1 /*
2 * Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9 #include <openssl/ssl.h>
10
11 #include "helpers/ssltestlib.h"
12 #include "internal/dane.h"
13 #include "testutil.h"
14
15 #undef OSSL_NO_USABLE_TLS1_3
16 #if defined(OPENSSL_NO_TLS1_3) \
17 || (defined(OPENSSL_NO_EC) && defined(OPENSSL_NO_DH))
18 /*
19 * If we don't have ec or dh then there are no built-in groups that are usable
20 * with TLSv1.3
21 */
22 # define OSSL_NO_USABLE_TLS1_3
23 #endif
24
25 static char *certsdir = NULL;
26 static char *rootcert = NULL;
27 static char *cert = NULL;
28 static char *privkey = NULL;
29 static char *cert2 = NULL;
30 static char *privkey2 = NULL;
31 static char *cert448 = NULL;
32 static char *privkey448 = NULL;
33 static char *cert25519 = NULL;
34 static char *privkey25519 = NULL;
35 static OSSL_LIB_CTX *libctx = NULL;
36 static OSSL_PROVIDER *defctxnull = NULL;
37
38 static const unsigned char cert_type_rpk[] = { TLSEXT_cert_type_rpk, TLSEXT_cert_type_x509 };
39 static const unsigned char SID_CTX[] = { 'r', 'p', 'k' };
40
rpk_verify_client_cb(int ok,X509_STORE_CTX * ctx)41 static int rpk_verify_client_cb(int ok, X509_STORE_CTX *ctx)
42 {
43 int err = X509_STORE_CTX_get_error(ctx);
44
45 if (X509_STORE_CTX_get0_rpk(ctx) != NULL) {
46 if (err != X509_V_OK) {
47 TEST_info("rpk_verify_client_cb: ok=%d err=%d", ok, err);
48 return 0;
49 }
50 }
51 return 1;
52 }
rpk_verify_server_cb(int ok,X509_STORE_CTX * ctx)53 static int rpk_verify_server_cb(int ok, X509_STORE_CTX *ctx)
54 {
55 int err = X509_STORE_CTX_get_error(ctx);
56
57 if (X509_STORE_CTX_get0_rpk(ctx) != NULL) {
58 if (err != X509_V_OK) {
59 TEST_info("rpk_verify_server_cb: ok=%d err=%d", ok, err);
60 return 0;
61 }
62 }
63 return 1;
64 }
65
66 /*
67 * Test dimensions:
68 * (2) server_cert_type RPK off/on for server
69 * (2) client_cert_type RPK off/on for server
70 * (2) server_cert_type RPK off/on for client
71 * (2) client_cert_type RPK off/on for client
72 * (4) RSA vs ECDSA vs Ed25519 vs Ed448 certificates
73 * (2) TLSv1.2 vs TLSv1.3
74 *
75 * Tests:
76 * idx = 0 - is the normal success case, certificate, single peer key
77 * idx = 1 - only a private key
78 * idx = 2 - add client authentication
79 * idx = 3 - add second peer key (rootcert.pem)
80 * idx = 4 - add second peer key (different, RSA or ECDSA)
81 * idx = 5 - reverse peer keys (rootcert.pem, different order)
82 * idx = 6 - reverse peer keys (RSA or ECDSA, different order)
83 * idx = 7 - expects failure due to mismatched key (RSA or ECDSA)
84 * idx = 8 - expects failure due to no configured key on client
85 * idx = 9 - add client authentication (PHA)
86 * idx = 10 - add client authentication (privake key only)
87 * idx = 11 - simple resumption
88 * idx = 12 - simple resumption, no ticket
89 * idx = 13 - resumption with client authentication
90 * idx = 14 - resumption with client authentication, no ticket
91 * idx = 15 - like 0, but use non-default libctx
92 *
93 * 16 * 2 * 4 * 2 * 2 * 2 * 2 = 2048 tests
94 */
test_rpk(int idx)95 static int test_rpk(int idx)
96 {
97 # define RPK_TESTS 16
