]> git.saurik.com Git - apple/security.git/blob - OSX/libsecurity_ssl/regressions/ssl-46-SSLGetSupportedCiphers.c
Security-57337.20.44.tar.gz
[apple/security.git] / OSX / libsecurity_ssl / regressions / ssl-46-SSLGetSupportedCiphers.c
1 /*
2 * Copyright (c) 2012,2014 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <Security/SecureTransportPriv.h>
28 #include <AssertMacros.h>
29
30 #include "ssl_regressions.h"
31 #include "ssl-utils.h"
32
33
34 #include "cipherSpecs.h"
35
36 static int test_GetSupportedCiphers(SSLContextRef ssl, bool server)
37 {
38 size_t max_ciphers = 0;
39 int fail=1;
40 SSLCipherSuite *ciphers = NULL;
41
42 require_noerr(SSLGetNumberSupportedCiphers(ssl, &max_ciphers), out);
43
44 size_t size = max_ciphers * sizeof (SSLCipherSuite);
45 ciphers = (SSLCipherSuite *) malloc(size);
46
47 require_string(ciphers, out, "out of memory");
48 memset(ciphers, 0xff, size);
49
50 size_t num_ciphers = max_ciphers;
51 require_noerr(SSLGetSupportedCiphers(ssl, ciphers, &num_ciphers), out);
52
53 for (size_t i = 0; i < num_ciphers; i++) {
54 require(ciphers[i]!=(SSLCipherSuite)(-1), out);
55 }
56
57 /* Success! */
58 fail=0;
59
60 out:
61 if(ciphers) free(ciphers);
62 return fail;
63 }
64
65
66 static OSStatus SocketWrite(SSLConnectionRef conn, const void *data, size_t *length)
67 {
68 return errSSLWouldBlock;
69 }
70
71 static OSStatus SocketRead(SSLConnectionRef conn, void *data, size_t *length)
72 {
73 return errSSLWouldBlock;
74 }
75
76
77
78 static const SSLCipherSuite legacy_ciphersuites[] = {
79 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
80 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
81 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
82 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
83 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
84 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
85 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
86 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
87 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
88 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
89 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
90 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
91 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
92 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
93 TLS_RSA_WITH_AES_256_GCM_SHA384,
94 TLS_RSA_WITH_AES_128_GCM_SHA256,
95 TLS_RSA_WITH_AES_256_CBC_SHA256,
96 TLS_RSA_WITH_AES_128_CBC_SHA256,
97 TLS_RSA_WITH_AES_256_CBC_SHA,
98 TLS_RSA_WITH_AES_128_CBC_SHA,
99 SSL_RSA_WITH_3DES_EDE_CBC_SHA,
100 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
101 TLS_ECDHE_RSA_WITH_RC4_128_SHA,
102 SSL_RSA_WITH_RC4_128_SHA,
103 SSL_RSA_WITH_RC4_128_MD5,
104 };
105
106 const SSLCipherSuite legacy_DHE_ciphersuites[] = {
107 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
108 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
109 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
110 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
111 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
112 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
113 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
114 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
115 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
116 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
117 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
118 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
119 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
120 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
121 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
122 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
123 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
124 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
125 TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
126 TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
127 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
128 TLS_RSA_WITH_AES_256_GCM_SHA384,
129 TLS_RSA_WITH_AES_128_GCM_SHA256,
130 TLS_RSA_WITH_AES_256_CBC_SHA256,
131 TLS_RSA_WITH_AES_128_CBC_SHA256,
132 TLS_RSA_WITH_AES_256_CBC_SHA,
133 TLS_RSA_WITH_AES_128_CBC_SHA,
134 SSL_RSA_WITH_3DES_EDE_CBC_SHA,
135 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
136 TLS_ECDHE_RSA_WITH_RC4_128_SHA,
137 SSL_RSA_WITH_RC4_128_SHA,
138 SSL_RSA_WITH_RC4_128_MD5,
139 };
140
141
142
143 const SSLCipherSuite standard_ciphersuites[] = {
144 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
145 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
146 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
147 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
148 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
149 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
150 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
151 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
152 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
153 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
154 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
