[ tor-browser ].git.dasho

ssl_extension_unittest.cc (54306B)
      1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
      2 /* vim: set ts=2 et sw=2 tw=80: */
      3 /* This Source Code Form is subject to the terms of the Mozilla Public
      4 * License, v. 2.0. If a copy of the MPL was not distributed with this file,
      5 * You can obtain one at http://mozilla.org/MPL/2.0/. */
      6 
      7 #include "ssl.h"
      8 #include "ssl3prot.h"
      9 #include "sslerr.h"
     10 #include "sslproto.h"
     11 
     12 #include <memory>
     13 
     14 #include "tls_connect.h"
     15 #include "tls_filter.h"
     16 #include "tls_parser.h"
     17 
     18 namespace nss_test {
     19 
     20 class Dtls13LegacyCookieInjector : public TlsHandshakeFilter {
     21 public:
     22  Dtls13LegacyCookieInjector(const std::shared_ptr<TlsAgent>& a)
     23      : TlsHandshakeFilter(a, {kTlsHandshakeClientHello}) {}
     24 
     25  virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
     26                                               const DataBuffer& input,
     27                                               DataBuffer* output) {
     28    const uint8_t cookie_bytes[] = {0x03, 0x0A, 0x0B, 0x0C};
     29    uint32_t offset = 2 /* version */ + 32 /* random */;
     30 
     31    if (agent()->variant() != ssl_variant_datagram) {
     32      ADD_FAILURE();
     33      return KEEP;
     34    }
     35 
     36    if (header.handshake_type() != ssl_hs_client_hello) {
     37      return KEEP;
     38    }
     39 
     40    DataBuffer cookie(cookie_bytes, sizeof(cookie_bytes));
     41    *output = input;
     42 
     43    // Add the SID length (if any) to locate the cookie.
     44    uint32_t sid_len = 0;
     45    if (!output->Read(offset, 1, &sid_len)) {
     46      ADD_FAILURE();
     47      return KEEP;
     48    }
     49    offset += 1 + sid_len;
     50    output->Splice(cookie, offset, 1);
     51 
     52    return CHANGE;
     53  }
     54 
     55 private:
     56  DataBuffer cookie_;
     57 };
     58 
     59 class TlsExtensionTruncator : public TlsExtensionFilter {
     60 public:
     61  TlsExtensionTruncator(const std::shared_ptr<TlsAgent>& a, uint16_t extension,
     62                        size_t length)
     63      : TlsExtensionFilter(a), extension_(extension), length_(length) {}
     64  virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
     65                                               const DataBuffer& input,
     66                                               DataBuffer* output) {
     67    if (extension_type != extension_) {
     68      return KEEP;
     69    }
     70    if (input.len() <= length_) {
     71      return KEEP;
     72    }
     73 
     74    output->Assign(input.data(), length_);
     75    return CHANGE;
     76  }
     77 
     78 private:
     79  uint16_t extension_;
     80  size_t length_;
     81 };
     82 
     83 class TlsExtensionTestBase : public TlsConnectTestBase {
     84 protected:
     85  TlsExtensionTestBase(SSLProtocolVariant variant, uint16_t version)
     86      : TlsConnectTestBase(variant, version) {}
     87 
     88  void ClientHelloErrorTest(std::shared_ptr<PacketFilter> filter,
     89                            uint8_t desc = kTlsAlertDecodeError) {
     90    client_->SetFilter(filter);
     91    ConnectExpectAlert(server_, desc);
     92  }
     93 
     94  void ServerHelloErrorTest(std::shared_ptr<PacketFilter> filter,
     95                            uint8_t desc = kTlsAlertDecodeError) {
     96    server_->SetFilter(filter);
     97    ConnectExpectAlert(client_, desc);
     98  }
     99 
    100  static void InitSimpleSni(DataBuffer* extension) {
    101    const char* name = "host.name";
    102    const size_t namelen = PL_strlen(name);
    103    extension->Allocate(namelen + 5);
    104    extension->Write(0, namelen + 3, 2);
    105    extension->Write(2, static_cast<uint32_t>(0), 1);  // 0 == hostname
    106    extension->Write(3, namelen, 2);
    107    extension->Write(5, reinterpret_cast<const uint8_t*>(name), namelen);
    108  }
    109 
    110  void HrrThenRemoveExtensionsTest(SSLExtensionType type, PRInt32 client_error,
    111                                   PRInt32 server_error) {
    112    static const std::vector<SSLNamedGroup> client_groups = {
    113        ssl_grp_ec_secp384r1, ssl_grp_ec_curve25519};
    114    static const std::vector<SSLNamedGroup> server_groups = {
    115        ssl_grp_ec_curve25519, ssl_grp_ec_secp384r1};
    116    client_->ConfigNamedGroups(client_groups);
    117    server_->ConfigNamedGroups(server_groups);
    118    EnsureTlsSetup();
    119    StartConnect();
    120    client_->Handshake();  // Send ClientHello
    121    server_->Handshake();  // Send HRR.
    122    MakeTlsFilter<TlsExtensionDropper>(client_, type);
    123    Handshake();
    124    client_->CheckErrorCode(client_error);
    125    server_->CheckErrorCode(server_error);
    126  }
    127 };
    128 
    129 class TlsExtensionTestDtls : public TlsExtensionTestBase,
    130                             public ::testing::WithParamInterface<uint16_t> {
    131 public:
    132  TlsExtensionTestDtls()
    133      : TlsExtensionTestBase(ssl_variant_datagram, GetParam()) {}
    134 };
    135 
    136 class TlsExtensionTest12Plus : public TlsExtensionTestBase,
    137                               public ::testing::WithParamInterface<
    138                                   std::tuple<SSLProtocolVariant, uint16_t>> {
    139 public:
    140  TlsExtensionTest12Plus()
    141      : TlsExtensionTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())) {
    142  }
    143 };
    144 
    145 class TlsExtensionTest12 : public TlsExtensionTestBase,
    146                           public ::testing::WithParamInterface<
    147                               std::tuple<SSLProtocolVariant, uint16_t>> {
    148 public:
    149  TlsExtensionTest12()
    150      : TlsExtensionTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())) {
    151  }
    152 };
    153 
    154 class TlsExtensionTest13
    155    : public TlsExtensionTestBase,
    156      public ::testing::WithParamInterface<SSLProtocolVariant> {
    157 public:
    158  TlsExtensionTest13()
    159      : TlsExtensionTestBase(GetParam(), SSL_LIBRARY_VERSION_TLS_1_3) {}
    160 
    161  void ConnectWithBogusVersionList(const uint8_t* buf, size_t len) {
    162    DataBuffer versions_buf(buf, len);
    163    MakeTlsFilter<TlsExtensionReplacer>(
    164        client_, ssl_tls13_supported_versions_xtn, versions_buf);
    165    ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
    166    client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
    167    server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
    168  }
    169 
    170  void ConnectWithReplacementVersionList(uint16_t version) {
    171    // Convert the version encoding for DTLS, if needed.
    172    if (variant_ == ssl_variant_datagram) {
    173      switch (version) {
    174        case SSL_LIBRARY_VERSION_TLS_1_3:
    175          version = SSL_LIBRARY_VERSION_DTLS_1_3_WIRE;
    176          break;
    177        case SSL_LIBRARY_VERSION_TLS_1_2:
    178          version = SSL_LIBRARY_VERSION_DTLS_1_2_WIRE;
    179          break;
    180        case SSL_LIBRARY_VERSION_TLS_1_1:
    181          /* TLS_1_1 maps to DTLS_1_0, see sslproto.h. */
    182          version = SSL_LIBRARY_VERSION_DTLS_1_0_WIRE;
    183          break;
    184        default:
    185          PORT_Assert(0);
    186      }
    187    }
    188 
    189    DataBuffer versions_buf;
    190    size_t index = versions_buf.Write(0, 2, 1);
    191    versions_buf.Write(index, version, 2);
    192    MakeTlsFilter<TlsExtensionReplacer>(
    193        client_, ssl_tls13_supported_versions_xtn, versions_buf);
    194    ConnectExpectFail();
    195  }
    196 };
    197 
    198 class TlsExtensionTest13Stream : public TlsExtensionTestBase {
    199 public:
    200  TlsExtensionTest13Stream()
    201      : TlsExtensionTestBase(ssl_variant_stream, SSL_LIBRARY_VERSION_TLS_1_3) {}
    202 };
    203 
    204 class TlsExtensionTestGeneric : public TlsExtensionTestBase,
    205                                public ::testing::WithParamInterface<
    206                                    std::tuple<SSLProtocolVariant, uint16_t>> {
    207 public:
    208  TlsExtensionTestGeneric()
    209      : TlsExtensionTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())) {
    210  }
    211 };
    212 
    213 class TlsExtensionTestPre13 : public TlsExtensionTestBase,
    214                              public ::testing::WithParamInterface<
    215                                  std::tuple<SSLProtocolVariant, uint16_t>> {
    216 public:
    217  TlsExtensionTestPre13()
    218      : TlsExtensionTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())) {
    219  }
    220 };
    221 
    222 TEST_P(TlsExtensionTestGeneric, DamageSniLength) {
    223  ClientHelloErrorTest(
    224      std::make_shared<TlsExtensionDamager>(client_, ssl_server_name_xtn, 1));
    225 }
    226 
    227 TEST_P(TlsExtensionTestGeneric, DamageSniHostLength) {
    228  ClientHelloErrorTest(
    229      std::make_shared<TlsExtensionDamager>(client_, ssl_server_name_xtn, 4));
    230 }
    231 
    232 TEST_P(TlsExtensionTestGeneric, TruncateSni) {
    233  ClientHelloErrorTest(
    234      std::make_shared<TlsExtensionTruncator>(client_, ssl_server_name_xtn, 7));
    235 }
    236 
    237 // A valid extension that appears twice will be reported as unsupported.