98 # define RPK_DIMS (2 * 4 * 2 * 2 * 2 * 2)
99 SSL_CTX *cctx = NULL, *sctx = NULL;
100 SSL *clientssl = NULL, *serverssl = NULL;
101 EVP_PKEY *pkey = NULL, *other_pkey = NULL, *root_pkey = NULL;
102 X509 *x509 = NULL, *other_x509 = NULL, *root_x509 = NULL;
103 int testresult = 0, ret, expected = 1;
104 int client_expected = X509_V_OK;
105 int verify;
106 int tls_version;
107 char *cert_file = NULL;
108 char *privkey_file = NULL;
109 char *other_cert_file = NULL;
110 SSL_SESSION *client_sess = NULL;
111 SSL_SESSION *server_sess = NULL;
112 int idx_server_server_rpk, idx_server_client_rpk;
113 int idx_client_server_rpk, idx_client_client_rpk;
114 int idx_cert, idx_prot;
115 int client_auth = 0;
116 int resumption = 0;
117 long server_verify_result = 0;
118 long client_verify_result = 0;
119 OSSL_LIB_CTX *test_libctx = NULL;
120
121 if (!TEST_int_le(idx, RPK_TESTS * RPK_DIMS))
122 return 0;
123
124 idx_server_server_rpk = idx / (RPK_TESTS * 2 * 4 * 2 * 2 * 2);
125 idx %= RPK_TESTS * 2 * 4 * 2 * 2 * 2;
126 idx_server_client_rpk = idx / (RPK_TESTS * 2 * 4 * 2 * 2);
127 idx %= RPK_TESTS * 2 * 4 * 2 * 2;
128 idx_client_server_rpk = idx / (RPK_TESTS * 2 * 4 * 2);
129 idx %= RPK_TESTS * 2 * 4 * 2;
130 idx_client_client_rpk = idx / (RPK_TESTS * 2 * 4);
131 idx %= RPK_TESTS * 2 * 4;
132 idx_cert = idx / (RPK_TESTS * 2);
133 idx %= RPK_TESTS * 2;
134 idx_prot = idx / RPK_TESTS;
135 idx %= RPK_TESTS;
136
137 /* Load "root" cert/pubkey */
138 root_x509 = load_cert_pem(rootcert, NULL);
139 if (!TEST_ptr(root_x509))
140 goto end;
141 root_pkey = X509_get0_pubkey(root_x509);
142 if (!TEST_ptr(root_pkey))
143 goto end;
144
145 switch (idx_cert) {
146 case 0:
147 /* use RSA */
148 cert_file = cert;
149 privkey_file = privkey;
150 other_cert_file = cert2;
151 break;
152 #ifndef OPENSSL_NO_ECDSA
153 case 1:
154 /* use ECDSA */
155 cert_file = cert2;
156 privkey_file = privkey2;
157 other_cert_file = cert;
158 break;
159 # ifndef OPENSSL_NO_ECX
160 case 2:
161 /* use Ed448 */
162 cert_file = cert448;
163 privkey_file = privkey448;
164 other_cert_file = cert;
165 break;
166 case 3:
167 /* use Ed25519 */
168 cert_file = cert25519;
169 privkey_file = privkey25519;
170 other_cert_file = cert;
171 break;
172 # endif
173 #endif
174 default:
175 testresult = TEST_skip("EDCSA disabled");
176 goto end;
177 }
178 /* Load primary cert */
179 x509 = load_cert_pem(cert_file, NULL);
180 if (!TEST_ptr(x509))
181 goto end;
182 pkey = X509_get0_pubkey(x509);
183 /* load other cert */
184 other_x509 = load_cert_pem(other_cert_file, NULL);
185 if (!TEST_ptr(other_x509))
186 goto end;
187 other_pkey = X509_get0_pubkey(other_x509);
188 #ifdef OPENSSL_NO_ECDSA
189 /* Can't get other_key if it's ECDSA */
190 if (other_pkey == NULL && idx_cert == 0
191 && (idx == 4 || idx == 6 || idx == 7)) {
192 testresult = TEST_skip("EDCSA disabled");
193 goto end;
194 }
195 #endif
196
197 switch (idx_prot) {
198 case 0:
199 #ifdef OSSL_NO_USABLE_TLS1_3
200 testresult = TEST_skip("TLSv1.3 disabled");
201 goto end;
202 #else
203 tls_version = TLS1_3_VERSION;
204 break;
205 #endif
206 case 1:
