472 lines
22 KiB
C++
472 lines
22 KiB
C++
|
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||
|
|
// SPDX-License-Identifier: Apache-2.0 OR ISC
|
||
|
|
|
||
|
|
#include <gtest/gtest.h>
|
||
|
|
#include <array>
|
||
|
|
|
||
|
|
#include "../crypto/test/test_util.h"
|
||
|
|
#include "internal.h"
|
||
|
|
#include "ssl_common_test.h"
|
||
|
|
|
||
|
|
BSSL_NAMESPACE_BEGIN
|
||
|
|
|
||
|
|
|
||
|
|
// kOpenSSLSession is a serialized SSL_SESSION.
|
||
|
|
static const char kOpenSSLSession[] =
|
||
|
|
"MIIFqgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
|
||
|
|
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
|
||
|
|
"IWoJoQYCBFRDO46iBAICASyjggR6MIIEdjCCA16gAwIBAgIIK9dUvsPWSlUwDQYJ"
|
||
|
|
"KoZIhvcNAQEFBQAwSTELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMx"
|
||
|
|
"JTAjBgNVBAMTHEdvb2dsZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwHhcNMTQxMDA4"
|
||
|
|
"MTIwNzU3WhcNMTUwMTA2MDAwMDAwWjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwK"
|
||
|
|
"Q2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzETMBEGA1UECgwKR29v"
|
||
|
|
"Z2xlIEluYzEXMBUGA1UEAwwOd3d3Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEB"
|
||
|
|
"AQUAA4IBDwAwggEKAoIBAQCcKeLrplAC+Lofy8t/wDwtB6eu72CVp0cJ4V3lknN6"
|
||
|
|
"huH9ct6FFk70oRIh/VBNBBz900jYy+7111Jm1b8iqOTQ9aT5C7SEhNcQFJvqzH3e"
|
||
|
|
"MPkb6ZSWGm1yGF7MCQTGQXF20Sk/O16FSjAynU/b3oJmOctcycWYkY0ytS/k3LBu"
|
||
|
|
"Id45PJaoMqjB0WypqvNeJHC3q5JjCB4RP7Nfx5jjHSrCMhw8lUMW4EaDxjaR9KDh"
|
||
|
|
"PLgjsk+LDIySRSRDaCQGhEOWLJZVLzLo4N6/UlctCHEllpBUSvEOyFga52qroGjg"
|
||
|
|
"rf3WOQ925MFwzd6AK+Ich0gDRg8sQfdLH5OuP1cfLfU1AgMBAAGjggFBMIIBPTAd"
|
||
|
|
"BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGQYDVR0RBBIwEIIOd3d3Lmdv"
|
||
|
|
"b2dsZS5jb20waAYIKwYBBQUHAQEEXDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtp"
|
||
|
|
"Lmdvb2dsZS5jb20vR0lBRzIuY3J0MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50"
|
||
|
|
"czEuZ29vZ2xlLmNvbS9vY3NwMB0GA1UdDgQWBBQ7a+CcxsZByOpc+xpYFcIbnUMZ"
|
||
|
|
"hTAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEv"
|
||
|
|
"MBcGA1UdIAQQMA4wDAYKKwYBBAHWeQIFATAwBgNVHR8EKTAnMCWgI6Ahhh9odHRw"
|
||
|
|
"Oi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQCa"
|
||
|
|
"OXCBdoqUy5bxyq+Wrh1zsyyCFim1PH5VU2+yvDSWrgDY8ibRGJmfff3r4Lud5kal"
|
||
|
|
"dKs9k8YlKD3ITG7P0YT/Rk8hLgfEuLcq5cc0xqmE42xJ+Eo2uzq9rYorc5emMCxf"
|
||
|
|
"5L0TJOXZqHQpOEcuptZQ4OjdYMfSxk5UzueUhA3ogZKRcRkdB3WeWRp+nYRhx4St"
|
||
|
|
"o2rt2A0MKmY9165GHUqMK9YaaXHDXqBu7Sefr1uSoAP9gyIJKeihMivsGqJ1TD6Z"
|
||
|
|
"cc6LMe+dN2P8cZEQHtD1y296ul4Mivqk3jatUVL8/hCwgch9A8O4PGZq9WqBfEWm"
|
||
|
|
"IyHh1dPtbg1lOXdYCWtjpAIEAKUDAgEUqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36S"
|
||
|
|
"YTcLEkXqKwOBfF9vE4KX0NxeLwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9B"
|
||
|
|
"sNHM362zZnY27GpTw+Kwd751CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yE"
|
||
|
|
"OTDKPNj3+inbMaVigtK4PLyPq+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdA"
|
||
|
|
"i4gv7Y5oliyntgMBAQA=";
|
||
|
|
|
||
|
|
// kCustomSession is a custom serialized SSL_SESSION generated by
|
||
|
|
// filling in missing fields from |kOpenSSLSession|. This includes
|
||
|
|
// providing |peer_sha256|, so |peer| is not serialized.
