7 #include <CoreFoundation/CoreFoundation.h>
9 #include <AssertMacros.h>
10 #include <Security/SecureTransportPriv.h> /* SSLSetOption */
11 #include <Security/SecureTransport.h>
12 #include <Security/SecPolicy.h>
13 #include <Security/SecTrust.h>
14 #include <Security/SecIdentity.h>
15 #include <Security/SecIdentityPriv.h>
16 #include <Security/SecCertificatePriv.h>
17 #include <Security/SecKeyPriv.h>
18 #include <Security/SecItem.h>
19 #include <Security/SecRandom.h>
21 #include <utilities/SecCFRelease.h>
24 #include <sys/types.h>
25 #include <sys/socket.h>
28 #include <mach/mach_time.h>
31 #include <Security/SecRSAKey.h>
34 #include "ssl-utils.h"
36 #include <tls_stream_parser.h>
37 #import "STLegacyTests.h"
39 #pragma clang diagnostic push
40 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
42 @implementation STLegacyTests (split)
50 tls_stream_parser_t parser;
56 #pragma mark SecureTransport support
58 #if SECTRANS_VERBOSE_DEBUG
59 static void hexdump(const char *s, const uint8_t *bytes, size_t len) {
61 printf("socket %s(%p, %lu)\n", s, bytes, len);
62 for (ix = 0; ix < len; ++ix) {
65 printf("%02X ", bytes[ix]);
70 #define hexdump(string, bytes, len)
73 static OSStatus SocketWrite(SSLConnectionRef h, const void *data, size_t *length)
75 ssl_test_handle *handle =(ssl_test_handle *)h;
76 int conn = handle->comm;
78 uint8_t *ptr = (uint8_t *)data;
80 if(handle->is_server) {
81 //printf("SocketWrite: server write len=%zd\n", len);
86 tls_stream_parser_parse(handle->parser, buffer);
92 hexdump("write", ptr, len);
93 ret = write((int)conn, ptr, len);
94 } while ((ret < 0) && (errno == EAGAIN || errno == EINTR));
103 *length = *length - len;
104 return errSecSuccess;
107 static OSStatus SocketRead(SSLConnectionRef h, void *data, size_t *length)
109 const ssl_test_handle *handle=h;
110 int conn = handle->comm;
111 size_t len = *length;
112 uint8_t *ptr = (uint8_t *)data;
118 ret = read((int)conn, ptr, len);
119 } while ((ret < 0) && (errno == EAGAIN || errno == EINTR));
129 printf("Something went wrong here... len=%d\n", (int)len);
131 *length = *length - len;
132 return errSecSuccess;
135 static int process(tls_stream_parser_ctx_t ctx, tls_buffer record)
137 ssl_test_handle *handle = (ssl_test_handle *)ctx;
139 // printf("processing record len=%zd, type=%d\n", record.length, record.data[0]);
140 if(record.data[0]==tls_record_type_AppData) {
141 handle->write_counter++;
142 // printf("record count = %d\n", handle->write_counter);
149 static void *securetransport_ssl_thread(void *arg)
152 ssl_test_handle * ssl = (ssl_test_handle *)arg;
153 SSLContextRef ctx = ssl->st;
154 bool got_server_auth = false;
157 ortn = SSLHandshake(ctx);
159 if (ortn == errSSLServerAuthCompleted) {
160 require_string(!got_server_auth, out, "second server auth");
161 got_server_auth = true;
163 } while (ortn == errSSLWouldBlock
164 || ortn == errSSLServerAuthCompleted);
166 require_noerr_action_quiet(ortn, out,
167 fprintf(stderr, "Fell out of SSLHandshake with error: %d\n", (int)ortn));
169 unsigned char ibuf[90000], obuf[45000];
171 if (ssl->is_server) {
173 require_action(errSecSuccess == SecRandomCopyBytes(kSecRandomDefault, ssl->write_size, obuf), out, ortn = -1);
174 require_noerr(ortn = SSLWrite(ctx, obuf, ssl->write_size, &len), out);
175 require_action(len == ssl->write_size, out, ortn = -1);
176 require_noerr(ortn = SSLWrite(ctx, obuf, ssl->write_size, &len), out);
177 require_action(len == ssl->write_size, out, ortn = -1);
179 size_t len = ssl->write_size*2;
181 unsigned char *p = ibuf;
183 require_noerr(ortn = SSLRead(ctx, p, len, &olen), out);
193 pthread_exit((void *)(intptr_t)ortn);
