1 /* 2 * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #ifndef OSSL_TEST_SSL_TEST_CTX_H 11 #define OSSL_TEST_SSL_TEST_CTX_H 12 13 #include <openssl/conf.h> 14 #include <openssl/ssl.h> 15 16 typedef enum { 17 SSL_TEST_SUCCESS = 0, /* Default */ 18 SSL_TEST_SERVER_FAIL, 19 SSL_TEST_CLIENT_FAIL, 20 SSL_TEST_INTERNAL_ERROR, 21 /* Couldn't test resumption/renegotiation: original handshake failed. */ 22 SSL_TEST_FIRST_HANDSHAKE_FAILED 23 } ssl_test_result_t; 24 25 typedef enum { 26 SSL_TEST_VERIFY_NONE = 0, /* Default */ 27 SSL_TEST_VERIFY_ACCEPT_ALL, 28 SSL_TEST_VERIFY_RETRY_ONCE, 29 SSL_TEST_VERIFY_REJECT_ALL 30 } ssl_verify_callback_t; 31 32 typedef enum { 33 SSL_TEST_SERVERNAME_NONE = 0, /* Default */ 34 SSL_TEST_SERVERNAME_SERVER1, 35 SSL_TEST_SERVERNAME_SERVER2, 36 SSL_TEST_SERVERNAME_INVALID 37 } ssl_servername_t; 38 39 typedef enum { 40 SSL_TEST_SERVERNAME_CB_NONE = 0, /* Default */ 41 SSL_TEST_SERVERNAME_IGNORE_MISMATCH, 42 SSL_TEST_SERVERNAME_REJECT_MISMATCH, 43 SSL_TEST_SERVERNAME_CLIENT_HELLO_IGNORE_MISMATCH, 44 SSL_TEST_SERVERNAME_CLIENT_HELLO_REJECT_MISMATCH, 45 SSL_TEST_SERVERNAME_CLIENT_HELLO_NO_V12 46 } ssl_servername_callback_t; 47 48 typedef enum { 49 SSL_TEST_SESSION_TICKET_IGNORE = 0, /* Default */ 50 SSL_TEST_SESSION_TICKET_YES, 51 SSL_TEST_SESSION_TICKET_NO, 52 SSL_TEST_SESSION_TICKET_BROKEN /* Special test */ 53 } ssl_session_ticket_t; 54 55 typedef enum { 56 SSL_TEST_COMPRESSION_NO = 0, /* Default */ 57 SSL_TEST_COMPRESSION_YES 58 } ssl_compression_t; 59 60 typedef enum { 61 SSL_TEST_SESSION_ID_IGNORE = 0, /* Default */ 62 SSL_TEST_SESSION_ID_YES, 63 SSL_TEST_SESSION_ID_NO 64 } ssl_session_id_t; 65 66 typedef enum { 67 SSL_TEST_METHOD_TLS = 0, /* Default */ 68 SSL_TEST_METHOD_DTLS 69 } ssl_test_method_t; 70 71 typedef enum { 72 SSL_TEST_HANDSHAKE_SIMPLE = 0, /* Default */ 73 SSL_TEST_HANDSHAKE_RESUME, 74 SSL_TEST_HANDSHAKE_RENEG_SERVER, 75 SSL_TEST_HANDSHAKE_RENEG_CLIENT, 76 SSL_TEST_HANDSHAKE_KEY_UPDATE_SERVER, 77 SSL_TEST_HANDSHAKE_KEY_UPDATE_CLIENT, 78 SSL_TEST_HANDSHAKE_POST_HANDSHAKE_AUTH 79 } ssl_handshake_mode_t; 80 81 typedef enum { 82 SSL_TEST_CT_VALIDATION_NONE = 0, /* Default */ 83 SSL_TEST_CT_VALIDATION_PERMISSIVE, 84 SSL_TEST_CT_VALIDATION_STRICT 85 } ssl_ct_validation_t; 86 87 typedef enum { 88 SSL_TEST_CERT_STATUS_NONE = 0, /* Default */ 89 SSL_TEST_CERT_STATUS_GOOD_RESPONSE, 90 SSL_TEST_CERT_STATUS_BAD_RESPONSE 91 } ssl_cert_status_t; 92 93 /* 94 * Server/client settings that aren't supported by the SSL CONF library, 95 * such as callbacks. 96 */ 97 typedef struct { 98 /* One of a number of predefined custom callbacks. */ 99 ssl_verify_callback_t verify_callback; 100 /* One of a number of predefined server names use by the client */ 101 ssl_servername_t servername; 102 /* Maximum Fragment Length extension mode */ 103 int max_fragment_len_mode; 104 /* Supported NPN and ALPN protocols. A comma-separated list. */ 105 char *npn_protocols; 106 char *alpn_protocols; 107 ssl_ct_validation_t ct_validation; 108 /* Ciphersuites to set on a renegotiation */ 109 char *reneg_ciphers; 110 char *srp_user; 111 char *srp_password; 112 /* PHA enabled */ 113 int enable_pha; 114 /* Do not send extms on renegotiation */ 115 int no_extms_on_reneg; 116 } SSL_TEST_CLIENT_CONF; 117 118 typedef struct { 119 /* SNI callback (server-side). */ 120 ssl_servername_callback_t servername_callback; 121 /* Supported NPN and ALPN protocols. A comma-separated list. */ 122 char *npn_protocols; 123 char *alpn_protocols; 124 /* Whether to set a broken session ticket callback. */ 125 int broken_session_ticket; 126 /* Should we send a CertStatus message? */ 127 ssl_cert_status_t cert_status; 128 /* An SRP user known to the server. */ 129 char *srp_user; 130 char *srp_password; 131 /* Forced PHA */ 132 int force_pha; 133 char *session_ticket_app_data; 134 } SSL_TEST_SERVER_CONF; 135 136 typedef struct { 137 SSL_TEST_CLIENT_CONF client; 138 SSL_TEST_SERVER_CONF server; 139 SSL_TEST_SERVER_CONF server2; 140 } SSL_TEST_EXTRA_CONF; 141 142 typedef struct { 143 /* 144 * Global test configuration. Does not change between handshakes. 145 */ 146 /* Whether the server/client CTX should use DTLS or TLS. */ 147 ssl_test_method_t method; 148 /* Whether to test a resumed/renegotiated handshake. */ 149 ssl_handshake_mode_t handshake_mode; 150 /* 151 * How much application data to exchange (default is 256 bytes). 