|
||
|
|
static const char kCustomSession[] =
|
||
|
|
"MIIBZAIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
|
||
|
|
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
|
||
|
|
"IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUqAcEBXdvcmxkqQUCAwGJwKqBpwSB"
|
||
|
|
"pBwUQvoeOk0Kg36SYTcLEkXqKwOBfF9vE4KX0NxeLwjcDTpsuh3qXEaZ992r1N38"
|
||
|
|
"VDcyS6P7I6HBYN9BsNHM362zZnY27GpTw+Kwd751CLoXFPoaMOe57dbBpXoro6Pd"
|
||
|
|
"3BTbf/Tzr88K06yEOTDKPNj3+inbMaVigtK4PLyPq+Topyzvx9USFgRvyuoxn0Hg"
|
||
|
|
"b+R0A3j6SLRuyOdAi4gv7Y5oliynrSIEIAYGBgYGBgYGBgYGBgYGBgYGBgYGBgYG"
|
||
|
|
"BgYGBgYGBgYGrgMEAQevAwQBBLADBAEF";
|
||
|
|
|
||
|
|
// kBoringSSLSession is a serialized SSL_SESSION generated from bssl client.
|
||
|
|
static const char kBoringSSLSession[] =
|
||
|
|
"MIIRwQIBAQICAwMEAsAvBCDdoGxGK26mR+8lM0uq6+k9xYuxPnwAjpcF9n0Yli9R"
|
||
|
|
"kQQwbyshfWhdi5XQ1++7n2L1qqrcVlmHBPpr6yknT/u4pUrpQB5FZ7vqvNn8MdHf"
|
||
|
|
"9rWgoQYCBFXgs7uiBAICHCCjggR6MIIEdjCCA16gAwIBAgIIf+yfD7Y6UicwDQYJ"
|
||
|
|
"KoZIhvcNAQELBQAwSTELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMx"
|
||
|
|
"JTAjBgNVBAMTHEdvb2dsZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwHhcNMTUwODEy"
|
||
|
|
"MTQ1MzE1WhcNMTUxMTEwMDAwMDAwWjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwK"
|
||
|
|
"Q2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzETMBEGA1UECgwKR29v"
|
||
|
|
"Z2xlIEluYzEXMBUGA1UEAwwOd3d3Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEB"
|
||
|
|
"AQUAA4IBDwAwggEKAoIBAQC0MeG5YGQ0t+IeJeoneP/PrhEaieibeKYkbKVLNZpo"
|
||
|
|
"PLuBinvhkXZo3DC133NpCBpy6ZktBwamqyixAyuk/NU6OjgXqwwxfQ7di1AInLIU"
|
||
|
|
"792c7hFyNXSUCG7At8Ifi3YwBX9Ba6u/1d6rWTGZJrdCq3QU11RkKYyTq2KT5mce"
|
||
|
|
"Tv9iGKqSkSTlp8puy/9SZ/3DbU3U+BuqCFqeSlz7zjwFmk35acdCilpJlVDDN5C/"
|
||
|
|
"RCh8/UKc8PaL+cxlt531qoTENvYrflBno14YEZlCBZsPiFeUSILpKEj3Ccwhy0eL"
|
||
|
|
"EucWQ72YZU8mUzXBoXGn0zA0crFl5ci/2sTBBGZsylNBAgMBAAGjggFBMIIBPTAd"
|
||
|
|
"BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGQYDVR0RBBIwEIIOd3d3Lmdv"
|
||
|
|
"b2dsZS5jb20waAYIKwYBBQUHAQEEXDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtp"
|
||
|
|
"Lmdvb2dsZS5jb20vR0lBRzIuY3J0MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50"
|
||
|
|
"czEuZ29vZ2xlLmNvbS9vY3NwMB0GA1UdDgQWBBS/bzHxcE73Q4j3slC4BLbMtLjG"
|
||
|
|
"GjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEv"
|
||
|
|
"MBcGA1UdIAQQMA4wDAYKKwYBBAHWeQIFATAwBgNVHR8EKTAnMCWgI6Ahhh9odHRw"
|
||
|
|
"Oi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQAb"
|
||
|
|
"qdWPZEHk0X7iKPCTHL6S3w6q1eR67goxZGFSM1lk1hjwyu7XcLJuvALVV9uY3ovE"
|
||
|
|
"kQZSHwT+pyOPWQhsSjO+1GyjvCvK/CAwiUmBX+bQRGaqHsRcio7xSbdVcajQ3bXd"
|
||
|
|
"X+s0WdbOpn6MStKAiBVloPlSxEI8pxY6x/BBCnTIk/+DMB17uZlOjG3vbAnkDkP+"
|
||
|
|
"n0OTucD9sHV7EVj9XUxi51nOfNBCN/s7lpUjDS/NJ4k3iwOtbCPswiot8vLO779a"
|
||
|
|
"f07vR03r349Iz/KTzk95rlFtX0IU+KYNxFNsanIXZ+C9FYGRXkwhHcvFb4qMUB1y"