207 #ifdef OPENSSL_NO_TLS1_2
208 testresult = TEST_skip("TLSv1.2 disabled");
209 goto end;
210 #else
211 tls_version = TLS1_2_VERSION;
212 break;
213 #endif
214 default:
215 goto end;
216 }
217
218 if (idx == 15) {
219 test_libctx = libctx;
220 defctxnull = OSSL_PROVIDER_load(NULL, "null");
221 if (!TEST_ptr(defctxnull))
222 goto end;
223 }
224 if (!TEST_true(create_ssl_ctx_pair(test_libctx,
225 TLS_server_method(), TLS_client_method(),
226 tls_version, tls_version,
227 &sctx, &cctx, NULL, NULL)))
228 goto end;
229
230 if (idx_server_server_rpk)
231 if (!TEST_true(SSL_CTX_set1_server_cert_type(sctx, cert_type_rpk, sizeof(cert_type_rpk))))
232 goto end;
233 if (idx_server_client_rpk)
234 if (!TEST_true(SSL_CTX_set1_client_cert_type(sctx, cert_type_rpk, sizeof(cert_type_rpk))))
235 goto end;
236 if (idx_client_server_rpk)
237 if (!TEST_true(SSL_CTX_set1_server_cert_type(cctx, cert_type_rpk, sizeof(cert_type_rpk))))
238 goto end;
239 if (idx_client_client_rpk)
240 if (!TEST_true(SSL_CTX_set1_client_cert_type(cctx, cert_type_rpk, sizeof(cert_type_rpk))))
241 goto end;
242 if (!TEST_true(SSL_CTX_set_session_id_context(sctx, SID_CTX, sizeof(SID_CTX))))
243 goto end;
244 if (!TEST_true(SSL_CTX_set_session_id_context(cctx, SID_CTX, sizeof(SID_CTX))))
245 goto end;
246
247 if (!TEST_int_gt(SSL_CTX_dane_enable(sctx), 0))
248 goto end;
249 if (!TEST_int_gt(SSL_CTX_dane_enable(cctx), 0))
250 goto end;
251
252 /* NEW */
253 SSL_CTX_set_verify(cctx, SSL_VERIFY_PEER, rpk_verify_client_cb);
254
255 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
256 NULL, NULL)))
257 goto end;
258
259 if (!TEST_int_gt(SSL_dane_enable(serverssl, NULL), 0))
260 goto end;
261 if (!TEST_int_gt(SSL_dane_enable(clientssl, "example.com"), 0))
262 goto end;
263
264 /* Set private key and certificate */
265 if (!TEST_int_eq(SSL_use_PrivateKey_file(serverssl, privkey_file, SSL_FILETYPE_PEM), 1))
266 goto end;
267 /* Only a private key */
268 if (idx == 1) {
269 if (idx_server_server_rpk == 0 || idx_client_server_rpk == 0)
270 expected = 0;
271 } else {
272 /* Add certificate */
273 if (!TEST_int_eq(SSL_use_certificate_file(serverssl, cert_file, SSL_FILETYPE_PEM), 1))
274 goto end;
275 if (!TEST_int_eq(SSL_check_private_key(serverssl), 1))
276 goto end;
277 }
278
279 switch (idx) {
280 default:
281 if (!TEST_true(idx < RPK_TESTS))
282 goto end;
283 break;
284 case 0:
285 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
286 goto end;
287 break;
288 case 1:
289 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
290 goto end;
291 break;
292 case 2:
293 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
294 goto end;
295 if (!TEST_true(SSL_add_expected_rpk(serverssl, pkey)))
296 goto end;
297 /* Use the same key for client auth */
298 if (!TEST_int_eq(SSL_use_PrivateKey_file(clientssl, privkey_file, SSL_FILETYPE_PEM), 1))
299 goto end;
300 if (!TEST_int_eq(SSL_use_certificate_file(clientssl, cert_file, SSL_FILETYPE_PEM), 1))
301 goto end;
302 if (!TEST_int_eq(SSL_check_private_key(clientssl), 1))
303 goto end;
304 SSL_set_verify(serverssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, rpk_verify_server_cb);