    238 TEST_P(TlsExtensionTestGeneric, RepeatSni) {
    239  DataBuffer extension;
    240  InitSimpleSni(&extension);
    241  ClientHelloErrorTest(std::make_shared<TlsExtensionInjector>(
    242                           client_, ssl_server_name_xtn, extension),
    243                       kTlsAlertIllegalParameter);
    244 }
    245 
    246 // An SNI entry with zero length is considered invalid (strangely, not if it is
    247 // the last entry, which is probably a bug).
    248 TEST_P(TlsExtensionTestGeneric, BadSni) {
    249  DataBuffer simple;
    250  InitSimpleSni(&simple);
    251  DataBuffer extension;
    252  extension.Allocate(simple.len() + 3);
    253  extension.Write(0, static_cast<uint32_t>(0), 3);
    254  extension.Write(3, simple);
    255  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    256      client_, ssl_server_name_xtn, extension));
    257 }
    258 
    259 TEST_P(TlsExtensionTestGeneric, EmptySni) {
    260  DataBuffer extension;
    261  extension.Allocate(2);
    262  extension.Write(0, static_cast<uint32_t>(0), 2);
    263  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    264      client_, ssl_server_name_xtn, extension));
    265 }
    266 
    267 TEST_P(TlsExtensionTestGeneric, EmptyAlpnExtension) {
    268  EnableAlpn();
    269  DataBuffer extension;
    270  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    271                           client_, ssl_app_layer_protocol_xtn, extension),
    272                       kTlsAlertIllegalParameter);
    273 }
    274 
    275 // An empty ALPN isn't considered bad, though it does lead to there being no
    276 // protocol for the server to select.
    277 TEST_P(TlsExtensionTestGeneric, EmptyAlpnList) {
    278  EnableAlpn();
    279  const uint8_t val[] = {0x00, 0x00};
    280  DataBuffer extension(val, sizeof(val));
    281  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    282                           client_, ssl_app_layer_protocol_xtn, extension),
    283                       kTlsAlertNoApplicationProtocol);
    284 }
    285 
    286 TEST_P(TlsExtensionTestGeneric, OneByteAlpn) {
    287  EnableAlpn();
    288  ClientHelloErrorTest(std::make_shared<TlsExtensionTruncator>(
    289      client_, ssl_app_layer_protocol_xtn, 1));
    290 }
    291 
    292 TEST_P(TlsExtensionTestGeneric, AlpnMissingValue) {
    293  EnableAlpn();
    294  // This will leave the length of the second entry, but no value.
    295  ClientHelloErrorTest(std::make_shared<TlsExtensionTruncator>(
    296      client_, ssl_app_layer_protocol_xtn, 5));
    297 }
    298 
    299 TEST_P(TlsExtensionTestGeneric, AlpnZeroLength) {
    300  EnableAlpn();
    301  const uint8_t val[] = {0x00, 0x03, 0x01, 0x61, 0x00};
    302  DataBuffer extension(val, sizeof(val));
    303  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    304      client_, ssl_app_layer_protocol_xtn, extension));
    305 }
    306 
    307 TEST_P(TlsExtensionTestGeneric, AlpnLengthOverflow) {
    308  EnableAlpn();
    309  const uint8_t val[] = {0x00, 0x03, 0x01, 0x61, 0x01};
    310  DataBuffer extension(val, sizeof(val));
    311  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    312      client_, ssl_app_layer_protocol_xtn, extension));
    313 }
    314 
    315 TEST_P(TlsExtensionTestGeneric, AlpnMismatch) {
    316  const uint8_t client_alpn[] = {0x01, 0x61};
    317  client_->EnableAlpn(client_alpn, sizeof(client_alpn));
    318  const uint8_t server_alpn[] = {0x02, 0x61, 0x62};
    319  server_->EnableAlpn(server_alpn, sizeof(server_alpn));
    320 
    321  ClientHelloErrorTest(nullptr, kTlsAlertNoApplicationProtocol);
    322  client_->CheckErrorCode(SSL_ERROR_NEXT_PROTOCOL_NO_PROTOCOL);
    323 }
    324 
    325 TEST_P(TlsExtensionTestGeneric, AlpnDisabledServer) {
    326  const uint8_t client_alpn[] = {0x01, 0x61};
    327  client_->EnableAlpn(client_alpn, sizeof(client_alpn));
    328  server_->EnableAlpn(nullptr, 0);
    329 
    330  ClientHelloErrorTest(nullptr, kTlsAlertUnsupportedExtension);
    331 }
    332 
    333 TEST_P(TlsConnectGeneric, AlpnDisabled) {
    334  server_->EnableAlpn(nullptr, 0);
    335  Connect();
    336 
    337  SSLNextProtoState state;
    338  uint8_t buf[255] = {0};
    339  unsigned int buf_len = 3;
    340  EXPECT_EQ(SECSuccess, SSL_GetNextProto(client_->ssl_fd(), &state, buf,
    341                                         &buf_len, sizeof(buf)));
    342  EXPECT_EQ(SSL_NEXT_PROTO_NO_SUPPORT, state);
    343  EXPECT_EQ(0U, buf_len);
    344 }
    345 
    346 // Many of these tests fail in TLS 1.3 because the extension is encrypted, which
    347 // prevents modification of the value from the ServerHello.