|
||
|
|
"TTlM80jBMOwyjZXmjRAhpAIEAKUDAgEUqQUCAwGJwKqBpwSBpOgebbmn9NRUtMWH"
|
||
|
|
"+eJpqA5JLMFSMCChOsvKey3toBaCNGU7HfAEiiXNuuAdCBoK262BjQc2YYfqFzqH"
|
||
|
|
"zuppopXCvhohx7j/tnCNZIMgLYt/O9SXK2RYI5z8FhCCHvB4CbD5G0LGl5EFP27s"
|
||
|
|
"Jb6S3aTTYPkQe8yZSlxevg6NDwmTogLO9F7UUkaYmVcMQhzssEE2ZRYNwSOU6KjE"
|
||
|
|
"0Yj+8fAiBtbQriIEIN2L8ZlpaVrdN5KFNdvcmOxJu81P8q53X55xQyGTnGWwsgMC"
|
||
|
|
"ARezggvvMIIEdjCCA16gAwIBAgIIf+yfD7Y6UicwDQYJKoZIhvcNAQELBQAwSTEL"
|
||
|
|
"MAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2ds"
|
||
|
|
"ZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwHhcNMTUwODEyMTQ1MzE1WhcNMTUxMTEw"
|
||
|
|
"MDAwMDAwWjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG"
|
||
|
|
"A1UEBwwNTW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEXMBUGA1UE"
|
||
|
|
"AwwOd3d3Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB"
|
||
|
|
"AQC0MeG5YGQ0t+IeJeoneP/PrhEaieibeKYkbKVLNZpoPLuBinvhkXZo3DC133Np"
|
||
|
|
"CBpy6ZktBwamqyixAyuk/NU6OjgXqwwxfQ7di1AInLIU792c7hFyNXSUCG7At8If"
|
||
|
|
"i3YwBX9Ba6u/1d6rWTGZJrdCq3QU11RkKYyTq2KT5mceTv9iGKqSkSTlp8puy/9S"
|
||
|
|
"Z/3DbU3U+BuqCFqeSlz7zjwFmk35acdCilpJlVDDN5C/RCh8/UKc8PaL+cxlt531"
|
||
|
|
"qoTENvYrflBno14YEZlCBZsPiFeUSILpKEj3Ccwhy0eLEucWQ72YZU8mUzXBoXGn"
|
||
|
|
"0zA0crFl5ci/2sTBBGZsylNBAgMBAAGjggFBMIIBPTAdBgNVHSUEFjAUBggrBgEF"
|
||
|
|
"BQcDAQYIKwYBBQUHAwIwGQYDVR0RBBIwEIIOd3d3Lmdvb2dsZS5jb20waAYIKwYB"
|
||
|
|
"BQUHAQEEXDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lB"
|
||
|
|
"RzIuY3J0MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50czEuZ29vZ2xlLmNvbS9v"
|
||
|
|
"Y3NwMB0GA1UdDgQWBBS/bzHxcE73Q4j3slC4BLbMtLjGGjAMBgNVHRMBAf8EAjAA"
|
||
|
|
"MB8GA1UdIwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEvMBcGA1UdIAQQMA4wDAYK"
|
||
|
|
"KwYBBAHWeQIFATAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vcGtpLmdvb2dsZS5j"
|
||
|
|
"b20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQAbqdWPZEHk0X7iKPCTHL6S"
|
||
|
|
"3w6q1eR67goxZGFSM1lk1hjwyu7XcLJuvALVV9uY3ovEkQZSHwT+pyOPWQhsSjO+"
|
||
|
|
"1GyjvCvK/CAwiUmBX+bQRGaqHsRcio7xSbdVcajQ3bXdX+s0WdbOpn6MStKAiBVl"
|
||
|
|
"oPlSxEI8pxY6x/BBCnTIk/+DMB17uZlOjG3vbAnkDkP+n0OTucD9sHV7EVj9XUxi"
|
||
|
|
"51nOfNBCN/s7lpUjDS/NJ4k3iwOtbCPswiot8vLO779af07vR03r349Iz/KTzk95"
|
||
|
|
"rlFtX0IU+KYNxFNsanIXZ+C9FYGRXkwhHcvFb4qMUB1yTTlM80jBMOwyjZXmjRAh"
|
||
|
|
"MIID8DCCAtigAwIBAgIDAjqDMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVT"
|
||
|
|
"MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i"
|
||
|
|
"YWwgQ0EwHhcNMTMwNDA1MTUxNTU2WhcNMTYxMjMxMjM1OTU5WjBJMQswCQYDVQQG"
|
||
|
|
"EwJVUzETMBEGA1UEChMKR29vZ2xlIEluYzElMCMGA1UEAxMcR29vZ2xlIEludGVy"
|
||
|
|
"bmV0IEF1dGhvcml0eSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB"
|
||
|
|
"AJwqBHdc2FCROgajguDYUEi8iT/xGXAaiEZ+4I/F8YnOIe5a/mENtzJEiaB0C1NP"
|
||
|
|
"VaTOgmKV7utZX8bhBYASxF6UP7xbSDj0U/ck5vuR6RXEz/RTDfRK/J9U3n2+oGtv"