155 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
156 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
157 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
158 TLS_RSA_WITH_AES_256_GCM_SHA384,
159 TLS_RSA_WITH_AES_128_GCM_SHA256,
160 TLS_RSA_WITH_AES_256_CBC_SHA256,
161 TLS_RSA_WITH_AES_128_CBC_SHA256,
162 TLS_RSA_WITH_AES_256_CBC_SHA,
163 TLS_RSA_WITH_AES_128_CBC_SHA,
164 SSL_RSA_WITH_3DES_EDE_CBC_SHA,
165 };
166
167 const SSLCipherSuite ATSv1_ciphersuites[] = {
168 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
169 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
170 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
171 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
172 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
173 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
174 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
175 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
176 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
177 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
178 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
179 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
180 };
181
182 const SSLCipherSuite ATSv1_noPFS_ciphersuites[] = {
183 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
184 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
185 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
186 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
187 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
188 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
189 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
190 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
191 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
192 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
193 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
194 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
195
196 TLS_RSA_WITH_AES_256_GCM_SHA384,
197 TLS_RSA_WITH_AES_128_GCM_SHA256,
198 TLS_RSA_WITH_AES_256_CBC_SHA256,
199 TLS_RSA_WITH_AES_128_CBC_SHA256,
200 TLS_RSA_WITH_AES_256_CBC_SHA,
201 TLS_RSA_WITH_AES_128_CBC_SHA,
202 };
203
204 const SSLCipherSuite TLSv1_RC4_fallback_ciphersuites[] = {
205 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
206 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
207 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
208 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
209 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
210 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
211 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
212 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
213 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
214 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
215 TLS_RSA_WITH_AES_256_CBC_SHA256,
216 TLS_RSA_WITH_AES_128_CBC_SHA256,
217 TLS_RSA_WITH_AES_256_CBC_SHA,
218 TLS_RSA_WITH_AES_128_CBC_SHA,
219 SSL_RSA_WITH_3DES_EDE_CBC_SHA,
220 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
221 TLS_ECDHE_RSA_WITH_RC4_128_SHA,
222 SSL_RSA_WITH_RC4_128_SHA,
223 SSL_RSA_WITH_RC4_128_MD5,
224 };
225
226 const SSLCipherSuite TLSv1_fallback_ciphersuites[] = {
227 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
228 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
229 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
230 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
231 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
232 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
233 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
234 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
235 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
236 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
237 TLS_RSA_WITH_AES_256_CBC_SHA256,
238 TLS_RSA_WITH_AES_128_CBC_SHA256,
239 TLS_RSA_WITH_AES_256_CBC_SHA,
240 TLS_RSA_WITH_AES_128_CBC_SHA,
241 SSL_RSA_WITH_3DES_EDE_CBC_SHA,
242 };
243
244
245
246 static int test_GetEnabledCiphers(SSLContextRef ssl, unsigned expected_num_ciphers, const SSLCipherSuite *expected_ciphers)
247 {
248 size_t num_ciphers;
249 size_t size;
250 int fail=1;
251 SSLCipherSuite *ciphers = NULL;
252 OSStatus err;
253
254 err=SSLSetIOFuncs(ssl, &SocketRead, &SocketWrite);
255 err=SSLSetConnection(ssl, NULL);
256
257 require_noerr(SSLGetNumberEnabledCiphers(ssl, &num_ciphers), out);
258 require_string(num_ciphers==expected_num_ciphers, out, "wrong ciphersuites number");
259
260 size = num_ciphers * sizeof (SSLCipherSuite);
261 ciphers = (SSLCipherSuite *) malloc(size);
262 require_string(ciphers, out, "out of memory");
263 memset(ciphers, 0xff, size);
264
265 require_noerr(SSLGetEnabledCiphers(ssl, ciphers, &num_ciphers), out);
266 require_string(memcmp(ciphers, expected_ciphers, size)==0, out, "wrong ciphersuites");
267
268 free(ciphers);
269 ciphers = NULL;
270
271 err=SSLHandshake(ssl);
272
273
274 require_noerr(SSLGetNumberEnabledCiphers(ssl, &num_ciphers), out);
275 require_string(num_ciphers==expected_num_ciphers, out, "wrong ciphersuites number");
276
277 size = num_ciphers * sizeof (SSLCipherSuite);
