ssl_agent_unittest.cc (10036B)
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ 2 /* vim: set ts=2 et sw=2 tw=80: */ 3 /* This Source Code Form is subject to the terms of the Mozilla Public 4 * License, v. 2.0. If a copy of the MPL was not distributed with this file, 5 * You can obtain one at http://mozilla.org/MPL/2.0/. */ 6 7 #include "ssl.h" 8 #include "sslerr.h" 9 #include "sslproto.h" 10 11 #include <memory> 12 13 #include "databuffer.h" 14 #include "tls_agent.h" 15 #include "tls_connect.h" 16 #include "tls_filter.h" 17 #include "tls_parser.h" 18 19 namespace nss_test { 20 21 // This is a 1-RTT ClientHello with ECDHE. 22 const static uint8_t kCannedTls13ClientHello[] = { 23 0x01, 0x00, 0x00, 0xcf, 0x03, 0x03, 0x6c, 0xb3, 0x46, 0x81, 0xc8, 0x1a, 24 0xf9, 0xd2, 0x05, 0x97, 0x48, 0x7c, 0xa8, 0x31, 0x03, 0x1c, 0x06, 0xa8, 25 0x62, 0xb1, 0x90, 0xd6, 0x21, 0x44, 0x7f, 0xc1, 0x9b, 0x87, 0x3e, 0xad, 26 0x91, 0x85, 0x00, 0x00, 0x06, 0x13, 0x01, 0x13, 0x03, 0x13, 0x02, 0x01, 27 0x00, 0x00, 0xa0, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x09, 0x00, 0x00, 0x06, 28 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 29 0x0a, 0x00, 0x12, 0x00, 0x10, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x01, 30 0x00, 0x01, 0x01, 0x01, 0x02, 0x01, 0x03, 0x01, 0x04, 0x00, 0x33, 0x00, 31 0x47, 0x00, 0x45, 0x00, 0x17, 0x00, 0x41, 0x04, 0x86, 0x4a, 0xb9, 0xdc, 32 0x6a, 0x38, 0xa7, 0xce, 0xe7, 0xc2, 0x4f, 0xa6, 0x28, 0xb9, 0xdc, 0x65, 33 0xbf, 0x73, 0x47, 0x3c, 0x9c, 0x65, 0x8c, 0x47, 0x6d, 0x57, 0x22, 0x8a, 34 0xc2, 0xb3, 0xc6, 0x80, 0x72, 0x86, 0x08, 0x86, 0x8f, 0x52, 0xc5, 0xcb, 35 0xbf, 0x2a, 0xb5, 0x59, 0x64, 0xcc, 0x0c, 0x49, 0x95, 0x36, 0xe4, 0xd9, 36 0x2f, 0xd4, 0x24, 0x66, 0x71, 0x6f, 0x5d, 0x70, 0xe2, 0xa0, 0xea, 0x26, 37 0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04, 0x00, 0x0d, 0x00, 0x20, 0x00, 38 0x1e, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02, 0x03, 0x08, 0x04, 0x08, 39 0x05, 0x08, 0x06, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02, 0x01, 0x04, 40 0x02, 0x05, 0x02, 0x06, 0x02, 0x02, 0x02}; 41 static const size_t kFirstFragmentSize = 20; 42 static const char *k0RttData = "ABCDEF"; 43 44 TEST_P(TlsAgentTest, EarlyFinished) { 45 DataBuffer buffer; 46 MakeTrivialHandshakeRecord(kTlsHandshakeFinished, 0, &buffer); 47 ExpectAlert(kTlsAlertUnexpectedMessage); 48 ProcessMessage(buffer, TlsAgent::STATE_ERROR, 49 SSL_ERROR_RX_UNEXPECTED_FINISHED); 50 } 51 52 TEST_P(TlsAgentTest, EarlyCertificateVerify) { 53 DataBuffer buffer; 54 MakeTrivialHandshakeRecord(kTlsHandshakeCertificateVerify, 0, &buffer); 55 ExpectAlert(kTlsAlertUnexpectedMessage); 56 ProcessMessage(buffer, TlsAgent::STATE_ERROR, 57 SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY); 58 } 59 60 TEST_P(TlsAgentTestClient13, CannedHello) { 61 DataBuffer buffer; 62 EnsureInit(); 63 DataBuffer server_hello; 64 auto sh = MakeCannedTls13ServerHello(); 65 MakeHandshakeMessage(kTlsHandshakeServerHello, sh.data(), sh.len(), 66 &server_hello); 67 MakeRecord(ssl_ct_handshake, SSL_LIBRARY_VERSION_TLS_1_3, server_hello.data(), 68 server_hello.len(), &buffer); 69 ProcessMessage(buffer, TlsAgent::STATE_CONNECTING); 70 } 71 72 TEST_P(TlsAgentTestClient13, EncryptedExtensionsInClear) { 73 DataBuffer server_hello; 74 auto sh = MakeCannedTls13ServerHello(); 75 MakeHandshakeMessage(kTlsHandshakeServerHello, sh.data(), sh.len(), 76 &server_hello); 77 DataBuffer encrypted_extensions; 78 MakeHandshakeMessage(kTlsHandshakeEncryptedExtensions, nullptr, 0, 79 &encrypted_extensions, 1); 80 server_hello.Append(encrypted_extensions); 81 DataBuffer buffer; 82 MakeRecord(ssl_ct_handshake, SSL_LIBRARY_VERSION_TLS_1_3, server_hello.data(), 83 server_hello.len(), &buffer); 84 EnsureInit(); 85 ExpectAlert(kTlsAlertUnexpectedMessage); 86 ProcessMessage(buffer, TlsAgent::STATE_ERROR, 87 SSL_ERROR_RX_UNEXPECTED_HANDSHAKE); 88 } 89 90 TEST_F(TlsAgentStreamTestClient, EncryptedExtensionsInClearTwoPieces) { 91 DataBuffer server_hello; 92 auto sh = MakeCannedTls13ServerHello(); 93 MakeHandshakeMessage(kTlsHandshakeServerHello, sh.data(), sh.len(), 94 &server_hello); 95 DataBuffer encrypted_extensions; 96 MakeHandshakeMessage(kTlsHandshakeEncryptedExtensions, nullptr, 0, 97 &encrypted_extensions, 1); 98 server_hello.Append(encrypted_extensions); 99 DataBuffer buffer; 100 MakeRecord(ssl_ct_handshake, SSL_LIBRARY_VERSION_TLS_1_3, server_hello.data(), 101 kFirstFragmentSize, &buffer); 102 103 DataBuffer buffer2; 104 MakeRecord(ssl_ct_handshake, SSL_LIBRARY_VERSION_TLS_1_3, 105 server_hello.data() + kFirstFragmentSize, 106 server_hello.len() - kFirstFragmentSize, &buffer2); 107 108 EnsureInit(); 109 agent_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_3, 110 SSL_LIBRARY_VERSION_TLS_1_3); 111 ProcessMessage(buffer, TlsAgent::STATE_CONNECTING); 112 ExpectAlert(kTlsAlertUnexpectedMessage); 113 ProcessMessage(buffer2, TlsAgent::STATE_ERROR, 114 SSL_ERROR_RX_UNEXPECTED_HANDSHAKE); 115 } 116 117 TEST_F(TlsAgentDgramTestClient, EncryptedExtensionsInClearTwoPieces) { 118 auto sh = MakeCannedTls13ServerHello(); 119 DataBuffer server_hello_frag1; 120 MakeHandshakeMessageFragment(kTlsHandshakeServerHello, sh.data(), sh.len(), 121 &server_hello_frag1, 0, 0, kFirstFragmentSize); 122 DataBuffer server_hello_frag2; 123 MakeHandshakeMessageFragment(kTlsHandshakeServerHello, 124 sh.data() + kFirstFragmentSize, sh.len(), 125 &server_hello_frag2, 0, kFirstFragmentSize, 126 sh.len() - kFirstFragmentSize); 127 DataBuffer encrypted_extensions; 128 MakeHandshakeMessage(kTlsHandshakeEncryptedExtensions, nullptr, 0, 129 &encrypted_extensions, 1); 130 server_hello_frag2.Append(encrypted_extensions); 131 DataBuffer buffer; 132 MakeRecord(ssl_ct_handshake, SSL_LIBRARY_VERSION_TLS_1_3, 133 server_hello_frag1.data(), server_hello_frag1.len(), &buffer); 134 135 DataBuffer buffer2; 136 MakeRecord(ssl_ct_handshake, SSL_LIBRARY_VERSION_TLS_1_3, 137 server_hello_frag2.data(), server_hello_frag2.len(), &buffer2, 1); 138 139 EnsureInit(); 140 agent_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_3, 141 SSL_LIBRARY_VERSION_TLS_1_3); 142 ProcessMessage(buffer, TlsAgent::STATE_CONNECTING); 143 ExpectAlert(kTlsAlertUnexpectedMessage); 144 ProcessMessage(buffer2, TlsAgent::STATE_ERROR, 145 SSL_ERROR_RX_UNEXPECTED_HANDSHAKE); 146 } 147 148 TEST_F(TlsAgentDgramTestClient, AckWithBogusLengthField) { 149 EnsureInit(); 150 // Length doesn't match 151 const uint8_t ackBuf[] = {0x00, 0x08, 0x00}; 152 DataBuffer record; 153 MakeRecord(variant_, ssl_ct_ack, SSL_LIBRARY_VERSION_TLS_1_2, ackBuf, 154 sizeof(ackBuf), &record, 