|
||
|
|
"h8DQUB8oMANA2ghzUWx//zo8pzcGjr1LEQTrfSTe5vn8MXH7lNVg8y5Kr0LSy+rE"
|
||
|
|
"ahqyzFPdFUuLH8gZYR/Nnag+YyuENWllhMgZxUYi+FOVvuOAShDGKuy6lyARxzmZ"
|
||
|
|
"EASg8GF6lSWMTlJ14rbtCMoU/M4iarNOz0YDl5cDfsCx3nuvRTPPuj5xt970JSXC"
|
||
|
|
"DTWJnZ37DhF5iR43xa+OcmkCAwEAAaOB5zCB5DAfBgNVHSMEGDAWgBTAephojYn7"
|
||
|
|
"qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQUSt0GFhu89mi1dvWBtrtiGrpagS8wDgYD"
|
||
|
|
"VR0PAQH/BAQDAgEGMC4GCCsGAQUFBwEBBCIwIDAeBggrBgEFBQcwAYYSaHR0cDov"
|
||
|
|
"L2cuc3ltY2QuY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwNQYDVR0fBC4wLDAqoCig"
|
||
|
|
"JoYkaHR0cDovL2cuc3ltY2IuY29tL2NybHMvZ3RnbG9iYWwuY3JsMBcGA1UdIAQQ"
|
||
|
|
"MA4wDAYKKwYBBAHWeQIFATANBgkqhkiG9w0BAQsFAAOCAQEAqvqpIM1qZ4PtXtR+"
|
||
|
|
"3h3Ef+AlBgDFJPupyC1tft6dgmUsgWM0Zj7pUsIItMsv91+ZOmqcUHqFBYx90SpI"
|
||
|
|
"hNMJbHzCzTWf84LuUt5oX+QAihcglvcpjZpNy6jehsgNb1aHA30DP9z6eX0hGfnI"
|
||
|
|
"Oi9RdozHQZJxjyXON/hKTAAj78Q1EK7gI4BzfE00LshukNYQHpmEcxpw8u1VDu4X"
|
||
|
|
"Bupn7jLrLN1nBz/2i8Jw3lsA5rsb0zYaImxssDVCbJAJPZPpZAkiDoUGn8JzIdPm"
|
||
|
|
"X4DkjYUiOnMDsWCOrmji9D6X52ASCWg23jrW4kOVWzeBkoEfu43XrVJkFleW2V40"
|
||
|
|
"fsg12DCCA30wggLmoAMCAQICAxK75jANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQG"
|
||
|
|
"EwJVUzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUg"
|
||
|
|
"Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTAyMDUyMTA0MDAwMFoXDTE4MDgyMTA0"
|
||
|
|
"MDAwMFowQjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xGzAZ"
|
||
|
|
"BgNVBAMTEkdlb1RydXN0IEdsb2JhbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP"
|
||
|
|
"ADCCAQoCggEBANrMGGMw/fQXIxpWflvfPGw45HG3eJHUvKHYTPioQ7YD6U0hBwiI"
|
||
|
|
"2lgvZjkpvQV4i5046AW3an5xpObEYKaw74DkiSgPniXW7YPzraaRx5jJQhg1FJ2t"
|
||
|
|
"mEaSLk/K8YdDwRaVVy1Q74ktgHpXrfLuX2vSAI25FPgUFTXZwEaje3LIkb/JVSvN"
|
||
|
|
"0Jc+nCZkzN/Ogxlxyk7m1NV7qRnNVd7I7NJeOFPlXE+MLf5QIzb8ZubLjqQ5GQC3"
|
||
|
|
"lQI5kQsO/jgu0R0FmvZNPm8PBx2vLB6PYDni+jZTEznUXiYr2z2oFL0y6xgDKFIE"
|
||
|
|
"ceWrMz3hOLsHNoRinHnqFjD0X8Ar6HFr5PkCAwEAAaOB8DCB7TAfBgNVHSMEGDAW"
|
||
|
|
"gBRI5mj5K9KylddH2CMgEE8zmJCf1DAdBgNVHQ4EFgQUwHqYaI2J+6sFZAwRfap9"
|
||
|
|
"ZbjKzE4wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwOgYDVR0fBDMw"
|
||
|
|
"MTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20vY3Jscy9zZWN1cmVjYS5j"
|
||
|
|
"cmwwTgYDVR0gBEcwRTBDBgRVHSAAMDswOQYIKwYBBQUHAgEWLWh0dHBzOi8vd3d3"
|
||
|
|
"Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvcmVwb3NpdG9yeTANBgkqhkiG9w0BAQUF"
|
||
|
|
"AAOBgQB24RJuTksWEoYwBrKBCM/wCMfHcX5m7sLt1Dsf//DwyE7WQziwuTB9GNBV"
|
||
|
|
"g6JqyzYRnOhIZqNtf7gT1Ef+i1pcc/yu2RsyGTirlzQUqpbS66McFAhJtrvlke+D"
|
||
|
|
"NusdVm/K2rxzY5Dkf3s+Iss9B+1fOHSc4wNQTqGvmO5h8oQ/Eg==";
|
||
|
|
|
||
|
|
// kBadSessionExtraField is a custom serialized SSL_SESSION generated by
|
||
|
|
// replacing the final (optional) element of |kCustomSession| with tag
|
||
|
|
// number 99.