    348 TEST_P(TlsExtensionTestPre13, AlpnReturnedEmptyList) {
    349  EnableAlpn();
    350  const uint8_t val[] = {0x00, 0x00};
    351  DataBuffer extension(val, sizeof(val));
    352  ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    353      server_, ssl_app_layer_protocol_xtn, extension));
    354 }
    355 
    356 TEST_P(TlsExtensionTestPre13, AlpnReturnedEmptyName) {
    357  EnableAlpn();
    358  const uint8_t val[] = {0x00, 0x01, 0x00};
    359  DataBuffer extension(val, sizeof(val));
    360  ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    361      server_, ssl_app_layer_protocol_xtn, extension));
    362 }
    363 
    364 TEST_P(TlsExtensionTestPre13, AlpnReturnedListTrailingData) {
    365  EnableAlpn();
    366  const uint8_t val[] = {0x00, 0x02, 0x01, 0x61, 0x00};
    367  DataBuffer extension(val, sizeof(val));
    368  ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    369      server_, ssl_app_layer_protocol_xtn, extension));
    370 }
    371 
    372 TEST_P(TlsExtensionTestPre13, AlpnReturnedExtraEntry) {
    373  EnableAlpn();
    374  const uint8_t val[] = {0x00, 0x04, 0x01, 0x61, 0x01, 0x62};
    375  DataBuffer extension(val, sizeof(val));
    376  ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    377      server_, ssl_app_layer_protocol_xtn, extension));
    378 }
    379 
    380 TEST_P(TlsExtensionTestPre13, AlpnReturnedBadListLength) {
    381  EnableAlpn();
    382  const uint8_t val[] = {0x00, 0x99, 0x01, 0x61, 0x00};
    383  DataBuffer extension(val, sizeof(val));
    384  ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    385      server_, ssl_app_layer_protocol_xtn, extension));
    386 }
    387 
    388 TEST_P(TlsExtensionTestPre13, AlpnReturnedBadNameLength) {
    389  EnableAlpn();
    390  const uint8_t val[] = {0x00, 0x02, 0x99, 0x61};
    391  DataBuffer extension(val, sizeof(val));
    392  ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    393      server_, ssl_app_layer_protocol_xtn, extension));
    394 }
    395 
    396 TEST_P(TlsExtensionTestPre13, AlpnReturnedUnknownName) {
    397  EnableAlpn();
    398  const uint8_t val[] = {0x00, 0x02, 0x01, 0x67};
    399  DataBuffer extension(val, sizeof(val));
    400  ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    401                           server_, ssl_app_layer_protocol_xtn, extension),
    402                       kTlsAlertIllegalParameter);
    403 }
    404 
    405 TEST_P(TlsExtensionTestDtls, SrtpShort) {
    406  EnableSrtp();
    407  ClientHelloErrorTest(
    408      std::make_shared<TlsExtensionTruncator>(client_, ssl_use_srtp_xtn, 3));
    409 }
    410 
    411 TEST_P(TlsExtensionTestDtls, SrtpOdd) {
    412  EnableSrtp();
    413  const uint8_t val[] = {0x00, 0x01, 0xff, 0x00};
    414  DataBuffer extension(val, sizeof(val));
    415  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    416      client_, ssl_use_srtp_xtn, extension));
    417 }
    418 
    419 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsBadLength) {
    420  const uint8_t val[] = {0x00};
    421  DataBuffer extension(val, sizeof(val));
    422  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    423      client_, ssl_signature_algorithms_xtn, extension));
    424 }
    425 
    426 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsTrailingData) {
    427  // make sure the test uses an algorithm that is legal for
    428  // tls 1.3 (or tls 1.3 will throw a handshake failure alert
    429  // instead of a decode error alert)
    430  const uint8_t val[] = {0x00, 0x02, 0x08, 0x09, 0x00};  // sha-256, rsa-pss-pss
    431  DataBuffer extension(val, sizeof(val));
    432  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    433      client_, ssl_signature_algorithms_xtn, extension));
    434 }
    435 
    436 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsEmpty) {
    437  const uint8_t val[] = {0x00, 0x00};
    438  DataBuffer extension(val, sizeof(val));
    439  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    440                           client_, ssl_signature_algorithms_xtn, extension),
    441                       kTlsAlertHandshakeFailure);
    442 }
    443 
    444 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsNoOverlap) {
    445  const uint8_t val[] = {0x00, 0x02, 0xff, 0xff};
    446  DataBuffer extension(val, sizeof(val));
    447  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    448                           client_, ssl_signature_algorithms_xtn, extension),
    449                       kTlsAlertHandshakeFailure);
    450 }
    451 
    452 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsOddLength) {
    453  const uint8_t val[] = {0x00, 0x01, 0x04};
    454  DataBuffer extension(val, sizeof(val));
    455  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    456      client_, ssl_signature_algorithms_xtn, extension));
    457 }
    458 
    459 TEST_F(TlsExtensionTest13Stream, SignatureAlgorithmsPrecedingGarbage) {
    460  // 31 unknown signature algorithms followed by sha-256, rsa-pss
    461  const uint8_t val[] = {
    462      0x00, 0x40, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
    463      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
    464      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
    465      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
    466      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
    467      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x08, 0x04};
    468  DataBuffer extension(val, sizeof(val));
    469  MakeTlsFilter<TlsExtensionReplacer>(client_, ssl_signature_algorithms_xtn,
    470                                      extension);
    471  client_->ExpectSendAlert(kTlsAlertBadRecordMac);
    472  server_->ExpectSendAlert(kTlsAlertBadRecordMac);
    473  ConnectExpectFail();
    474  client_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
    475  server_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
    476 }
    477 
    478 TEST_P(TlsExtensionTestGeneric, NoSupportedGroups) {
    479  ClientHelloErrorTest(
    480      std::make_shared<TlsExtensionDropper>(client_, ssl_supported_groups_xtn),
    481      version_ < SSL_LIBRARY_VERSION_TLS_1_3 ? kTlsAlertDecryptError
    482                                             : kTlsAlertMissingExtension);
    483 }
    484 
    485 TEST_P(TlsExtensionTestGeneric, SupportedCurvesShort) {
    486  const uint8_t val[] = {0x00, 0x01, 0x00};
    487  DataBuffer extension(val, sizeof(val));
    488  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    489      client_, ssl_elliptic_curves_xtn, extension));
    490 }
    491 
    492 TEST_P(TlsExtensionTestGeneric, SupportedCurvesBadLength) {
    493  const uint8_t val[] = {0x09, 0x99, 0x00, 0x00};
    494  DataBuffer extension(val, sizeof(val));
    495  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    496      client_, ssl_elliptic_curves_xtn, extension));
    497 }
    498 
    499 TEST_P(TlsExtensionTestGeneric, SupportedCurvesTrailingData) {
    500  const uint8_t val[] = {0x00, 0x02, 0x00, 0x00, 0x00};
    501  DataBuffer extension(val, sizeof(val));
    502  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    503      client_, ssl_elliptic_curves_xtn, extension));
    504 }
    505 
    506 TEST_P(TlsExtensionTest12, SupportedCurvesDisableX25519) {
    507  // Disable session resumption.
    508  ConfigureSessionCache(RESUME_NONE, RESUME_NONE);
    509 
    510  // Ensure that we can enable its use in the key exchange.
    511  SECStatus rv =
    512      NSS_SetAlgorithmPolicy(SEC_OID_CURVE25519, NSS_USE_ALG_IN_SSL_KX, 0);
    513  ASSERT_EQ(SECSuccess, rv);
    514  rv = NSS_SetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, NSS_USE_POLICY_IN_SSL,
    515                              0);
    516  ASSERT_EQ(SECSuccess, rv);
    517 
    518  auto capture1 =
    519      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_elliptic_curves_xtn);
    520  Connect();
    521 
    522  EXPECT_TRUE(capture1->captured());
    523  const DataBuffer& ext1 = capture1->extension();
    524 
    525  uint32_t count;
    526  ASSERT_TRUE(ext1.Read(0, 2, &count));
    527 
    528  // Whether or not we've seen x25519 offered in this handshake.
    529  bool seen1_x25519 = false;
    530  for (size_t offset = 2; offset <= count; offset++) {
    531    uint32_t val;
    532    ASSERT_TRUE(ext1.Read(offset, 2, &val));
    533    if (val == ssl_grp_ec_curve25519) {
    534      seen1_x25519 = true;
    535      break;
    536    }
    537  }
    538  ASSERT_TRUE(seen1_x25519);
    539 
    540  // Ensure that we can disable its use in the key exchange.
    541  rv = NSS_SetAlgorithmPolicy(SEC_OID_CURVE25519, 0, NSS_USE_ALG_IN_SSL_KX);
    542  ASSERT_EQ(SECSuccess, rv);
    543  rv = NSS_SetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, NSS_USE_POLICY_IN_SSL,
    544                              0);
    545  ASSERT_EQ(SECSuccess, rv);
    546 
    547  // Clean up after the last run.
    548  Reset();
    549  auto capture2 =
    550      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_elliptic_curves_xtn);
    551  Connect();
    552 
    553  EXPECT_TRUE(capture2->captured());
    554  const DataBuffer& ext2 = capture2->extension();
    555 
    556  ASSERT_TRUE(ext2.Read(0, 2, &count));
    557 
    558  // Whether or not we've seen x25519 offered in this handshake.
    559  bool seen2_x25519 = false;
    560  for (size_t offset = 2; offset <= count; offset++) {
    561    uint32_t val;
    562    ASSERT_TRUE(ext2.Read(offset, 2, &val));
    563 
    564    if (val == ssl_grp_ec_curve25519) {
    565      seen2_x25519 = true;
    566      break;
    567    }
    568  }
    569 
    570  ASSERT_FALSE(seen2_x25519);
    571 }
    572 
    573 TEST_P(TlsExtensionTestPre13, SupportedPointsEmpty) {
    574  const uint8_t val[] = {0x00};
    575  DataBuffer extension(val, sizeof(val));
    576  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    577      client_, ssl_ec_point_formats_xtn, extension));
    578 }
    579 
    580 TEST_P(TlsExtensionTestPre13, SupportedPointsBadLength) {
    581  const uint8_t val[] = {0x99, 0x00, 0x00};
    582  DataBuffer extension(val, sizeof(val));
    583  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    584      client_, ssl_ec_point_formats_xtn, extension));
    585 }
    586 
    587 TEST_P(TlsExtensionTestPre13, SupportedPointsTrailingData) {
    588  const uint8_t val[] = {0x01, 0x00, 0x00};
    589  DataBuffer extension(val, sizeof(val));
    590  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    591      client_, ssl_ec_point_formats_xtn, extension));
    592 }
    593 
    594 TEST_P(TlsExtensionTestPre13, SupportedPointsCompressed) {
    595  const uint8_t val[] = {0x01, 0x02};
    596  DataBuffer extension(val, sizeof(val));
    597  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    598                           client_, ssl_ec_point_formats_xtn, extension),
    599                       kTlsAlertIllegalParameter);
    600 }
    601 
    602 TEST_P(TlsExtensionTestPre13, SupportedPointsUndefined) {
    603  const uint8_t val[] = {0x01, 0xAA};
    604  DataBuffer extension(val, sizeof(val));
    605  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    606                           client_, ssl_ec_point_formats_xtn, extension),
    607                       kTlsAlertIllegalParameter);
    608 }
    609 
    610 TEST_P(TlsExtensionTestPre13, RenegotiationInfoBadLength) {
    611  const uint8_t val[] = {0x99};
    612  DataBuffer extension(val, sizeof(val));
    613  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    614      client_, ssl_renegotiation_info_xtn, extension));
    615 }
    616 
    617 TEST_P(TlsExtensionTestPre13, RenegotiationInfoMismatch) {
    618  const uint8_t val[] = {0x01, 0x00};
    619  DataBuffer extension(val, sizeof(val));
    620  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    621      client_, ssl_renegotiation_info_xtn, extension));
    622 }
    623 
    624 // The extension has to contain a length.