152 * Both peers will send |app_data_size| bytes interleaved. 153 */ 154 int app_data_size; 155 /* Maximum send fragment size. */ 156 int max_fragment_size; 157 /* KeyUpdate type */ 158 int key_update_type; 159 160 /* 161 * Extra server/client configurations. Per-handshake. 162 */ 163 /* First handshake. */ 164 SSL_TEST_EXTRA_CONF extra; 165 /* Resumed handshake. */ 166 SSL_TEST_EXTRA_CONF resume_extra; 167 168 /* 169 * Test expectations. These apply to the LAST handshake. 170 */ 171 /* Defaults to SUCCESS. */ 172 ssl_test_result_t expected_result; 173 /* Alerts. 0 if no expectation. */ 174 /* See ssl.h for alert codes. */ 175 /* Alert sent by the client / received by the server. */ 176 int expected_client_alert; 177 /* Alert sent by the server / received by the client. */ 178 int expected_server_alert; 179 /* Negotiated protocol version. 0 if no expectation. */ 180 /* See ssl.h for protocol versions. */ 181 int expected_protocol; 182 /* 183 * The expected SNI context to use. 184 * We test server-side that the server switched to the expected context. 185 * Set by the callback upon success, so if the callback wasn't called or 186 * terminated with an alert, the servername will match with 187 * SSL_TEST_SERVERNAME_NONE. 188 * Note: in the event that the servername was accepted, the client should 189 * also receive an empty SNI extension back but we have no way of probing 190 * client-side via the API that this was the case. 191 */ 192 ssl_servername_t expected_servername; 193 ssl_session_ticket_t session_ticket_expected; 194 int compression_expected; 195 /* The expected NPN/ALPN protocol to negotiate. */ 196 char *expected_npn_protocol; 197 char *expected_alpn_protocol; 198 /* Whether the second handshake is resumed or a full handshake (boolean). */ 199 int resumption_expected; 200 /* Expected temporary key type */ 201 int expected_tmp_key_type; 202 /* Expected server certificate key type */ 203 int expected_server_cert_type; 204 /* Expected server signing hash */ 205 int expected_server_sign_hash; 206 /* Expected server signature type */ 207 int expected_server_sign_type; 208 /* Expected server CA names */ 209 STACK_OF(X509_NAME) *expected_server_ca_names; 210 /* Expected client certificate key type */ 211 int expected_client_cert_type; 212 /* Expected client signing hash */ 213 int expected_client_sign_hash; 214 /* Expected client signature type */ 215 int expected_client_sign_type; 216 /* Expected CA names for client auth */ 217 STACK_OF(X509_NAME) *expected_client_ca_names; 218 /* Whether to use SCTP for the transport */ 219 int use_sctp; 220 /* Enable SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG on client side */ 221 int enable_client_sctp_label_bug; 222 /* Enable SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG on server side */ 223 int enable_server_sctp_label_bug; 224 /* Whether to expect a session id from the server */ 225 ssl_session_id_t session_id_expected; 226 char *expected_cipher; 227 /* Expected Session Ticket Application Data */ 228 char *expected_session_ticket_app_data; 229 230 OSSL_LIB_CTX *libctx; 231 } SSL_TEST_CTX; 232 233 const char *ssl_test_result_name(ssl_test_result_t result); 234 const char *ssl_alert_name(int alert); 235 const char *ssl_protocol_name(int protocol); 236 const char *ssl_verify_callback_name(ssl_verify_callback_t verify_callback); 237 const char *ssl_servername_name(ssl_servername_t server); 238 const char *ssl_servername_callback_name(ssl_servername_callback_t 239 servername_callback); 240 const char *ssl_session_ticket_name(ssl_session_ticket_t server); 241 const char *ssl_session_id_name(ssl_session_id_t server); 242 const char *ssl_test_method_name(ssl_test_method_t method); 243 const char *ssl_handshake_mode_name(ssl_handshake_mode_t mode); 244 const char *ssl_ct_validation_name(ssl_ct_validation_t mode); 245 const char *ssl_certstatus_name(ssl_cert_status_t cert_status); 246 const char *ssl_max_fragment_len_name(int MFL_mode); 247 248 /* 249 * Load the test case context from |conf|. 250 * See test/README.ssltest.md for details on the conf file format. 251 */ 252 SSL_TEST_CTX *SSL_TEST_CTX_create(const CONF *conf, const char *test_section, 253 OSSL_LIB_CTX *libctx); 254 255 SSL_TEST_CTX *SSL_TEST_CTX_new(OSSL_LIB_CTX *libctx); 256 257 void SSL_TEST_CTX_free(SSL_TEST_CTX *ctx); 258 259 #endif /* OSSL_TEST_SSL_TEST_CTX_H */ 260