305 client_auth = 1;
306 break;
307 case 3:
308 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
309 goto end;
310 if (!TEST_true(SSL_add_expected_rpk(clientssl, root_pkey)))
311 goto end;
312 break;
313 case 4:
314 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
315 goto end;
316 if (!TEST_true(SSL_add_expected_rpk(clientssl, other_pkey)))
317 goto end;
318 break;
319 case 5:
320 if (!TEST_true(SSL_add_expected_rpk(clientssl, root_pkey)))
321 goto end;
322 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
323 goto end;
324 break;
325 case 6:
326 if (!TEST_true(SSL_add_expected_rpk(clientssl, other_pkey)))
327 goto end;
328 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
329 goto end;
330 break;
331 case 7:
332 if (idx_server_server_rpk == 1 && idx_client_server_rpk == 1)
333 client_expected = -1;
334 if (!TEST_true(SSL_add_expected_rpk(clientssl, other_pkey)))
335 goto end;
336 client_verify_result = X509_V_ERR_DANE_NO_MATCH;
337 break;
338 case 8:
339 if (idx_server_server_rpk == 1 && idx_client_server_rpk == 1)
340 client_expected = -1;
341 /* no peer keys */
342 client_verify_result = X509_V_ERR_RPK_UNTRUSTED;
343 break;
344 case 9:
345 if (tls_version != TLS1_3_VERSION) {
346 testresult = TEST_skip("PHA requires TLSv1.3");
347 goto end;
348 }
349 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
350 goto end;
351 if (!TEST_true(SSL_add_expected_rpk(serverssl, pkey)))
352 goto end;
353 /* Use the same key for client auth */
354 if (!TEST_int_eq(SSL_use_PrivateKey_file(clientssl, privkey_file, SSL_FILETYPE_PEM), 1))
355 goto end;
356 if (!TEST_int_eq(SSL_use_certificate_file(clientssl, cert_file, SSL_FILETYPE_PEM), 1))
357 goto end;
358 if (!TEST_int_eq(SSL_check_private_key(clientssl), 1))
359 goto end;
360 SSL_set_verify(serverssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_POST_HANDSHAKE, rpk_verify_server_cb);
361 SSL_set_post_handshake_auth(clientssl, 1);
362 client_auth = 1;
363 break;
364 case 10:
365 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
366 goto end;
367 if (!TEST_true(SSL_add_expected_rpk(serverssl, pkey)))
368 goto end;
369 /* Use the same key for client auth */
370 if (!TEST_int_eq(SSL_use_PrivateKey_file(clientssl, privkey_file, SSL_FILETYPE_PEM), 1))
371 goto end;
372 /* Since there's no cert, this is expected to fail without RPK support */
373 if (!idx_server_client_rpk || !idx_client_client_rpk)
374 expected = 0;
375 SSL_set_verify(serverssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, rpk_verify_server_cb);
376 client_auth = 1;
377 break;
378 case 11:
379 if (!idx_server_server_rpk || !idx_client_server_rpk) {
380 testresult = TEST_skip("Only testing resumption with server RPK");
381 goto end;
382 }
383 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
384 goto end;
385 resumption = 1;
386 break;
387 case 12:
388 if (!idx_server_server_rpk || !idx_client_server_rpk) {
389 testresult = TEST_skip("Only testing resumption with server RPK");
390 goto end;
391 }
392 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