198 ssl_test_handle_destroy(ssl_test_handle *handle)
201 if (handle->parser) {
202 tls_stream_parser_destroy(handle->parser);
208 static ssl_test_handle *
209 ssl_test_handle_create(bool server, int comm, CFArrayRef certs)
211 ssl_test_handle *handle = calloc(1, sizeof(ssl_test_handle));
212 SSLContextRef ctx = SSLCreateContext(kCFAllocatorDefault, server?kSSLServerSide:kSSLClientSide, kSSLStreamType);
214 require(handle, out);
217 require_noerr(SSLSetIOFuncs(ctx,
218 (SSLReadFunc)SocketRead, (SSLWriteFunc)SocketWrite), out);
219 require_noerr(SSLSetConnection(ctx, (SSLConnectionRef)handle), out);
222 require_noerr(SSLSetCertificate(ctx, certs), out);
225 require_noerr(SSLSetSessionOption(ctx,
226 kSSLSessionOptionBreakOnServerAuth, true), out);
228 /* Tell SecureTransport to not check certs itself: it will break out of the
229 handshake to let us take care of it instead. */
230 require_noerr(SSLSetEnableCertVerify(ctx, false), out);
232 handle->is_server = server;
234 handle->certs = certs;
236 handle->write_counter = 0;
237 handle->parser = tls_stream_parser_create(handle, process);
242 if (handle) free(handle);
243 if (ctx) CFRelease(ctx);
247 static SSLCipherSuite ciphers[] = {
248 TLS_RSA_WITH_AES_128_CBC_SHA,
250 static int nciphers = sizeof(ciphers)/sizeof(ciphers[0]);
252 static SSLProtocol versions[] = {
258 static int nversions = sizeof(versions)/sizeof(versions[0]);
260 // { write size, expected count when nosplit, expected count when split }
261 static size_t wsizes[][3] = {
277 static int nwsizes = sizeof(wsizes)/sizeof(wsizes[0]);
281 pthread_t client_thread, server_thread;
282 CFArrayRef server_certs = server_chain();
283 XCTAssert(server_certs, "got server certs");
287 for(i=0; i<nciphers; i++)
288 for(j=0; j<nversions; j++)
289 for(k=0; k<nwsizes; k++)
293 if (socketpair(AF_UNIX, SOCK_STREAM, 0, sp)) exit(errno);
294 fcntl(sp[0], F_SETNOSIGPIPE, 1);
295 fcntl(sp[1], F_SETNOSIGPIPE, 1);
297 ssl_test_handle *server, *client;
299 server = ssl_test_handle_create(true /*server*/, sp[0], server_certs);
300 client = ssl_test_handle_create(false/*client*/, sp[1], NULL);
302 server->write_size = wsizes[k][0];
303 client->write_size = wsizes[k][0];
305 require(client, out);
306 require(server, out);
308 require_noerr(SSLSetProtocolVersionMin(server->st, kSSLProtocol3), out); // We need this server to do SSL3.
309 require_noerr(SSLSetProtocolVersionMax(client->st, versions[j]), out);
310 require_noerr(SSLSetEnabledCiphers(client->st, &ciphers[i], 1), out);
312 // s=0: default (should be enabled)
313 // s=1: explicit enable
314 // s=2: expliciti disable
315 require_noerr(SSLSetSessionOption(server->st, kSSLSessionOptionSendOneByteRecord, (s==1)?true:false), out);
318 pthread_create(&client_thread, NULL, securetransport_ssl_thread, client);
319 pthread_create(&server_thread, NULL, securetransport_ssl_thread, server);
321 intptr_t server_err, client_err;
322 pthread_join(client_thread, (void*)&client_err);
323 pthread_join(server_thread, (void*)&server_err);
325 XCTAssert(!server_err, "Server error = %ld", server_err);
326 XCTAssert(!client_err, "Client error = %ld", client_err);
328 /* one byte split is expected only for AES when using TLS 1.0 or lower, and when not disabled */
329 bool expected_split = (i==0) && (s!=2) && (versions[j]<=kTLSProtocol1);
330 int expected_count = (int)(expected_split ? wsizes[k][2]: wsizes[k][1]);
332 XCTAssertEqual(server->write_counter, expected_count, "wrong number of data records");
336 ssl_test_handle_destroy(client);
337 ssl_test_handle_destroy(server);
340 CFReleaseNull(server_certs);
345 #pragma clang diagnostic pop