278 ciphers = (SSLCipherSuite *) malloc(size);
279 require_string(ciphers, out, "out of memory");
280 memset(ciphers, 0xff, size);
281
282 require_noerr(SSLGetEnabledCiphers(ssl, ciphers, &num_ciphers), out);
283 require_string(memcmp(ciphers, expected_ciphers, size)==0, out, "wrong ciphersuites");
284
285 /* Success! */
286 fail=0;
287
288 out:
289 free(ciphers);
290 return fail;
291 }
292
293 static int test_SetEnabledCiphers(SSLContextRef ssl)
294 {
295 int fail=1;
296 size_t num_enabled;
297
298 /* This should not fail as long as we have one valid cipher in this table */
299 SSLCipherSuite ciphers[] = {
300 SSL_RSA_WITH_RC2_CBC_MD5, /* unsupported */
301 TLS_RSA_WITH_NULL_SHA, /* supported by not enabled by default */
302 TLS_RSA_WITH_AES_128_CBC_SHA, /* Supported and enabled by default */
303 };
304
305 require_noerr(SSLSetEnabledCiphers(ssl, ciphers, sizeof(ciphers)/sizeof(SSLCipherSuite)), out);
306 require_noerr(SSLGetNumberEnabledCiphers(ssl, &num_enabled), out);
307
308 require(num_enabled==2, out); /* 2 ciphers in the above table are supported */
309
310 /* Success! */
311 fail=0;
312
313 out:
314 return fail;
315 }
316
317
318 static void
319 test_dhe(SSLProtocolSide side, bool dhe_enabled)
320 {
321 SSLContextRef ssl = NULL;
322 bool server = (side == kSSLServerSide);
323
324 ssl=SSLCreateContext(kCFAllocatorDefault, side, kSSLStreamType);
325 ok(ssl, "test_dhe: SSLCreateContext(1) failed (%s, %s)", server?"server":"client", dhe_enabled?"enabled":"disabled");
326 require(ssl, out);
327
328 ok_status(SSLSetDHEEnabled(ssl, dhe_enabled),"test_dhe: SSLSetDHEEnabled failed (%s, %s)", server?"server":"client", dhe_enabled?"enabled":"disabled");
329
330 unsigned num = (dhe_enabled?sizeof(legacy_DHE_ciphersuites):sizeof(legacy_ciphersuites))/sizeof(SSLCipherSuite);
331 const SSLCipherSuite *ciphers = dhe_enabled?legacy_DHE_ciphersuites:legacy_ciphersuites;
332 /* The order of this tests does matter, be careful when adding tests */
333 ok(!test_GetSupportedCiphers(ssl, server), "test_dhe: GetSupportedCiphers test failed (%s, %s)", server?"server":"client", dhe_enabled?"enabled":"disabled");
334 ok(!test_GetEnabledCiphers(ssl, num, ciphers), "test_dhe: GetEnabledCiphers test failed (%s, %s)", server?"server":"client", dhe_enabled?"enabled":"disabled");
335
336 CFRelease(ssl); ssl=NULL;
337
338 ssl=SSLCreateContext(kCFAllocatorDefault, side, kSSLStreamType);
339 ok(ssl, "test_dhe: SSLCreateContext(2) failed (%s, %s)", server?"server":"client", dhe_enabled?"enabled":"disabled");
340 require(ssl, out);
341
342 ok(!test_SetEnabledCiphers(ssl), "test_dhe: SetEnabledCiphers test failed (%s, %s)", server?"server":"client", dhe_enabled?"enabled":"disabled");
343
344 out:
345 if(ssl) CFRelease(ssl);
346 }
347
348 static void
349 test_config(SSLProtocolSide side, CFStringRef config, unsigned num, const SSLCipherSuite *ciphers)
350 {
351 SSLContextRef ssl = NULL;
352 bool server = (side == kSSLServerSide);
353
354 ssl=SSLCreateContext(kCFAllocatorDefault, side, kSSLStreamType);
355 ok(ssl, "test_config: SSLCreateContext(1) failed (%s,%@)", server?"server":"client", config);
356 require(ssl, out);
357
358 ok_status(SSLSetSessionConfig(ssl, config), "test_config: SSLSetSessionConfig failed (%s,%@)", server?"server":"client", config);
359
360 /* The order of this tests does matter, be careful when adding tests */
361 ok(!test_GetSupportedCiphers(ssl, server), "test_config: GetSupportedCiphers test failed (%s,%@)", server?"server":"client", config);
362 ok(!test_GetEnabledCiphers(ssl, num, ciphers), "test_config: GetEnabledCiphers test failed (%s,%@)", server?"server":"client", config);
363
364 CFRelease(ssl); ssl=NULL;
365
366 ssl=SSLCreateContext(kCFAllocatorDefault, side, kSSLStreamType);
367 ok(ssl, "test_config: SSLCreateContext(2) failed (%s,%@)", server?"server":"client", config);
368 require(ssl, out);
369
370 ok(!test_SetEnabledCiphers(ssl), "test_config: SetEnabledCiphers test failed (%s,%@)", server?"server":"client", config);
371
372 out:
373 if(ssl) CFRelease(ssl);
374 }
375
376
377
378 int ssl_46_SSLGetSupportedCiphers(int argc, char *const *argv)
379 {
380 plan_tests(132);
381
382 test_dhe(kSSLClientSide, true);
383 test_dhe(kSSLServerSide, true);
384 test_dhe(kSSLClientSide, false);
385 test_dhe(kSSLServerSide, false);
386
387 #define TEST_CONFIG(x, y) do { \
388 test_config(kSSLClientSide, x, sizeof(y)/sizeof(SSLCipherSuite), y); \
389 test_config(kSSLServerSide, x, sizeof(y)/sizeof(SSLCipherSuite), y); \
390 } while(0)
391
392 TEST_CONFIG(kSSLSessionConfig_ATSv1, ATSv1_ciphersuites);
393 TEST_CONFIG(kSSLSessionConfig_ATSv1_noPFS, ATSv1_noPFS_ciphersuites);
394 TEST_CONFIG(kSSLSessionConfig_legacy, legacy_ciphersuites);
395 TEST_CONFIG(kSSLSessionConfig_legacy_DHE, legacy_DHE_ciphersuites);
396 TEST_CONFIG(kSSLSessionConfig_standard, standard_ciphersuites);
397 TEST_CONFIG(kSSLSessionConfig_RC4_fallback, legacy_ciphersuites);
398 TEST_CONFIG(kSSLSessionConfig_TLSv1_fallback, standard_ciphersuites);
399 TEST_CONFIG(kSSLSessionConfig_TLSv1_RC4_fallback, legacy_ciphersuites);
400 TEST_CONFIG(kSSLSessionConfig_default, legacy_ciphersuites);
401
402 return 0;
403 }
404