393 goto end;
394 SSL_set_options(serverssl, SSL_OP_NO_TICKET);
395 SSL_set_options(clientssl, SSL_OP_NO_TICKET);
396 resumption = 1;
397 break;
398 case 13:
399 if (!idx_server_server_rpk || !idx_client_server_rpk) {
400 testresult = TEST_skip("Only testing resumption with server RPK");
401 goto end;
402 }
403 if (!idx_server_client_rpk || !idx_client_client_rpk) {
404 testresult = TEST_skip("Only testing client authentication resumption with client RPK");
405 goto end;
406 }
407 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
408 goto end;
409 if (!TEST_true(SSL_add_expected_rpk(serverssl, pkey)))
410 goto end;
411 /* Use the same key for client auth */
412 if (!TEST_int_eq(SSL_use_PrivateKey_file(clientssl, privkey_file, SSL_FILETYPE_PEM), 1))
413 goto end;
414 if (!TEST_int_eq(SSL_use_certificate_file(clientssl, cert_file, SSL_FILETYPE_PEM), 1))
415 goto end;
416 if (!TEST_int_eq(SSL_check_private_key(clientssl), 1))
417 goto end;
418 SSL_set_verify(serverssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, rpk_verify_server_cb);
419 client_auth = 1;
420 resumption = 1;
421 break;
422 case 14:
423 if (!idx_server_server_rpk || !idx_client_server_rpk) {
424 testresult = TEST_skip("Only testing resumption with server RPK");
425 goto end;
426 }
427 if (!idx_server_client_rpk || !idx_client_client_rpk) {
428 testresult = TEST_skip("Only testing client authentication resumption with client RPK");
429 goto end;
430 }
431 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
432 goto end;
433 if (!TEST_true(SSL_add_expected_rpk(serverssl, pkey)))
434 goto end;
435 /* Use the same key for client auth */
436 if (!TEST_int_eq(SSL_use_PrivateKey_file(clientssl, privkey_file, SSL_FILETYPE_PEM), 1))
437 goto end;
438 if (!TEST_int_eq(SSL_use_certificate_file(clientssl, cert_file, SSL_FILETYPE_PEM), 1))
439 goto end;
440 if (!TEST_int_eq(SSL_check_private_key(clientssl), 1))
441 goto end;
442 SSL_set_verify(serverssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, rpk_verify_server_cb);
443 SSL_set_options(serverssl, SSL_OP_NO_TICKET);
444 SSL_set_options(clientssl, SSL_OP_NO_TICKET);
445 client_auth = 1;
446 resumption = 1;
447 break;
448 case 15:
449 if (!TEST_true(SSL_add_expected_rpk(clientssl, pkey)))
450 goto end;
451 break;
452 }
453
454 ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
455 if (!TEST_int_eq(expected, ret))
456 goto end;
457
458 /* Make sure client gets RPK or certificate as configured */
459 if (expected == 1) {
460 if (idx_server_server_rpk && idx_client_server_rpk) {
461 if (!TEST_long_eq(SSL_get_verify_result(clientssl), client_verify_result))
462 goto end;
463 if (!TEST_ptr(SSL_get0_peer_rpk(clientssl)))
464 goto end;
465 if (!TEST_int_eq(SSL_get_negotiated_server_cert_type(serverssl), TLSEXT_cert_type_rpk))
466 goto end;
467 if (!TEST_int_eq(SSL_get_negotiated_server_cert_type(clientssl), TLSEXT_cert_type_rpk))
468 goto end;
469 } else {
470 if (!TEST_ptr(SSL_get0_peer_certificate(clientssl)))
471 goto end;
472 if (!TEST_int_eq(SSL_get_negotiated_server_cert_type(serverssl), TLSEXT_cert_type_x509))