|
||
|
|
static const char kBadSessionExtraField[] =
|
||
|
|
"MIIBdgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
|
||
|
|
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
|
||
|
|
"IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"
|
||
|
|
"BXdvcmxkqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36SYTcLEkXqKwOBfF9vE4KX0Nxe"
|
||
|
|
"LwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9BsNHM362zZnY27GpTw+Kwd751"
|
||
|
|
"CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yEOTDKPNj3+inbMaVigtK4PLyP"
|
||
|
|
"q+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdAi4gv7Y5oliynrSIEIAYGBgYG"
|
||
|
|
"BgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGrgMEAQevAwQBBOMDBAEF";
|
||
|
|
|
||
|
|
// kBadSessionVersion is a custom serialized SSL_SESSION generated by replacing
|
||
|
|
// the version of |kCustomSession| with 2.
|
||
|
|
static const char kBadSessionVersion[] =
|
||
|
|
"MIIBdgIBAgICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
|
||
|
|
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
|
||
|
|
"IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"
|
||
|
|
"BXdvcmxkqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36SYTcLEkXqKwOBfF9vE4KX0Nxe"
|
||
|
|
"LwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9BsNHM362zZnY27GpTw+Kwd751"
|
||
|
|
"CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yEOTDKPNj3+inbMaVigtK4PLyP"
|
||
|
|
"q+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdAi4gv7Y5oliynrSIEIAYGBgYG"
|
||
|
|
"BgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGrgMEAQevAwQBBLADBAEF";
|
||
|
|
|
||
|
|
// kBadSessionTrailingData is a custom serialized SSL_SESSION with trailing data
|
||
|
|
// appended.
|
||
|
|
static const char kBadSessionTrailingData[] =
|
||
|
|
"MIIBdgIBAQICAwMEAsAvBCAG5Q1ndq4Yfmbeo1zwLkNRKmCXGdNgWvGT3cskV0yQ"
|
||
|
|
"kAQwJlrlzkAWBOWiLj/jJ76D7l+UXoizP2KI2C7I2FccqMmIfFmmkUy32nIJ0mZH"
|
||
|
|
"IWoJoQYCBFRDO46iBAICASykAwQBAqUDAgEUphAEDnd3dy5nb29nbGUuY29tqAcE"
|
||
|
|
"BXdvcmxkqQUCAwGJwKqBpwSBpBwUQvoeOk0Kg36SYTcLEkXqKwOBfF9vE4KX0Nxe"
|
||
|
|
"LwjcDTpsuh3qXEaZ992r1N38VDcyS6P7I6HBYN9BsNHM362zZnY27GpTw+Kwd751"
|
||
|
|
"CLoXFPoaMOe57dbBpXoro6Pd3BTbf/Tzr88K06yEOTDKPNj3+inbMaVigtK4PLyP"
|
||
|
|
"q+Topyzvx9USFgRvyuoxn0Hgb+R0A3j6SLRuyOdAi4gv7Y5oliynrSIEIAYGBgYG"
|
||
|
|
"BgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGrgMEAQevAwQBBLADBAEFAAAA";
|
||
|
|
|
||
|
|
static bool DecodeBase64(std::vector<uint8_t> *out, const char *in) {
|
||
|
|
size_t len = 0;
|
||
|
|
if (!EVP_DecodedLength(&len, strlen(in))) {
|
||
|
|
fprintf(stderr, "EVP_DecodedLength failed\n");
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
|
||
|
|
out->resize(len);
|
||
|
|
if (!EVP_DecodeBase64(out->data(), &len, len, (const uint8_t *)in,
|
||
|
|
strlen(in))) {
|
||
|
|
fprintf(stderr, "EVP_DecodeBase64 failed\n");
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
out->resize(len);
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
|
||
|
|
TEST(SSLTest, SessionEncoding) {
|
||
|
|
for (const char *input_b64 : {
|
||
|
|
kOpenSSLSession,
|
||
|
|
kCustomSession,
|
||
|
|
kBoringSSLSession,
|
||
|
|
}) {
|
||
|
|
SCOPED_TRACE(std::string(input_b64));
|
||
|
|
// Decode the input.
|
||
|
|
std::vector<uint8_t> input;
|
||
|
|
ASSERT_TRUE(DecodeBase64(&input, input_b64));
|
||
|
|
|
||
|
|
// Verify the SSL_SESSION decodes.
