d, errno = %d\n", + name, desc, ssl_err, errno); + ERR_print_errors_fp(stderr); + return 0; + } + + return 1; +} + +static int +do_connect(SSL *ssl, const char *name, int *done) +{ + int ssl_ret; + + if ((ssl_ret = SSL_connect(ssl)) == 1) { + fprintf(stderr, "INFO: %s connect done\n", name); + *done = 1; + return 1; + } + + return ssl_error(ssl, name, "connect", ssl_ret); +} + +static int +do_accept(SSL *ssl, const char *name, int *done) +{ + int ssl_ret; + + if ((ssl_ret = SSL_accept(ssl)) == 1) { + fprintf(stderr, "INFO: %s accept done\n", name); + *done = 1; + return 1; + } + + return ssl_error(ssl, name, "accept", ssl_ret); +} + +typedef int (*ssl_func)(SSL *ssl, const char *name, int *done); + +static int +do_client_server_loop(SSL *client, ssl_func client_func, SSL *server, + ssl_func server_func) +{ + int client_done = 0, server_done = 0; + int i = 0; + + do { + if (!client_done) { + if (debug) + fprintf(stderr, "DEBUG: client loop\n"); + if (!client_func(client, "client", &client_done)) + return 0; + } + if (!server_done) { + if (debug) + fprintf(stderr, "DEBUG: server loop\n"); + if (!server_func(server, "server", &server_done)) + return 0; + } + } while (i++ < 100 && (!client_done || !server_done)); + + if (!client_done || !server_done) + fprintf(stderr, "FAIL: gave up\n"); + + return client_done && server_done; +} + +static int +ssl_get_peer_cert_chain_test(uint16_t tls_version) +{ + STACK_OF(X509) *peer_chain; + X509 *peer_cert; + BIO *client_wbio = NULL, *server_wbio = NULL; + SSL *client = NULL, *server = NULL; + int failed = 1; + + if ((client_wbio = BIO_new(BIO_s_mem())) == NULL) + goto failure; + if (BIO_set_mem_eof_return(client_wbio, -1) <= 0) + goto failure; + + if ((server_wbio = BIO_new(BIO_s_mem())) == NULL) + goto failure; + if (BIO_set_mem_eof_return(server_wbio, -1) <= 0) + goto failure; + + if ((client = tls_client(server_wbio, client_wbio)) == NULL) + goto failure; + if (tls_version != 0) { + if (!SSL_set_min_proto_version(client, tls_version)) + goto failure; + if (!SSL_set_max_proto_version(client, tls_version)) + goto failure; + } + + if ((server = tls_server(client_wbio, server_wbio)) == NULL) + goto failure; + if (tls_version != 0) { + if (!SSL_set_min_proto_version(server, tls_version)) + goto failure; + if (!SSL_set_max_proto_version(server, tls_version)) + goto failure; + } + + if (!do_client_server_loop(client, do_connect, server, do_accept)) { + fprintf(stderr, "FAIL: client and server handshake failed\n"); + goto failure; + } + + if (tls_version != 0) { + if (SSL_version(client) != tls_version) { + fprintf(stderr, "FAIL: client got TLS version %x, " + "want %x\n", SSL_version(client), tls_version); + goto failure; + } + if (SSL_version(server) != tls_version) { + fprintf(stderr, "FAIL: server got TLS version %x, " + "want %x\n", SSL_version(server), tls_version); + goto failure; + } + } + + /* + * Due to the wonders of API inconsistency, SSL_get_peer_cert_chain() + * includes the peer's leaf certificate when called by the client, + * however it does not when called by the server. Futhermore, the + * certificate returned by SSL_get_peer_certificate() has already + * had its reference count incremented and must be freed, where as + * the certificates returned from SSL_get_peer_cert_chain() must + * not be freed... *sigh* + */ + peer_cert = SSL_get_peer_certificate(client); + peer_chain = SSL_get_peer_cert_chain(client); + X509_free(peer_cert); + + if (peer_cert == NULL) { + fprintf(stderr, "FAIL: client got no peer cert\n"); + goto failure; + } + if (sk_X509_num(peer_chain) != 2) { + fprintf(stderr, "FAIL: client got peer cert chain with %d " + "certificates, want 2\n", sk_X509_num(peer_chain)); + goto failure; + } + if (X509_cmp(peer_cert, sk_X509_value(peer_chain, 0)) != 0) { + fprintf(stderr, "FAIL: client got peer cert chain without peer " + "certificate\n"); + goto failure; + } + + peer_cert = SSL_get_peer_certificate(server); + peer_chain = SSL_get_peer_cert_chain(server); + X509_free(peer_cert); + + if (peer_cert == NULL) { + fprintf(stderr, "FAIL: server got no peer cert\n"); + goto failure; + } + if (sk_X509_num(peer_chain) != 1) { + fprintf(stderr, "FAIL: server got peer cert chain with %d " + "certificates, want 1\n", sk_X509_num(peer_chain)); + goto failure; + } + if (X509_cmp(peer_cert, sk_X509_value(peer_chain, 0)) == 0) { + fprintf(stderr, "FAIL: server got peer cert chain with peer " + "certificate\n"); + goto failure; + } + + fprintf(stderr, "INFO: Done!\n"); + + failed = 0; + + failure: + BIO_free(client_wbio); + BIO_free(server_wbio); + + SSL_free(client); + SSL_free(server); + + return failed; +} + +static int +ssl_get_peer_cert_chain_tests(void) +{ + int failed = 0; + + fprintf(stderr, "\n== Testing SSL_get_peer_cert_chain()... ==\n"); + + failed |= ssl_get_peer_cert_chain_test(0); + failed |= ssl_get_peer_cert_chain_test(TLS1_3_VERSION); + failed |= ssl_get_peer_cert_chain_test(TLS1_2_VERSION); + + return failed; +} + +int +main(int argc, char **argv) +{ + int failed = 0; + + if (argc != 2) { + fprintf(stderr, "usage: %s certspath\n", argv[0]); + exit(1); + } + certs_path = argv[1]; + + failed |= ssl_get_peer_cert_chain_tests(); + + return failed; +} -- 2.20.1