    625 TEST_P(TlsExtensionTestPre13, RenegotiationInfoExtensionEmpty) {
    626  DataBuffer extension;
    627  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
    628      client_, ssl_renegotiation_info_xtn, extension));
    629 }
    630 
    631 // This only works on TLS 1.2, since it relies on static RSA; otherwise libssl
    632 // picks the wrong cipher suite.
    633 TEST_P(TlsExtensionTest12, SignatureAlgorithmConfiguration) {
    634  const SSLSignatureScheme schemes[] = {ssl_sig_rsa_pss_rsae_sha512,
    635                                        ssl_sig_rsa_pss_rsae_sha384};
    636 
    637  auto capture =
    638      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_signature_algorithms_xtn);
    639  client_->SetSignatureSchemes(schemes, PR_ARRAY_SIZE(schemes));
    640  EnableOnlyStaticRsaCiphers();
    641  Connect();
    642 
    643  const DataBuffer& ext = capture->extension();
    644  EXPECT_EQ(2 + PR_ARRAY_SIZE(schemes) * 2, ext.len());
    645  for (size_t i = 0, cursor = 2;
    646       i < PR_ARRAY_SIZE(schemes) && cursor < ext.len(); ++i) {
    647    uint32_t v = 0;
    648    EXPECT_TRUE(ext.Read(cursor, 2, &v));
    649    cursor += 2;
    650    EXPECT_EQ(schemes[i], static_cast<SSLSignatureScheme>(v));
    651  }
    652 }
    653 
    654 #ifndef NSS_DISABLE_DSA
    655 // This only works on TLS 1.2, since it relies on DSA.
    656 // and doesn't work if we've disabled DSA (Reset(TlsAgent:kServerDSA) fail
    657 // because we don't have a DSA certificate)
    658 TEST_P(TlsExtensionTest12, SignatureAlgorithmDisableDSA) {
    659  const std::vector<SSLSignatureScheme> schemes = {
    660      ssl_sig_dsa_sha1, ssl_sig_dsa_sha256, ssl_sig_dsa_sha384,
    661      ssl_sig_dsa_sha512, ssl_sig_rsa_pss_rsae_sha256};
    662 
    663  // Connect with DSA enabled by policy.
    664  SECStatus rv = NSS_SetAlgorithmPolicy(SEC_OID_ANSIX9_DSA_SIGNATURE,
    665                                        NSS_USE_ALG_IN_SSL_KX, 0);
    666  ASSERT_EQ(SECSuccess, rv);
    667  rv = NSS_SetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, NSS_USE_POLICY_IN_SSL,
    668                              0);
    669  ASSERT_EQ(SECSuccess, rv);
    670 
    671  Reset(TlsAgent::kServerDsa);
    672  auto capture1 =
    673      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_signature_algorithms_xtn);
    674  client_->SetSignatureSchemes(schemes.data(), schemes.size());
    675  Connect();
    676 
    677  // Check if all the signature algorithms are advertised.
    678  EXPECT_TRUE(capture1->captured());
    679  const DataBuffer& ext1 = capture1->extension();
    680  EXPECT_EQ(2U + 2U * schemes.size(), ext1.len());
    681 
    682  // Connect with DSA disabled by policy.
    683  rv = NSS_SetAlgorithmPolicy(SEC_OID_ANSIX9_DSA_SIGNATURE, 0,
    684                              NSS_USE_ALG_IN_SSL_KX);
    685  ASSERT_EQ(SECSuccess, rv);
    686  rv = NSS_SetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, NSS_USE_POLICY_IN_SSL,
    687                              0);
    688  ASSERT_EQ(SECSuccess, rv);
    689 
    690  Reset(TlsAgent::kServerDsa);
    691  auto capture2 =
    692      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_signature_algorithms_xtn);
    693  client_->SetSignatureSchemes(schemes.data(), schemes.size());
    694  ConnectExpectAlert(server_, kTlsAlertHandshakeFailure);
    695  server_->CheckErrorCode(SSL_ERROR_NO_CYPHER_OVERLAP);
    696  client_->CheckErrorCode(SSL_ERROR_NO_CYPHER_OVERLAP);
    697 
    698  // Check if no DSA algorithms are advertised.
    699  EXPECT_TRUE(capture2->captured());
    700  const DataBuffer& ext2 = capture2->extension();
    701  EXPECT_EQ(2U + 2U, ext2.len());
    702  uint32_t v = 0;
    703  EXPECT_TRUE(ext2.Read(2, 2, &v));
    704  EXPECT_EQ(ssl_sig_rsa_pss_rsae_sha256, v);
    705 }
    706 #endif
    707 
    708 // Temporary test to verify that we choke on an empty ClientKeyShare.
    709 // This test will fail when we implement HelloRetryRequest.
    710 TEST_P(TlsExtensionTest13, EmptyClientKeyShare) {
    711  ClientHelloErrorTest(std::make_shared<TlsExtensionTruncator>(
    712                           client_, ssl_tls13_key_share_xtn, 2),
    713                       kTlsAlertHandshakeFailure);
    714 }
    715 
    716 // These tests only work in stream mode because the client sends a
    717 // cleartext alert which causes a MAC error on the server. With
    718 // stream this causes handshake failure but with datagram, the
    719 // packet gets dropped.
    720 TEST_F(TlsExtensionTest13Stream, DropServerKeyShare) {
    721  EnsureTlsSetup();
    722  MakeTlsFilter<TlsExtensionDropper>(server_, ssl_tls13_key_share_xtn);
    723  client_->ExpectSendAlert(kTlsAlertMissingExtension);
    724  server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
    725  ConnectExpectFail();
    726  EXPECT_EQ(SSL_ERROR_MISSING_KEY_SHARE, client_->error_code());
    727  EXPECT_EQ(SSL_ERROR_RX_UNEXPECTED_RECORD_TYPE, server_->error_code());
    728 }
    729 
    730 TEST_F(TlsExtensionTest13Stream, WrongServerKeyShare) {
    731  const uint16_t wrong_group = ssl_grp_ec_secp384r1;
    732 
    733  static const uint8_t key_share[] = {
    734      wrong_group >> 8,
    735      wrong_group & 0xff,  // Group we didn't offer.
    736      0x00,
    737      0x02,  // length = 2
    738      0x01,
    739      0x02};
    740  DataBuffer buf(key_share, sizeof(key_share));
    741  EnsureTlsSetup();
    742  MakeTlsFilter<TlsExtensionReplacer>(server_, ssl_tls13_key_share_xtn, buf);
    743  client_->ExpectSendAlert(kTlsAlertIllegalParameter);
    744  server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
    745  ConnectExpectFail();
    746  EXPECT_EQ(SSL_ERROR_RX_MALFORMED_KEY_SHARE, client_->error_code());
    747  EXPECT_EQ(SSL_ERROR_RX_UNEXPECTED_RECORD_TYPE, server_->error_code());
    748 }
    749 
    750 TEST_F(TlsExtensionTest13Stream, UnknownServerKeyShare) {
    751  const uint16_t wrong_group = 0xffff;
    752 
    753  static const uint8_t key_share[] = {
    754      wrong_group >> 8,
    755      wrong_group & 0xff,  // Group we didn't offer.