|
||
|
|
bssl::UniquePtr<SSL_CTX> ssl_ctx(SSL_CTX_new(TLS_method()));
|
||
|
|
ASSERT_TRUE(ssl_ctx);
|
||
|
|
bssl::UniquePtr<SSL_SESSION> session(
|
||
|
|
SSL_SESSION_from_bytes(input.data(), input.size(), ssl_ctx.get()));
|
||
|
|
ASSERT_TRUE(session) << "SSL_SESSION_from_bytes failed";
|
||
|
|
|
||
|
|
// Verify the SSL_SESSION encoding round-trips.
|
||
|
|
size_t encoded_len = 0;
|
||
|
|
bssl::UniquePtr<uint8_t> encoded;
|
||
|
|
uint8_t *encoded_raw = nullptr;
|
||
|
|
ASSERT_TRUE(SSL_SESSION_to_bytes(session.get(), &encoded_raw, &encoded_len))
|
||
|
|
<< "SSL_SESSION_to_bytes failed";
|
||
|
|
encoded.reset(encoded_raw);
|
||
|
|
EXPECT_EQ(Bytes(encoded.get(), encoded_len), Bytes(input))
|
||
|
|
<< "SSL_SESSION_to_bytes did not round-trip";
|
||
|
|
|
||
|
|
// Verify the SSL_SESSION also decodes with the legacy API.
|
||
|
|
const uint8_t *cptr = input.data();
|
||
|
|
session.reset(d2i_SSL_SESSION(NULL, &cptr, input.size()));
|
||
|
|
ASSERT_TRUE(session) << "d2i_SSL_SESSION failed";
|
||
|
|
EXPECT_EQ(cptr, input.data() + input.size());
|
||
|
|
|
||
|
|
// Verify the SSL_SESSION encoding round-trips via the legacy API.
|
||
|
|
int len = i2d_SSL_SESSION(session.get(), NULL);
|
||
|
|
ASSERT_GT(len, 0) << "i2d_SSL_SESSION failed";
|
||
|
|
ASSERT_EQ(static_cast<size_t>(len), input.size())
|
||
|
|
<< "i2d_SSL_SESSION(NULL) returned invalid length";
|
||
|
|
|
||
|
|
encoded.reset((uint8_t *)OPENSSL_malloc(input.size()));
|
||
|
|
ASSERT_TRUE(encoded);
|
||
|
|
|
||
|
|
uint8_t *ptr = encoded.get();
|
||
|
|
len = i2d_SSL_SESSION(session.get(), &ptr);
|
||
|
|
ASSERT_GT(len, 0) << "i2d_SSL_SESSION failed";
|
||
|
|
ASSERT_EQ(static_cast<size_t>(len), input.size())
|
||
|
|
<< "i2d_SSL_SESSION(NULL) returned invalid length";
|
||
|
|
ASSERT_EQ(ptr, encoded.get() + input.size())
|
||
|
|
<< "i2d_SSL_SESSION did not advance ptr correctly";
|
||
|
|
EXPECT_EQ(Bytes(encoded.get(), encoded_len), Bytes(input))
|
||
|
|
<< "SSL_SESSION_to_bytes did not round-trip";
|
||
|
|
|
||
|
|
// Verify that |i2d_SSL_SESSION| works correctly when |pp| is non-NULL, but
|
||
|
|
// |*pp| is NULL. A newly-allocated buffer containing the result should be
|
||
|
|
// created. See |i2d_SAMPLE| for more details.
|
||
|
|
uint8_t *ptr2 = nullptr;
|
||
|
|
int len2 = i2d_SSL_SESSION(session.get(), &ptr2);
|
||
|
|
ASSERT_TRUE(ptr2);
|
||
|
|
ASSERT_GT(len2, 0);
|
||
|
|
bssl::UniquePtr<uint8_t> encoded2(ptr2);
|
||
|
|
EXPECT_EQ(Bytes(encoded2.get(), len2), Bytes(input))
|
||
|
|
<< "SSL_SESSION_to_bytes did not round-trip";
|
||
|
|
}
|
||
|
|
|
||
|
|
for (const char *input_b64 : {
|
||
|
|
kBadSessionExtraField,
|
||
|
|
kBadSessionVersion,
|
||
|
|
kBadSessionTrailingData,
|
||
|
|
}) {
|
||
|
|
SCOPED_TRACE(std::string(input_b64));
|
||
|
|
std::vector<uint8_t> input;
|
||
|
|
ASSERT_TRUE(DecodeBase64(&input, input_b64));
|
||
|
|
|
||
|
|
// Verify that the SSL_SESSION fails to decode.
|
||
|
|
bssl::UniquePtr<SSL_CTX> ssl_ctx(SSL_CTX_new(TLS_method()));
|
||
|
|
ASSERT_TRUE(ssl_ctx);
|
||
|
|
bssl::UniquePtr<SSL_SESSION> session(
|
||
|
|
SSL_SESSION_from_bytes(input.data(), input.size(), ssl_ctx.get()));
|
||
|
|
EXPECT_FALSE(session) << "SSL_SESSION_from_bytes unexpectedly succeeded";
|
||
|
|
ERR_clear_error();
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// CreateSessionWithTicket returns a sample |SSL_SESSION| with the specified
|
||
|
|
// version and ticket length or nullptr on failure.