473 goto end;
474 if (!TEST_int_eq(SSL_get_negotiated_server_cert_type(clientssl), TLSEXT_cert_type_x509))
475 goto end;
476 }
477 }
478
479 if (idx == 9) {
480 /* Make PHA happen... */
481 if (!TEST_true(SSL_verify_client_post_handshake(serverssl)))
482 goto end;
483 if (!TEST_true(SSL_do_handshake(serverssl)))
484 goto end;
485 if (!TEST_int_le(SSL_read(clientssl, NULL, 0), 0))
486 goto end;
487 if (!TEST_int_le(SSL_read(serverssl, NULL, 0), 0))
488 goto end;
489 }
490
491 /* Make sure server gets an RPK or certificate as configured */
492 if (client_auth) {
493 if (idx_server_client_rpk && idx_client_client_rpk) {
494 if (!TEST_long_eq(SSL_get_verify_result(serverssl), server_verify_result))
495 goto end;
496 if (!TEST_ptr(SSL_get0_peer_rpk(serverssl)))
497 goto end;
498 if (!TEST_int_eq(SSL_get_negotiated_client_cert_type(serverssl), TLSEXT_cert_type_rpk))
499 goto end;
500 if (!TEST_int_eq(SSL_get_negotiated_client_cert_type(clientssl), TLSEXT_cert_type_rpk))
501 goto end;
502 } else {
503 /* only if connection is expected to succeed */
504 if (expected == 1 && !TEST_ptr(SSL_get0_peer_certificate(serverssl)))
505 goto end;
506 if (!TEST_int_eq(SSL_get_negotiated_client_cert_type(serverssl), TLSEXT_cert_type_x509))
507 goto end;
508 if (!TEST_int_eq(SSL_get_negotiated_client_cert_type(clientssl), TLSEXT_cert_type_x509))
509 goto end;
510 }
511 }
512
513 if (resumption) {
514 EVP_PKEY *client_pkey = NULL;
515 EVP_PKEY *server_pkey = NULL;
516
517 if (!TEST_ptr((client_sess = SSL_get1_session(clientssl)))
518 || !TEST_ptr((client_pkey = SSL_SESSION_get0_peer_rpk(client_sess))))
519 goto end;
520 if (client_auth) {
521 if (!TEST_ptr((server_sess = SSL_get1_session(serverssl)))
522 || !TEST_ptr((server_pkey = SSL_SESSION_get0_peer_rpk(server_sess))))
523 goto end;
524 }
525 SSL_shutdown(clientssl);
526 SSL_shutdown(serverssl);
527 SSL_free(clientssl);
528 SSL_free(serverssl);
529 serverssl = clientssl = NULL;
530
531 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
532 NULL, NULL))
533 || !TEST_true(SSL_set_session(clientssl, client_sess)))
534 goto end;
535
536 /* Set private key (and maybe certificate) */
537 if (!TEST_int_eq(SSL_use_PrivateKey_file(serverssl, privkey_file, SSL_FILETYPE_PEM), 1))
538 goto end;
539 if (!TEST_int_eq(SSL_use_certificate_file(serverssl, cert_file, SSL_FILETYPE_PEM), 1))
540 goto end;
541 if (!TEST_int_eq(SSL_check_private_key(serverssl), 1))
542 goto end;
543 if (!TEST_int_gt(SSL_dane_enable(serverssl, "example.com"), 0))
544 goto end;
545 if (!TEST_int_gt(SSL_dane_enable(clientssl, "example.com"), 0))
546 goto end;
547
548 switch (idx) {
549 default:
550 break;
551 case 11:
552 if (!TEST_true(SSL_add_expected_rpk(clientssl, client_pkey)))
553 goto end;
554 break;
555 case 12:
556 if (!TEST_true(SSL_add_expected_rpk(clientssl, client_pkey)))
557 goto end;
558 SSL_set_options(clientssl, SSL_OP_NO_TICKET);
559 SSL_set_options(serverssl, SSL_OP_NO_TICKET);
560 break;
561 case 13:
562 if (!TEST_true(SSL_add_expected_rpk(clientssl, client_pkey)))
563 goto end;