    756      0x00,
    757      0x02,  // length = 2
    758      0x01,
    759      0x02};
    760  DataBuffer buf(key_share, sizeof(key_share));
    761  EnsureTlsSetup();
    762  MakeTlsFilter<TlsExtensionReplacer>(server_, ssl_tls13_key_share_xtn, buf);
    763  client_->ExpectSendAlert(kTlsAlertIllegalParameter);
    764  server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
    765  ConnectExpectFail();
    766  EXPECT_EQ(SSL_ERROR_RX_MALFORMED_KEY_SHARE, client_->error_code());
    767  EXPECT_EQ(SSL_ERROR_RX_UNEXPECTED_RECORD_TYPE, server_->error_code());
    768 }
    769 
    770 TEST_F(TlsExtensionTest13Stream, AddServerSignatureAlgorithmsOnResumption) {
    771  SetupForResume();
    772  DataBuffer empty;
    773  MakeTlsFilter<TlsExtensionInjector>(server_, ssl_signature_algorithms_xtn,
    774                                      empty);
    775  client_->ExpectSendAlert(kTlsAlertIllegalParameter);
    776  server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
    777  ConnectExpectFail();
    778  EXPECT_EQ(SSL_ERROR_EXTENSION_DISALLOWED_FOR_VERSION, client_->error_code());
    779  EXPECT_EQ(SSL_ERROR_RX_UNEXPECTED_RECORD_TYPE, server_->error_code());
    780 }
    781 
    782 struct PskIdentity {
    783  DataBuffer identity;
    784  uint32_t obfuscated_ticket_age;
    785 };
    786 
    787 class TlsPreSharedKeyReplacer;
    788 
    789 typedef std::function<void(TlsPreSharedKeyReplacer*)>
    790    TlsPreSharedKeyReplacerFunc;
    791 
    792 class TlsPreSharedKeyReplacer : public TlsExtensionFilter {
    793 public:
    794  TlsPreSharedKeyReplacer(const std::shared_ptr<TlsAgent>& a,
    795                          TlsPreSharedKeyReplacerFunc function)
    796      : TlsExtensionFilter(a), identities_(), binders_(), function_(function) {}
    797 
    798  static size_t CopyAndMaybeReplace(TlsParser* parser, size_t size,
    799                                    const std::unique_ptr<DataBuffer>& replace,
    800                                    size_t index, DataBuffer* output) {
    801    DataBuffer tmp;
    802    bool ret = parser->ReadVariable(&tmp, size);
    803    EXPECT_EQ(true, ret);
    804    if (!ret) return 0;
    805    if (replace) {
    806      tmp = *replace;
    807    }
    808 
    809    return WriteVariable(output, index, tmp, size);
    810  }
    811 
    812  PacketFilter::Action FilterExtension(uint16_t extension_type,
    813                                       const DataBuffer& input,
    814                                       DataBuffer* output) {
    815    if (extension_type != ssl_tls13_pre_shared_key_xtn) {
    816      return KEEP;
    817    }
    818 
    819    if (!Decode(input)) {
    820      return KEEP;
    821    }
    822 
    823    // Call the function.
    824    function_(this);
    825 
    826    Encode(output);
    827 
    828    return CHANGE;
    829  }
    830 
    831  std::vector<PskIdentity> identities_;
    832  std::vector<DataBuffer> binders_;
    833 
    834 private:
    835  bool Decode(const DataBuffer& input) {
    836    std::unique_ptr<TlsParser> parser(new TlsParser(input));
    837    DataBuffer identities;
    838 
    839    if (!parser->ReadVariable(&identities, 2)) {
    840      ADD_FAILURE();
    841      return false;
    842    }
    843 
    844    DataBuffer binders;
    845    if (!parser->ReadVariable(&binders, 2)) {
    846      ADD_FAILURE();
    847      return false;
    848    }
    849    EXPECT_EQ(0UL, parser->remaining());
    850 
    851    // Now parse the inner sections.
    852    parser.reset(new TlsParser(identities));
    853    while (parser->remaining()) {
    854      PskIdentity identity;
    855 
    856      if (!parser->ReadVariable(&identity.identity, 2)) {
    857        ADD_FAILURE();
    858        return false;
    859      }
    860 
    861      if (!parser->Read(&identity.obfuscated_ticket_age, 4)) {
    862        ADD_FAILURE();
    863        return false;
    864      }
    865 
    866      identities_.push_back(identity);
    867    }
    868 
    869    parser.reset(new TlsParser(binders));
    870    while (parser->remaining()) {
    871      DataBuffer binder;
    872 
    873      if (!parser->ReadVariable(&binder, 1)) {
    874        ADD_FAILURE();
    875        return false;
    876      }
    877 
    878      binders_.push_back(binder);
    879    }
    880 
    881    return true;
    882  }
    883 
    884  void Encode(DataBuffer* output) {
    885    DataBuffer identities;
    886    size_t index = 0;
    887    for (auto id : identities_) {
    888      index = WriteVariable(&identities, index, id.identity, 2);
    889      index = identities.Write(index, id.obfuscated_ticket_age, 4);
    890    }
    891 
    892    DataBuffer binders;
    893    index = 0;
    894    for (auto binder : binders_) {
    895      index = WriteVariable(&binders, index, binder, 1);
    896    }
    897 
    898    output->Truncate(0);
    899    index = 0;
    900    index = WriteVariable(output, index, identities, 2);
    901    index = WriteVariable(output, index, binders, 2);
    902  }
    903 
    904  TlsPreSharedKeyReplacerFunc function_;
    905 };
    906 
    907 TEST_F(TlsExtensionTest13Stream, ResumeEmptyPskLabel) {
    908  SetupForResume();
    909 
    910  MakeTlsFilter<TlsPreSharedKeyReplacer>(
    911      client_, [](TlsPreSharedKeyReplacer* r) {
    912        r->identities_[0].identity.Truncate(0);
    913      });
    914  ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
    915  client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
    916  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
    917 }
    918 
    919 // Flip the first byte of the binder.
    920 TEST_F(TlsExtensionTest13Stream, ResumeIncorrectBinderValue) {
    921  SetupForResume();
    922 
    923  MakeTlsFilter<TlsPreSharedKeyReplacer>(
    924      client_, [](TlsPreSharedKeyReplacer* r) {
    925        r->binders_[0].Write(0, r->binders_[0].data()[0] ^ 0xff, 1);
    926      });
    927  ConnectExpectAlert(server_, kTlsAlertDecryptError);
    928  client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
    929  server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
    930 }
    931 
    932 // Do the same with an External PSK.
    933 TEST_P(TlsConnectTls13, TestTls13PskInvalidBinderValue) {
    934  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
    935  ASSERT_TRUE(!!slot);
    936  ScopedPK11SymKey key(
    937      PK11_KeyGen(slot.get(), CKM_HKDF_KEY_GEN, nullptr, 16, nullptr));
    938  ASSERT_TRUE(!!key);
    939  AddPsk(key, std::string("foo"), ssl_hash_sha256);
    940  StartConnect();
    941  ASSERT_TRUE(client_->MaybeSetResumptionToken());
    942 
    943  MakeTlsFilter<TlsPreSharedKeyReplacer>(
    944      client_, [](TlsPreSharedKeyReplacer* r) {
    945        r->binders_[0].Write(0, r->binders_[0].data()[0] ^ 0xff, 1);
    946      });
    947  ConnectExpectAlert(server_, kTlsAlertDecryptError);
    948  client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
    949  server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
    950 }
    951 
    952 // Extend the binder by one.
    953 TEST_F(TlsExtensionTest13Stream, ResumeIncorrectBinderLength) {
    954  SetupForResume();
    955 
    956  MakeTlsFilter<TlsPreSharedKeyReplacer>(
    957      client_, [](TlsPreSharedKeyReplacer* r) {
    958        r->binders_[0].Write(r->binders_[0].len(), 0xff, 1);
    959      });
    960  ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
    961  client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
    962  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
    963 }
    964 
    965 // Binders must be at least 32 bytes.
    966 TEST_F(TlsExtensionTest13Stream, ResumeBinderTooShort) {
    967  SetupForResume();
    968 
    969  MakeTlsFilter<TlsPreSharedKeyReplacer>(
    970      client_, [](TlsPreSharedKeyReplacer* r) { r->binders_[0].Truncate(31); });
    971  ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
    972  client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
    973  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
    974 }
    975 
    976 // Duplicate the identity and binder. This will fail with an error
    977 // processing the binder (because we extended the identity list.)
    978 TEST_F(TlsExtensionTest13Stream, ResumeTwoPsks) {
    979  SetupForResume();
    980 
    981  MakeTlsFilter<TlsPreSharedKeyReplacer>(
    982      client_, [](TlsPreSharedKeyReplacer* r) {
    983        r->identities_.push_back(r->identities_[0]);
    984        r->binders_.push_back(r->binders_[0]);
    985      });
    986  ConnectExpectAlert(server_, kTlsAlertDecryptError);
    987  client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
    988  server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
    989 }
    990 
    991 // The next two tests have mismatches in the number of identities
    992 // and binders. This generates an illegal parameter alert.