|
||
|
|
static bssl::UniquePtr<SSL_SESSION> CreateSessionWithTicket(uint16_t version,
|
||
|
|
size_t ticket_len) {
|
||
|
|
std::vector<uint8_t> der;
|
||
|
|
if (!DecodeBase64(&der, kOpenSSLSession)) {
|
||
|
|
return nullptr;
|
||
|
|
}
|
||
|
|
|
||
|
|
bssl::UniquePtr<SSL_CTX> ssl_ctx(SSL_CTX_new(TLS_method()));
|
||
|
|
if (!ssl_ctx) {
|
||
|
|
return nullptr;
|
||
|
|
}
|
||
|
|
// Use a garbage ticket.
|
||
|
|
std::vector<uint8_t> ticket(ticket_len, 'a');
|
||
|
|
bssl::UniquePtr<SSL_SESSION> session(
|
||
|
|
SSL_SESSION_from_bytes(der.data(), der.size(), ssl_ctx.get()));
|
||
|
|
if (!session || !SSL_SESSION_set_protocol_version(session.get(), version) ||
|
||
|
|
!SSL_SESSION_set_ticket(session.get(), ticket.data(), ticket.size())) {
|
||
|
|
return nullptr;
|
||
|
|
}
|
||
|
|
// Fix up the timeout.
|
||
|
|
#if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
|
||
|
|
SSL_SESSION_set_time(session.get(), 1234);
|
||
|
|
#else
|
||
|
|
SSL_SESSION_set_time(session.get(), time(nullptr));
|
||
|
|
#endif
|
||
|
|
return session;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
// GetClientHelloLen creates a client SSL connection with the specified version
|
||
|
|
// and ticket length. It returns the length of the ClientHello, not including
|
||
|
|
// the record header, on success and zero on error.
|
||
|
|
static size_t GetClientHelloLen(uint16_t max_version, uint16_t session_version,
|
||
|
|
size_t ticket_len) {
|
||
|
|
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
|
||
|
|
bssl::UniquePtr<SSL_SESSION> session =
|
||
|
|
CreateSessionWithTicket(session_version, ticket_len);
|
||
|
|
if (!ctx || !session) {
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Set a one-element cipher list so the baseline ClientHello is unpadded.
|
||
|
|
bssl::UniquePtr<SSL> ssl(SSL_new(ctx.get()));
|
||
|
|
if (!ssl || !SSL_set_session(ssl.get(), session.get()) ||
|
||
|
|
!SSL_set_strict_cipher_list(ssl.get(), "ECDHE-RSA-AES128-GCM-SHA256") ||
|
||
|
|
!SSL_set1_curves_list(ssl.get(), "x25519:P-256:P-384") ||
|
||
|
|
!SSL_set_max_proto_version(ssl.get(), max_version)) {
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
std::vector<uint8_t> client_hello;
|
||
|
|
if (!GetClientHello(ssl.get(), &client_hello) ||
|
||
|
|
client_hello.size() <= SSL3_RT_HEADER_LENGTH) {
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
return client_hello.size() - SSL3_RT_HEADER_LENGTH;
|
||
|
|
}
|
||
|
|
|
||
|
|
TEST(SSLTest, Padding) {
|
||
|
|
struct PaddingVersions {
|
||
|
|
uint16_t max_version, session_version;
|
||
|
|
};
|
||
|
|
static const PaddingVersions kPaddingVersions[] = {
|
||
|
|
// Test the padding extension at TLS 1.2.
|
||
|
|
{TLS1_2_VERSION, TLS1_2_VERSION},
|
||
|
|
// Test the padding extension at TLS 1.3 with a TLS 1.2 session, so there
|
||
|
|
// will be no PSK binder after the padding extension.
|
||
|
|
{TLS1_3_VERSION, TLS1_2_VERSION},
|
||
|
|
// Test the padding extension at TLS 1.3 with a TLS 1.3 session, so there
|
||
|
|
// will be a PSK binder after the padding extension.
|
||
|
|
{TLS1_3_VERSION, TLS1_3_VERSION},
|
||
|
|
|
||
|
|
};
|
||
|
|
|
||
|
|
struct PaddingTest {
|
||
|
|
size_t input_len, padded_len;
|
||
|
|
};
|
||
|
|
static const PaddingTest kPaddingTests[] = {
|
||
|
|
// ClientHellos of length below 0x100 do not require padding.
|
||
|
|
{0xfe, 0xfe},
|
||
|
|
{0xff, 0xff},
|
||
|
|
// ClientHellos of length 0x100 through 0x1fb are padded up to 0x200.