564 if (!TEST_true(SSL_add_expected_rpk(serverssl, server_pkey)))
565 goto end;
566 /* Use the same key for client auth */
567 if (!TEST_int_eq(SSL_use_PrivateKey_file(clientssl, privkey_file, SSL_FILETYPE_PEM), 1))
568 goto end;
569 if (!TEST_int_eq(SSL_use_certificate_file(clientssl, cert_file, SSL_FILETYPE_PEM), 1))
570 goto end;
571 if (!TEST_int_eq(SSL_check_private_key(clientssl), 1))
572 goto end;
573 SSL_set_verify(serverssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, rpk_verify_server_cb);
574 break;
575 case 14:
576 if (!TEST_true(SSL_add_expected_rpk(clientssl, client_pkey)))
577 goto end;
578 if (!TEST_true(SSL_add_expected_rpk(serverssl, server_pkey)))
579 goto end;
580 /* Use the same key for client auth */
581 if (!TEST_int_eq(SSL_use_PrivateKey_file(clientssl, privkey_file, SSL_FILETYPE_PEM), 1))
582 goto end;
583 if (!TEST_int_eq(SSL_use_certificate_file(clientssl, cert_file, SSL_FILETYPE_PEM), 1))
584 goto end;
585 if (!TEST_int_eq(SSL_check_private_key(clientssl), 1))
586 goto end;
587 SSL_set_verify(serverssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, rpk_verify_server_cb);
588 SSL_set_options(serverssl, SSL_OP_NO_TICKET);
589 SSL_set_options(clientssl, SSL_OP_NO_TICKET);
590 break;
591 }
592
593 ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
594 if (!TEST_int_eq(expected, ret))
595 goto end;
596 verify = SSL_get_verify_result(clientssl);
597 if (!TEST_int_eq(client_expected, verify))
598 goto end;
599 if (!TEST_true(SSL_session_reused(clientssl)))
600 goto end;
601
602 if (!TEST_ptr(SSL_get0_peer_rpk(clientssl)))
603 goto end;
604 if (!TEST_int_eq(SSL_get_negotiated_server_cert_type(serverssl), TLSEXT_cert_type_rpk))
605 goto end;
606 if (!TEST_int_eq(SSL_get_negotiated_server_cert_type(clientssl), TLSEXT_cert_type_rpk))
607 goto end;
608
609 if (client_auth) {
610 if (!TEST_ptr(SSL_get0_peer_rpk(serverssl)))
611 goto end;
612 if (!TEST_int_eq(SSL_get_negotiated_client_cert_type(serverssl), TLSEXT_cert_type_rpk))
613 goto end;
614 if (!TEST_int_eq(SSL_get_negotiated_client_cert_type(clientssl), TLSEXT_cert_type_rpk))
615 goto end;
616 }
617 }
618
619 testresult = 1;
620
621 end:
622 OSSL_PROVIDER_unload(defctxnull);
623 defctxnull = NULL;
624 SSL_SESSION_free(client_sess);
625 SSL_SESSION_free(server_sess);
626 SSL_free(serverssl);
627 SSL_free(clientssl);
628 SSL_CTX_free(sctx);
629 SSL_CTX_free(cctx);
630 X509_free(x509);
631 X509_free(other_x509);
632 X509_free(root_x509);
633
634 if (testresult == 0) {
635 TEST_info("idx_ss_rpk=%d, idx_sc_rpk=%d, idx_cs_rpk=%d, idx_cc_rpk=%d, idx_cert=%d, idx_prot=%d, idx=%d",
636 idx_server_server_rpk, idx_server_client_rpk,
637 idx_client_server_rpk, idx_client_client_rpk,
638 idx_cert, idx_prot, idx);
639 }
640 return testresult;
641 }
642
test_rpk_api(void)643 static int test_rpk_api(void)
644 {
645 int ret = 0;
646 SSL_CTX *cctx = NULL, *sctx = NULL;
647 unsigned char cert_type_dups[] = { TLSEXT_cert_type_rpk,
648 TLSEXT_cert_type_x509,
649 TLSEXT_cert_type_x509 };
650 unsigned char cert_type_bad[] = { 0xFF };
651 unsigned char cert_type_extra[] = { TLSEXT_cert_type_rpk,