    993 TEST_F(TlsExtensionTest13Stream, ResumeTwoIdentitiesOneBinder) {
    994  SetupForResume();
    995 
    996  MakeTlsFilter<TlsPreSharedKeyReplacer>(
    997      client_, [](TlsPreSharedKeyReplacer* r) {
    998        r->identities_.push_back(r->identities_[0]);
    999      });
   1000  ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   1001  client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   1002  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
   1003 }
   1004 
   1005 TEST_F(TlsExtensionTest13Stream, ResumeOneIdentityTwoBinders) {
   1006  SetupForResume();
   1007 
   1008  MakeTlsFilter<TlsPreSharedKeyReplacer>(
   1009      client_, [](TlsPreSharedKeyReplacer* r) {
   1010        r->binders_.push_back(r->binders_[0]);
   1011      });
   1012  ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   1013  client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   1014  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
   1015 }
   1016 
   1017 TEST_F(TlsExtensionTest13Stream, ResumePskExtensionNotLast) {
   1018  SetupForResume();
   1019 
   1020  const uint8_t empty_buf[] = {0};
   1021  DataBuffer empty(empty_buf, 0);
   1022  // Inject an unused extension after the PSK extension.
   1023  MakeTlsFilter<TlsExtensionAppender>(client_, kTlsHandshakeClientHello, 0xffff,
   1024                                      empty);
   1025  ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   1026  client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   1027  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
   1028 }
   1029 
   1030 TEST_F(TlsExtensionTest13Stream, ResumeNoKeModes) {
   1031  SetupForResume();
   1032 
   1033  DataBuffer empty;
   1034  MakeTlsFilter<TlsExtensionDropper>(client_,
   1035                                     ssl_tls13_psk_key_exchange_modes_xtn);
   1036  ConnectExpectAlert(server_, kTlsAlertMissingExtension);
   1037  client_->CheckErrorCode(SSL_ERROR_MISSING_EXTENSION_ALERT);
   1038  server_->CheckErrorCode(SSL_ERROR_MISSING_PSK_KEY_EXCHANGE_MODES);
   1039 }
   1040 
   1041 // The following test contains valid but unacceptable PreSharedKey
   1042 // modes and therefore produces non-resumption followed by MAC
   1043 // errors.
   1044 TEST_F(TlsExtensionTest13Stream, ResumeBogusKeModes) {
   1045  SetupForResume();
   1046  const static uint8_t ke_modes[] = {1,  // Length
   1047                                     kTls13PskKe};
   1048 
   1049  DataBuffer modes(ke_modes, sizeof(ke_modes));
   1050  MakeTlsFilter<TlsExtensionReplacer>(
   1051      client_, ssl_tls13_psk_key_exchange_modes_xtn, modes);
   1052  client_->ExpectSendAlert(kTlsAlertBadRecordMac);
   1053  server_->ExpectSendAlert(kTlsAlertBadRecordMac);
   1054  ConnectExpectFail();
   1055  client_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
   1056  server_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
   1057 }
   1058 
   1059 TEST_P(TlsExtensionTest13, NoKeModesIfResumptionOff) {
   1060  ConfigureSessionCache(RESUME_NONE, RESUME_NONE);
   1061  auto capture = MakeTlsFilter<TlsExtensionCapture>(
   1062      client_, ssl_tls13_psk_key_exchange_modes_xtn);
   1063  Connect();
   1064  EXPECT_FALSE(capture->captured());
   1065 }
   1066 
   1067 // In these tests, we downgrade to TLS 1.2, causing the
   1068 // server to negotiate TLS 1.2.
   1069 // 1. Both sides only support TLS 1.3, so we get a cipher version
   1070 //    error.
   1071 TEST_P(TlsExtensionTest13, RemoveTls13FromVersionList) {
   1072  ExpectAlert(server_, kTlsAlertProtocolVersion);
   1073  ConnectWithReplacementVersionList(SSL_LIBRARY_VERSION_TLS_1_2);
   1074  client_->CheckErrorCode(SSL_ERROR_PROTOCOL_VERSION_ALERT);
   1075  server_->CheckErrorCode(SSL_ERROR_UNSUPPORTED_VERSION);
   1076 }
   1077 
   1078 // 2. Server supports 1.2 and 1.3, client supports 1.2, so we
   1079 //    can't negotiate any ciphers.
   1080 TEST_P(TlsExtensionTest13, RemoveTls13FromVersionListServerV12) {
   1081  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
   1082                           SSL_LIBRARY_VERSION_TLS_1_3);
   1083  ExpectAlert(server_, kTlsAlertHandshakeFailure);
   1084  ConnectWithReplacementVersionList(SSL_LIBRARY_VERSION_TLS_1_2);
   1085  client_->CheckErrorCode(SSL_ERROR_NO_CYPHER_OVERLAP);
   1086  server_->CheckErrorCode(SSL_ERROR_NO_CYPHER_OVERLAP);
   1087 }
   1088 
   1089 // 3. Server supports 1.2 and 1.3, client supports 1.2 and 1.3
   1090 // but advertises 1.2 (because we changed things).
   1091 TEST_P(TlsExtensionTest13, RemoveTls13FromVersionListBothV12) {
   1092  client_->SetOption(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, PR_TRUE);
   1093  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
   1094                           SSL_LIBRARY_VERSION_TLS_1_3);
   1095  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
   1096                           SSL_LIBRARY_VERSION_TLS_1_3);
   1097  // The downgrade check is disabled in DTLS 1.3, so all that happens when we
   1098  // tamper with the supported versions is that the Finished check fails.
   1099  ExpectAlert(client_, kTlsAlertIllegalParameter);
   1100  ConnectWithReplacementVersionList(SSL_LIBRARY_VERSION_TLS_1_2);
   1101  client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_SERVER_HELLO);
   1102  server_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   1103 }
   1104 
   1105 TEST_P(TlsExtensionTest13, HrrThenRemoveSignatureAlgorithms) {
   1106  ExpectAlert(server_, kTlsAlertMissingExtension);
   1107  HrrThenRemoveExtensionsTest(ssl_signature_algorithms_xtn,
   1108                              SSL_ERROR_MISSING_EXTENSION_ALERT,
   1109                              SSL_ERROR_MISSING_SIGNATURE_ALGORITHMS_EXTENSION);
   1110 }
   1111 
   1112 TEST_P(TlsExtensionTest13, HrrThenRemoveKeyShare) {
   1113  ExpectAlert(server_, kTlsAlertIllegalParameter);
   1114  HrrThenRemoveExtensionsTest(ssl_tls13_key_share_xtn,
   1115                              SSL_ERROR_ILLEGAL_PARAMETER_ALERT,
   1116                              SSL_ERROR_BAD_2ND_CLIENT_HELLO);
   1117 }
   1118 
   1119 TEST_P(TlsExtensionTest13, HrrThenRemoveSupportedGroups) {
   1120  ExpectAlert(server_, kTlsAlertMissingExtension);
   1121  HrrThenRemoveExtensionsTest(ssl_supported_groups_xtn,
   1122                              SSL_ERROR_MISSING_EXTENSION_ALERT,
   1123                              SSL_ERROR_MISSING_SUPPORTED_GROUPS_EXTENSION);
   1124 }
   1125 
   1126 TEST_P(TlsExtensionTest13, EmptyVersionList) {
   1127  static const uint8_t kExt[] = {0x00, 0x00};
   1128  ConnectWithBogusVersionList(kExt, sizeof(kExt));
   1129 }
   1130 
   1131 TEST_P(TlsExtensionTest13, OddVersionList) {
   1132  static const uint8_t kExt[] = {0x00, 0x01, 0x00};
   1133  ConnectWithBogusVersionList(kExt, sizeof(kExt));
   1134 }
   1135 
   1136 TEST_P(TlsExtensionTest13, SignatureAlgorithmsInvalidTls13) {
   1137  // testing the case where we ask for a invalid parameter for tls13
   1138  const uint8_t val[] = {0x00, 0x02, 0x04, 0x01};  // sha-256, rsa-pkcs1
   1139  DataBuffer extension(val, sizeof(val));
   1140  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
   1141                           client_, ssl_signature_algorithms_xtn, extension),
   1142                       kTlsAlertHandshakeFailure);
   1143 }
   1144 
   1145 // Use the stream version number for TLS 1.3 (0x0304) in DTLS.
   1146 TEST_F(TlsConnectDatagram13, TlsVersionInDtls) {
   1147  static const uint8_t kExt[] = {0x02, 0x03, 0x04};
   1148 
   1149  DataBuffer versions_buf(kExt, sizeof(kExt));
   1150  MakeTlsFilter<TlsExtensionReplacer>(client_, ssl_tls13_supported_versions_xtn,
   1151                                      versions_buf);
   1152  ConnectExpectAlert(server_, kTlsAlertProtocolVersion);
   1153  client_->CheckErrorCode(SSL_ERROR_PROTOCOL_VERSION_ALERT);
   1154  server_->CheckErrorCode(SSL_ERROR_UNSUPPORTED_VERSION);
   1155 }
   1156 
   1157 // TODO: this only tests extensions in server messages.  The client can extend
   1158 // Certificate messages, which is not checked here.