0); 155 agent_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_3, 156 SSL_LIBRARY_VERSION_TLS_1_3); 157 ProcessMessage(record, TlsAgent::STATE_ERROR, 158 SSL_ERROR_RX_MALFORMED_DTLS_ACK); 159 } 160 161 TEST_F(TlsAgentDgramTestClient, AckWithNonEvenLength) { 162 EnsureInit(); 163 // Length isn't a multiple of 8 164 const uint8_t ackBuf[] = {0x00, 0x01, 0x00}; 165 DataBuffer record; 166 MakeRecord(variant_, ssl_ct_ack, SSL_LIBRARY_VERSION_TLS_1_2, ackBuf, 167 sizeof(ackBuf), &record, 0); 168 agent_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_3, 169 SSL_LIBRARY_VERSION_TLS_1_3); 170 // Because we haven't negotiated the version, 171 // ssl3_DecodeError() sends an older (pre-TLS error). 172 ExpectAlert(kTlsAlertIllegalParameter); 173 ProcessMessage(record, TlsAgent::STATE_ERROR, 174 SSL_ERROR_RX_MALFORMED_DTLS_ACK); 175 } 176 177 TEST_F(TlsAgentStreamTestClient, Set0RttOptionThenWrite) { 178 EnsureInit(); 179 agent_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1, 180 SSL_LIBRARY_VERSION_TLS_1_3); 181 agent_->StartConnect(); 182 agent_->Set0RttEnabled(true); 183 auto filter = 184 MakeTlsFilter<TlsHandshakeRecorder>(agent_, kTlsHandshakeClientHello); 185 PRInt32 rv = PR_Write(agent_->ssl_fd(), k0RttData, strlen(k0RttData)); 186 EXPECT_EQ(-1, rv); 187 int32_t err = PORT_GetError(); 188 EXPECT_EQ(PR_WOULD_BLOCK_ERROR, err); 189 EXPECT_LT(0UL, filter->buffer().len()); 190 } 191 192 TEST_F(TlsAgentStreamTestClient, Set0RttOptionThenRead) { 193 EnsureInit(); 194 agent_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1, 195 SSL_LIBRARY_VERSION_TLS_1_3); 196 agent_->StartConnect(); 197 agent_->Set0RttEnabled(true); 198 DataBuffer buffer; 199 MakeRecord(ssl_ct_application_data, SSL_LIBRARY_VERSION_TLS_1_3, 200 reinterpret_cast<const uint8_t *>(k0RttData), strlen(k0RttData), 201 &buffer); 202 ExpectAlert(kTlsAlertUnexpectedMessage); 203 ProcessMessage(buffer, TlsAgent::STATE_ERROR, 204 SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA); 205 } 206 207 // The server is allowing 0-RTT but the client doesn't offer it, 208 // so trial decryption isn't engaged and 0-RTT messages cause 209 // an error. 210 TEST_F(TlsAgentStreamTestServer, Set0RttOptionClientHelloThenRead) { 211 EnsureInit(); 212 agent_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1, 213 SSL_LIBRARY_VERSION_TLS_1_3); 214 agent_->StartConnect(); 215 agent_->Set0RttEnabled(true); 216 DataBuffer buffer; 217 MakeRecord(ssl_ct_handshake, SSL_LIBRARY_VERSION_TLS_1_3, 218 kCannedTls13ClientHello, sizeof(kCannedTls13ClientHello), &buffer); 219 ProcessMessage(buffer, TlsAgent::STATE_CONNECTING); 220 MakeRecord(ssl_ct_application_data, SSL_LIBRARY_VERSION_TLS_1_3, 221 reinterpret_cast<const uint8_t *>(k0RttData), strlen(k0RttData), 222 &buffer); 223 ExpectAlert(kTlsAlertBadRecordMac); 224 ProcessMessage(buffer, TlsAgent::STATE_ERROR, SSL_ERROR_BAD_MAC_READ); 225 } 226 227 INSTANTIATE_TEST_SUITE_P( 228 AgentTests, TlsAgentTest, 229 ::testing::Combine(TlsAgentTestBase::kTlsRolesAll, 230 TlsConnectTestBase::kTlsVariantsStream, 231 TlsConnectTestBase::kTlsVAll)); 232 INSTANTIATE_TEST_SUITE_P(ClientTests13, TlsAgentTestClient13, 233 ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll, 234 TlsConnectTestBase::kTlsV13)); 235 } // namespace nss_test