dtls_mtu_test.c 5.9 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
/*
 * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <string.h>

#include <openssl/dtls1.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

#include "ssltestlib.h"
18
#include "testutil.h"
19

20
/* for SSL_READ_ETM() */
21 22 23 24 25 26 27 28 29
#include "../ssl/ssl_locl.h"

static int debug = 0;

static unsigned int clnt_psk_callback(SSL *ssl, const char *hint,
                                      char *ident, unsigned int max_ident_len,
                                      unsigned char *psk,
                                      unsigned int max_psk_len)
{
30
    BIO_snprintf(ident, max_ident_len, "psk");
31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

    if (max_psk_len > 20)
        max_psk_len = 20;
    memset(psk, 0x5a, max_psk_len);

    return max_psk_len;
}

static unsigned int srvr_psk_callback(SSL *ssl, const char *identity,
                                      unsigned char *psk,
                                      unsigned int max_psk_len)
{
    if (max_psk_len > 20)
        max_psk_len = 20;
    memset(psk, 0x5a, max_psk_len);
    return max_psk_len;
}

static int mtu_test(SSL_CTX *ctx, const char *cs, int no_etm)
{
    SSL *srvr_ssl = NULL, *clnt_ssl = NULL;
    BIO *sc_bio = NULL;
    int i;
    size_t s;
    size_t mtus[30];
    unsigned char buf[600];
    int rv = 0;

    memset(buf, 0x5a, sizeof(buf));

61 62 63
    if (!TEST_true(create_ssl_objects(ctx, ctx, &srvr_ssl, &clnt_ssl,
                                      NULL, NULL)))
        goto end;
64 65 66 67

    if (no_etm)
        SSL_set_options(srvr_ssl, SSL_OP_NO_ENCRYPT_THEN_MAC);

68 69 70 71 72 73
    if (!TEST_true(SSL_set_cipher_list(srvr_ssl, cs))
            || !TEST_true(SSL_set_cipher_list(clnt_ssl, cs))
            || !TEST_ptr(sc_bio = SSL_get_rbio(srvr_ssl))
            || !TEST_true(create_ssl_connection(clnt_ssl, srvr_ssl,
                                                SSL_ERROR_NONE)))
        goto end;
74 75 76 77 78 79 80 81 82 83

    if (debug)
        printf("Channel established\n");

    /* For record MTU values between 500 and 539, call DTLS_get_data_mtu()
     * to query the payload MTU which will fit. */
    for (i = 0; i < 30; i++) {
        SSL_set_mtu(clnt_ssl, 500 + i);
        mtus[i] = DTLS_get_data_mtu(clnt_ssl);
        if (debug)
84 85 86 87 88 89
            TEST_info("%s%s MTU for record mtu %d = %lu",
                      cs, no_etm ? "-noEtM" : "",
                      500 + i, (unsigned long)mtus[i]);
        if (!TEST_size_t_ne(mtus[i], 0)) {
            TEST_info("Cipher %s MTU %d", cs, 500 + i);
            goto end;
90 91 92 93 94 95
        }
    }

    /* Now get out of the way */
    SSL_set_mtu(clnt_ssl, 1000);

96 97 98 99
    /*
     * Now for all values in the range of payload MTUs, send a payload of
     * that size and see what actual record size we end up with.
     */
100 101
    for (s = mtus[0]; s <= mtus[29]; s++) {
        size_t reclen;
102 103 104

        if (!TEST_int_eq(SSL_write(clnt_ssl, buf, s), (int)s))
            goto end;
105 106 107 108 109 110 111
        reclen = BIO_read(sc_bio, buf, sizeof(buf));
        if (debug)
            printf("record %"OSSLzu" for payload %"OSSLzu"\n", reclen, s);

        for (i = 0; i < 30; i++) {
            /* DTLS_get_data_mtu() with record MTU 500+i returned mtus[i] ... */

112 113 114 115 116 117 118 119 120
            if (!TEST_false(s <= mtus[i] && reclen > (size_t)(500 + i))) {
                /*
                 * We sent a packet smaller than or equal to mtus[j] and
                 * that made a record *larger* than the record MTU 500+j!
                 */
                TEST_error("%s: s=%lu, mtus[i]=%lu, reclen=%lu, i=%d",
                           cs, (unsigned long)s, (unsigned long)mtus[i],
                           (unsigned long)reclen, 500 + i);
                goto end;
121
            }
122 123 124
            if (!TEST_false(s > mtus[i] && reclen <= (size_t)(500 + i))) {
                /*
                 * We sent a *larger* packet than mtus[i] and that *still*
125
                 * fits within the record MTU 500+i, so DTLS_get_data_mtu()
126 127 128 129 130 131
                 * was overly pessimistic.
                 */
                TEST_error("%s: s=%lu, mtus[i]=%lu, reclen=%lu, i=%d",
                           cs, (unsigned long)s, (unsigned long)mtus[i],
                           (unsigned long)reclen, 500 + i);
                goto end;
132 133 134 135
            }
        }
    }
    rv = 1;
136
    if (SSL_READ_ETM(clnt_ssl))
137
        rv = 2;
138
 end:
139 140 141 142 143
    SSL_free(clnt_ssl);
    SSL_free(srvr_ssl);
    return rv;
}

144
static int run_mtu_tests(void)
145
{
146
    SSL_CTX *ctx = NULL;
147
    STACK_OF(SSL_CIPHER) *ciphers;
148 149 150 151
    int i, ret = 0;

    if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_method())))
        goto end;
152 153 154 155 156

    SSL_CTX_set_psk_server_callback(ctx, srvr_psk_callback);
    SSL_CTX_set_psk_client_callback(ctx, clnt_psk_callback);
    SSL_CTX_set_security_level(ctx, 0);

157 158 159 160 161 162 163
    /*
     * We only care about iterating over each enc/mac; we don't want to
     * repeat the test for each auth/kx variant. So keep life simple and
     * only do (non-DH) PSK.
     */
    if (!TEST_true(SSL_CTX_set_cipher_list(ctx, "PSK")))
        goto end;
164 165 166 167 168 169 170

    ciphers = SSL_CTX_get_ciphers(ctx);
    for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
        const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(ciphers, i);
        const char *cipher_name = SSL_CIPHER_get_name(cipher);

        /* As noted above, only one test for each enc/mac variant. */
171
        if (strncmp(cipher_name, "PSK-", 4) != 0)
172 173
            continue;

174
        if (!TEST_int_gt(ret = mtu_test(ctx, cipher_name, 0), 0))
175
            break;
176 177
        TEST_info("%s OK", cipher_name);
        if (ret == 1)
178 179 180
            continue;

        /* mtu_test() returns 2 if it used Encrypt-then-MAC */
181
        if (!TEST_int_gt(ret = mtu_test(ctx, cipher_name, 1), 0))
182
            break;
183
        TEST_info("%s without EtM OK", cipher_name);
184
    }
185 186

 end:
187
    SSL_CTX_free(ctx);
188 189 190
    bio_s_mempacket_test_free();
    return ret;
}
191

192 193 194
void register_tests()
{
    ADD_TEST(run_mtu_tests);
195
}