   1159 class TlsBogusExtensionTest : public TlsConnectTestBase,
   1160                              public ::testing::WithParamInterface<
   1161                                  std::tuple<SSLProtocolVariant, uint16_t>> {
   1162 public:
   1163  TlsBogusExtensionTest()
   1164      : TlsConnectTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())) {}
   1165 
   1166 protected:
   1167  virtual void ConnectAndFail(uint8_t message) = 0;
   1168 
   1169  void AddFilter(uint8_t message, uint16_t extension) {
   1170    static uint8_t empty_buf[1] = {0};
   1171    DataBuffer empty(empty_buf, 0);
   1172    auto filter =
   1173        MakeTlsFilter<TlsExtensionAppender>(server_, message, extension, empty);
   1174    if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {
   1175      filter->EnableDecryption();
   1176    }
   1177  }
   1178 
   1179  void Run(uint8_t message, uint16_t extension = 0xff) {
   1180    EnsureTlsSetup();
   1181    AddFilter(message, extension);
   1182    ConnectAndFail(message);
   1183  }
   1184 };
   1185 
   1186 class TlsBogusExtensionTestPre13 : public TlsBogusExtensionTest {
   1187 protected:
   1188  void ConnectAndFail(uint8_t) override {
   1189    ConnectExpectAlert(client_, kTlsAlertUnsupportedExtension);
   1190  }
   1191 };
   1192 
   1193 class TlsBogusExtensionTest13 : public TlsBogusExtensionTest {
   1194 protected:
   1195  void ConnectAndFail(uint8_t message) override {
   1196    if (message != kTlsHandshakeServerHello) {
   1197      ConnectExpectAlert(client_, kTlsAlertUnsupportedExtension);
   1198      return;
   1199    }
   1200 
   1201    FailWithAlert(kTlsAlertUnsupportedExtension);
   1202  }
   1203 
   1204  void FailWithAlert(uint8_t alert) {
   1205    StartConnect();
   1206    client_->Handshake();  // ClientHello
   1207    server_->Handshake();  // ServerHello
   1208 
   1209    client_->ExpectSendAlert(alert);
   1210    client_->Handshake();
   1211    if (variant_ == ssl_variant_stream) {
   1212      server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
   1213    }
   1214    server_->Handshake();
   1215  }
   1216 };
   1217 
   1218 TEST_P(TlsBogusExtensionTestPre13, AddBogusExtensionServerHello) {
   1219  Run(kTlsHandshakeServerHello);
   1220 }
   1221 
   1222 TEST_P(TlsBogusExtensionTest13, AddBogusExtensionServerHello) {
   1223  Run(kTlsHandshakeServerHello);
   1224 }
   1225 
   1226 TEST_P(TlsBogusExtensionTest13, AddBogusExtensionEncryptedExtensions) {
   1227  Run(kTlsHandshakeEncryptedExtensions);
   1228 }
   1229 
   1230 TEST_P(TlsBogusExtensionTest13, AddBogusExtensionCertificate) {
   1231  Run(kTlsHandshakeCertificate);
   1232 }
   1233 
   1234 // It's perfectly valid to set unknown extensions in CertificateRequest.
   1235 TEST_P(TlsBogusExtensionTest13, AddBogusExtensionCertificateRequest) {
   1236  server_->RequestClientAuth(false);
   1237  AddFilter(kTlsHandshakeCertificateRequest, 0xff);
   1238  ConnectExpectAlert(client_, kTlsAlertDecryptError);
   1239  client_->CheckErrorCode(SEC_ERROR_BAD_SIGNATURE);
   1240 }
   1241 
   1242 TEST_P(TlsBogusExtensionTest13, AddBogusExtensionHelloRetryRequest) {
   1243  static const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1};
   1244  server_->ConfigNamedGroups(groups);
   1245 
   1246  Run(kTlsHandshakeHelloRetryRequest);
   1247 }
   1248 
   1249 // NewSessionTicket allows unknown extensions AND it isn't protected by the
   1250 // Finished.  So adding an unknown extension doesn't cause an error.
   1251 TEST_P(TlsBogusExtensionTest13, AddBogusExtensionNewSessionTicket) {
   1252  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   1253 
   1254  AddFilter(kTlsHandshakeNewSessionTicket, 0xff);
   1255  Connect();
   1256  SendReceive();
   1257  CheckKeys();
   1258 
   1259  Reset();
   1260  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   1261  ExpectResumption(RESUME_TICKET);
   1262  Connect();
   1263  SendReceive();
   1264 }
   1265 
   1266 class TlsDisallowedExtensionTest13 : public TlsBogusExtensionTest {
   1267 protected:
   1268  void ConnectAndFail(uint8_t message) override {
   1269    ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
   1270  }
   1271 };
   1272 
   1273 TEST_P(TlsDisallowedExtensionTest13, AddVersionExtensionEncryptedExtensions) {
   1274  Run(kTlsHandshakeEncryptedExtensions, ssl_tls13_supported_versions_xtn);
   1275 }
   1276 
   1277 TEST_P(TlsDisallowedExtensionTest13, AddVersionExtensionCertificate) {
   1278  Run(kTlsHandshakeCertificate, ssl_tls13_supported_versions_xtn);
   1279 }
   1280 
   1281 TEST_P(TlsDisallowedExtensionTest13, AddVersionExtensionCertificateRequest) {
   1282  server_->RequestClientAuth(false);
   1283  Run(kTlsHandshakeCertificateRequest, ssl_tls13_supported_versions_xtn);
   1284 }
   1285 
   1286 /* For unadvertised disallowed extensions an unsupported_extension alert is
   1287 * thrown since NSS checks for unadvertised extensions before its disallowed
   1288 * extension check. */
   1289 class TlsDisallowedUnadvertisedExtensionTest13 : public TlsBogusExtensionTest {
   1290 protected:
   1291  void ConnectAndFail(uint8_t message) override {
   1292    uint8_t alert = kTlsAlertUnsupportedExtension;
   1293    if (message == kTlsHandshakeCertificateRequest) {
   1294      alert = kTlsAlertIllegalParameter;
   1295    }
   1296    ConnectExpectAlert(client_, alert);
   1297  }
   1298 };
   1299 
   1300 TEST_P(TlsDisallowedUnadvertisedExtensionTest13,
   1301       AddPSKExtensionEncryptedExtensions) {
   1302  Run(kTlsHandshakeEncryptedExtensions, ssl_tls13_pre_shared_key_xtn);
   1303 }
   1304 
   1305 TEST_P(TlsDisallowedUnadvertisedExtensionTest13, AddPSKExtensionCertificate) {
   1306  Run(kTlsHandshakeCertificate, ssl_tls13_pre_shared_key_xtn);
   1307 }
   1308 
   1309 TEST_P(TlsDisallowedUnadvertisedExtensionTest13,
   1310       AddPSKExtensionCertificateRequest) {
   1311  server_->RequestClientAuth(false);
   1312  Run(kTlsHandshakeCertificateRequest, ssl_tls13_pre_shared_key_xtn);
   1313 }
   1314 
   1315 TEST_P(TlsConnectStream, IncludePadding) {
   1316  EnsureTlsSetup();
   1317  // filters only work with particular groups
   1318  client_->ConfigNamedGroups(kNonPQDHEGroups);
   1319 
   1320  SSL_EnableTls13GreaseEch(client_->ssl_fd(), PR_FALSE);  // Don't GREASE
   1321 
   1322  // This needs to be long enough to push a TLS 1.0 ClientHello over 255, but
   1323  // short enough not to push a TLS 1.3 ClientHello over 511.
   1324  static const char* long_name =
   1325      "chickenchickenchickenchickenchickenchickenchickenchicken."
   1326      "chickenchickenchickenchickenchickenchickenchickenchicken."