|
||
|
|
{0x100, 0x200},
|
||
|
|
{0x123, 0x200},
|
||
|
|
{0x1fb, 0x200},
|
||
|
|
// ClientHellos of length 0x1fc through 0x1ff get padded beyond 0x200. The
|
||
|
|
// padding extension takes a minimum of four bytes plus one required
|
||
|
|
// content
|
||
|
|
// byte. (To work around yet more server bugs, we avoid empty final
|
||
|
|
// extensions.)
|
||
|
|
{0x1fc, 0x201},
|
||
|
|
{0x1fd, 0x202},
|
||
|
|
{0x1fe, 0x203},
|
||
|
|
{0x1ff, 0x204},
|
||
|
|
// Finally, larger ClientHellos need no padding.
|
||
|
|
{0x200, 0x200},
|
||
|
|
{0x201, 0x201},
|
||
|
|
};
|
||
|
|
|
||
|
|
for (const PaddingVersions &versions : kPaddingVersions) {
|
||
|
|
SCOPED_TRACE(versions.max_version);
|
||
|
|
SCOPED_TRACE(versions.session_version);
|
||
|
|
|
||
|
|
// Sample a baseline length.
|
||
|
|
size_t base_len =
|
||
|
|
GetClientHelloLen(versions.max_version, versions.session_version, 1);
|
||
|
|
ASSERT_NE(base_len, 0u) << "Baseline length could not be sampled";
|
||
|
|
|
||
|
|
for (const PaddingTest &test : kPaddingTests) {
|
||
|
|
SCOPED_TRACE(test.input_len);
|
||
|
|
ASSERT_LE(base_len, test.input_len) << "Baseline ClientHello too long";
|
||
|
|
|
||
|
|
size_t padded_len =
|
||
|
|
GetClientHelloLen(versions.max_version, versions.session_version,
|
||
|
|
1 + test.input_len - base_len);
|
||
|
|
EXPECT_EQ(padded_len, test.padded_len)
|
||
|
|
<< "ClientHello was not padded to expected length";
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
TEST(SSLTest, SessionPrint) {
|
||
|
|
static const std::array<std::string, 15> kExpectedTLS13{
|
||
|
|
{"SSL-Session:", " Protocol :", " Cipher : ",
|
||
|
|
" Session-ID: ", " Session-ID-ctx:", " Resumption PSK:",
|
||
|
|
" PSK identity:", " TLS session ticket lifetime hint:",
|
||
|
|
" TLS session ticket:", " 61",
|
||
|
|
" Start Time:", " Timeout :", " Verify return code:",
|
||
|
|
" Extended master secret:", " Max Early Data:"}};
|
||
|
|
|
||
|
|
static const std::array<std::string, 14> kExpectedTLS12{
|
||
|
|
{"SSL-Session:", " Protocol :", " Cipher : ",
|
||
|
|
" Session-ID: ", " Session-ID-ctx:", " Master-Key:",
|
||
|
|
" PSK identity:", " TLS session ticket lifetime hint:",
|
||
|
|
" TLS session ticket:", " 61",
|
||
|
|
" Start Time:", " Timeout :", " Verify return code:",
|
||
|
|
" Extended master secret:"}};
|
||
|
|
|
||
|
|
bssl::UniquePtr<SSL_SESSION> session(
|
||
|
|
CreateSessionWithTicket(TLS1_3_VERSION, 10));
|
||
|
|
bssl::UniquePtr<BIO> bio(BIO_new(BIO_s_mem()));
|
||
|
|
EXPECT_TRUE(SSL_SESSION_print(bio.get(), session.get()));
|
||
|
|
const uint8_t *out = nullptr;
|
||
|
|
size_t outlen = 0;
|
||
|
|
ASSERT_TRUE(BIO_mem_contents(bio.get(), &out, &outlen));
|
||
|
|
|
||
|
|
// Iterate through |kExpectedTLS13| and verify that |SSL_SESSION_print| has
|
||
|
|
// the expected format.
|
||
|
|
std::istringstream iss_tls13((std::string((char *)out, outlen)));
|
||
|
|
std::string line;
|
||
|
|
for (const auto &expected : kExpectedTLS13) {
|
||
|
|
std::getline(iss_tls13, line);
|
||
|
|
EXPECT_EQ(line.substr(0, expected.length()), expected);
|
||
|
|
}
|
||
|
|
|
||
|
|
session = CreateSessionWithTicket(TLS1_2_VERSION, 10);
|
||
|
|
bio.reset(BIO_new(BIO_s_mem()));
|
||
|
|
EXPECT_TRUE(SSL_SESSION_print(bio.get(), session.get()));
|
||
|
|
ASSERT_TRUE(BIO_mem_contents(bio.get(), &out, &outlen));
|
||
|
|
// Iterate through |kExpectedTLS12| and verify that |SSL_SESSION_print| has
|
||
|
|
// the expected format.
|
||
|
|
std::istringstream iss_tls12((std::string((char *)out, outlen)));
|
||
|
|
for (const auto &expected : kExpectedTLS12) {
|
||
|
|
std::getline(iss_tls12, line);
|
||
|
|
EXPECT_EQ(line.substr(0, expected.length()), expected);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
BSSL_NAMESPACE_END
|