652 TLSEXT_cert_type_x509,
653 0xFF };
654 unsigned char cert_type_unsup[] = { TLSEXT_cert_type_pgp,
655 TLSEXT_cert_type_1609dot2 };
656 unsigned char cert_type_just_x509[] = { TLSEXT_cert_type_x509 };
657 unsigned char cert_type_just_rpk[] = { TLSEXT_cert_type_rpk };
658
659 if (!TEST_true(create_ssl_ctx_pair(NULL,
660 TLS_server_method(), TLS_client_method(),
661 TLS1_2_VERSION, TLS1_2_VERSION,
662 &sctx, &cctx, NULL, NULL)))
663 goto end;
664
665 if (!TEST_false(SSL_CTX_set1_server_cert_type(sctx, cert_type_dups, sizeof(cert_type_dups))))
666 goto end;
667
668 if (!TEST_false(SSL_CTX_set1_server_cert_type(sctx, cert_type_bad, sizeof(cert_type_bad))))
669 goto end;
670
671 if (!TEST_false(SSL_CTX_set1_server_cert_type(sctx, cert_type_extra, sizeof(cert_type_extra))))
672 goto end;
673
674 if (!TEST_false(SSL_CTX_set1_server_cert_type(sctx, cert_type_unsup, sizeof(cert_type_unsup))))
675 goto end;
676
677 if (!TEST_true(SSL_CTX_set1_server_cert_type(sctx, cert_type_just_x509, sizeof(cert_type_just_x509))))
678 goto end;
679
680 if (!TEST_true(SSL_CTX_set1_server_cert_type(sctx, cert_type_just_rpk, sizeof(cert_type_just_rpk))))
681 goto end;
682
683 ret = 1;
684 end:
685 SSL_CTX_free(sctx);
686 SSL_CTX_free(cctx);
687 return ret;
688 }
689 OPT_TEST_DECLARE_USAGE("certdir\n")
690
setup_tests(void)691 int setup_tests(void)
692 {
693 if (!test_skip_common_options()) {
694 TEST_error("Error parsing test options\n");
695 return 0;
696 }
697
698 if (!TEST_ptr(certsdir = test_get_argument(0)))
699 return 0;
700
701 rootcert = test_mk_file_path(certsdir, "rootcert.pem");
702 if (rootcert == NULL)
703 goto err;
704
705 cert = test_mk_file_path(certsdir, "servercert.pem");
706 if (cert == NULL)
707 goto err;
708
709 privkey = test_mk_file_path(certsdir, "serverkey.pem");
710 if (privkey == NULL)
711 goto err;
712
713 cert2 = test_mk_file_path(certsdir, "server-ecdsa-cert.pem");
714 if (cert2 == NULL)
715 goto err;
716
717 privkey2 = test_mk_file_path(certsdir, "server-ecdsa-key.pem");
718 if (privkey2 == NULL)
719 goto err;
720
721 cert448 = test_mk_file_path(certsdir, "server-ed448-cert.pem");
722 if (cert2 == NULL)
723 goto err;
724
725 privkey448 = test_mk_file_path(certsdir, "server-ed448-key.pem");
726 if (privkey2 == NULL)
727 goto err;
728
729 cert25519 = test_mk_file_path(certsdir, "server-ed25519-cert.pem");
730 if (cert2 == NULL)
731 goto err;
732
733 privkey25519 = test_mk_file_path(certsdir, "server-ed25519-key.pem");
734 if (privkey2 == NULL)
735 goto err;
736
737 libctx = OSSL_LIB_CTX_new();
738 if (libctx == NULL)
739 goto err;
740
741 ADD_TEST(test_rpk_api);
742 ADD_ALL_TESTS(test_rpk, RPK_TESTS * RPK_DIMS);
743 return 1;
744
745 err:
746 return 0;
747 }
748
cleanup_tests(void)749 void cleanup_tests(void)
750 {
751 OPENSSL_free(rootcert);
752 OPENSSL_free(cert);
753 OPENSSL_free(privkey);
754 OPENSSL_free(cert2);
755 OPENSSL_free(privkey2);
756 OPENSSL_free(cert448);
757 OPENSSL_free(privkey448);
758 OPENSSL_free(cert25519);
759 OPENSSL_free(privkey25519);
760 OSSL_LIB_CTX_free(libctx);
761 }
762