   1327      "chickenchickenchickenchickenchicken.";
   1328  SECStatus rv = SSL_SetURL(client_->ssl_fd(), long_name);
   1329  EXPECT_EQ(SECSuccess, rv);
   1330 
   1331  auto capture = MakeTlsFilter<TlsExtensionCapture>(client_, ssl_padding_xtn);
   1332  client_->StartConnect();
   1333  client_->Handshake();
   1334  EXPECT_TRUE(capture->captured());
   1335 }
   1336 
   1337 TEST_F(TlsConnectDatagram13, Dtls13RejectLegacyCookie) {
   1338  EnsureTlsSetup();
   1339  MakeTlsFilter<Dtls13LegacyCookieInjector>(client_);
   1340  ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   1341  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
   1342  client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   1343 }
   1344 
   1345 TEST_P(TlsConnectGeneric, ClientHelloExtensionPermutation) {
   1346  EnsureTlsSetup();
   1347  ASSERT_TRUE(SSL_OptionSet(client_->ssl_fd(),
   1348                            SSL_ENABLE_CH_EXTENSION_PERMUTATION,
   1349                            PR_TRUE) == SECSuccess);
   1350  Connect();
   1351 }
   1352 
   1353 TEST_F(TlsConnectStreamTls13, ClientHelloExtensionPermutationWithPSK) {
   1354  EnsureTlsSetup();
   1355 
   1356  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
   1357  const uint8_t kPskDummyVal_[16] = {0x01, 0x02, 0x03, 0x04, 0x05,
   1358                                     0x06, 0x07, 0x08, 0x09, 0x0a,
   1359                                     0x0b, 0x0c, 0x0d, 0x0e, 0x0f};
   1360  SECItem psk_item;
   1361  psk_item.type = siBuffer;
   1362  psk_item.len = sizeof(kPskDummyVal_);
   1363  psk_item.data = const_cast<uint8_t*>(kPskDummyVal_);
   1364  PK11SymKey* key =
   1365      PK11_ImportSymKey(slot.get(), CKM_HKDF_KEY_GEN, PK11_OriginUnwrap,
   1366                        CKA_DERIVE, &psk_item, NULL);
   1367 
   1368  ScopedPK11SymKey scoped_psk_(key);
   1369  const std::string kPskDummyLabel_ = "NSS PSK GTEST label";
   1370  const SSLHashType kPskHash_ = ssl_hash_sha384;
   1371  AddPsk(scoped_psk_, kPskDummyLabel_, kPskHash_);
   1372 
   1373  ASSERT_TRUE(SSL_OptionSet(client_->ssl_fd(),
   1374                            SSL_ENABLE_CH_EXTENSION_PERMUTATION,
   1375                            PR_TRUE) == SECSuccess);
   1376  Connect();
   1377  SendReceive();
   1378  CheckKeys(ssl_auth_psk, ssl_sig_none);
   1379 }
   1380 
   1381 /* This test checks that the ClientHello extension order is actually permuted
   1382 * if ss->opt.chXtnPermutation is set. It is asserted that at least one out of
   1383 * 10 extension orders differs from the others.
   1384 *
   1385 * This is a probabilistic test: The default TLS 1.3 ClientHello contains 8
   1386 * extensions, leading to a 1/8! probability for any extension order and the
   1387 * same probability for two drawn extension orders to coincide.
   1388 * Since all sequences are compared against each other this leads to a false
   1389 * positive rate of (1/8!)^(n^2-n).
   1390 * To achieve a spurious failure rate << 1/2^64, we compare n=10 drawn orders.
   1391 *
   1392 * This test assures that randomisation is happening but does not check quality
   1393 * of the used Fisher-Yates shuffle. */
   1394 TEST_F(TlsConnectStreamTls13,
   1395       ClientHelloExtensionPermutationProbabilisticTest) {
   1396  std::vector<std::vector<uint16_t>> orders;
   1397 
   1398  /* Capture the extension order of 10 ClientHello messages. */
   1399  for (size_t i = 0; i < 10; i++) {
   1400    client_->StartConnect();
   1401    /* Enable ClientHello extension permutation. */
   1402    ASSERT_TRUE(SSL_OptionSet(client_->ssl_fd(),
   1403                              SSL_ENABLE_CH_EXTENSION_PERMUTATION,
   1404                              PR_TRUE) == SECSuccess);
   1405    /* Capture extension order filter. */
   1406    auto filter = MakeTlsFilter<TlsExtensionOrderCapture>(
   1407        client_, kTlsHandshakeClientHello);
   1408    /* Send ClientHello. */
   1409    client_->Handshake();
   1410    /* Remember extension order. */
   1411    orders.push_back(filter->order);
   1412    /* Reset client / server state. */
   1413    Reset();
   1414  }
   1415 
   1416  /* Check for extension order inequality. */
   1417  size_t inequal = 0;
   1418  for (auto& outerOrders : orders) {
   1419    for (auto& innerOrders : orders) {
   1420      if (outerOrders != innerOrders) {
   1421        inequal++;
   1422      }
   1423    }
   1424  }
   1425  ASSERT_TRUE(inequal >= 1);
   1426 }
   1427 
   1428 // The certificate_authorities xtn can be included in a ClientHello [RFC 8446,
   1429 // Section 4.2]
   1430 TEST_F(TlsConnectStreamTls13, ClientHelloCertAuthXtnToleration) {
   1431  EnsureTlsSetup();
   1432  uint8_t bodyBuf[3] = {0x00, 0x01, 0xff};
   1433  DataBuffer body(bodyBuf, sizeof(bodyBuf));
   1434  auto ch = MakeTlsFilter<TlsExtensionAppender>(
   1435      client_, kTlsHandshakeClientHello, ssl_tls13_certificate_authorities_xtn,
   1436      body);
   1437  // The Connection will fail because the added extension isn't in the client's
   1438  // transcript  not because the extension is unsupported (Bug 1815167).
   1439  server_->ExpectSendAlert(bad_record_mac);
   1440  client_->ExpectSendAlert(bad_record_mac);
   1441  ConnectExpectFail();
   1442  server_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
   1443  client_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
   1444 }
   1445 
   1446 INSTANTIATE_TEST_SUITE_P(
   1447    ExtensionStream, TlsExtensionTestGeneric,
   1448    ::testing::Combine(TlsConnectTestBase::kTlsVariantsStream,
   1449                       TlsConnectTestBase::kTlsVAll));
   1450 INSTANTIATE_TEST_SUITE_P(
   1451    ExtensionDatagram, TlsExtensionTestGeneric,
   1452    ::testing::Combine(TlsConnectTestBase::kTlsVariantsDatagram,
   1453                       TlsConnectTestBase::kTlsV11Plus));
   1454 INSTANTIATE_TEST_SUITE_P(ExtensionDatagramOnly, TlsExtensionTestDtls,
   1455                         TlsConnectTestBase::kTlsV11Plus);
   1456 
   1457 INSTANTIATE_TEST_SUITE_P(ExtensionTls12, TlsExtensionTest12,
   1458                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
   1459                                            TlsConnectTestBase::kTlsV12));
   1460 
   1461 INSTANTIATE_TEST_SUITE_P(ExtensionTls12Plus, TlsExtensionTest12Plus,
   1462                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
   1463                                            TlsConnectTestBase::kTlsV12Plus));
   1464 
   1465 INSTANTIATE_TEST_SUITE_P(
   1466    ExtensionPre13Stream, TlsExtensionTestPre13,
   1467    ::testing::Combine(TlsConnectTestBase::kTlsVariantsStream,
   1468                       TlsConnectTestBase::kTlsV10ToV12));
   1469 INSTANTIATE_TEST_SUITE_P(ExtensionPre13Datagram, TlsExtensionTestPre13,
   1470                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
   1471                                            TlsConnectTestBase::kTlsV11V12));
   1472 
   1473 INSTANTIATE_TEST_SUITE_P(ExtensionTls13, TlsExtensionTest13,
   1474                         TlsConnectTestBase::kTlsVariantsAll);
   1475 
   1476 INSTANTIATE_TEST_SUITE_P(
   1477    BogusExtensionStream, TlsBogusExtensionTestPre13,
   1478    ::testing::Combine(TlsConnectTestBase::kTlsVariantsStream,
   1479                       TlsConnectTestBase::kTlsV10ToV12));
   1480 INSTANTIATE_TEST_SUITE_P(
   1481    BogusExtensionDatagram, TlsBogusExtensionTestPre13,
   1482    ::testing::Combine(TlsConnectTestBase::kTlsVariantsDatagram,
   1483                       TlsConnectTestBase::kTlsV11V12));
   1484 
   1485 INSTANTIATE_TEST_SUITE_P(BogusExtension13, TlsBogusExtensionTest13,
   1486                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
   1487                                            TlsConnectTestBase::kTlsV13));
   1488 
   1489 INSTANTIATE_TEST_SUITE_P(DisallowedExtension13, TlsDisallowedExtensionTest13,
   1490                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
   1491                                            TlsConnectTestBase::kTlsV13));
   1492 
   1493 INSTANTIATE_TEST_SUITE_P(DisallowedUnadvertisedExtension13,
   1494                         TlsDisallowedUnadvertisedExtensionTest13,
   1495                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
   1496                                            TlsConnectTestBase::kTlsV13));
   1497 
   1498 }  // namespace nss_test
	tor-browser The Tor Browser
	git clone https://git.dasho.dev/tor-browser.git
	Log \| Files \| Refs \| README \| LICENSE