--- /dev/null
+/* Copyright (c) 2005-2006 Apple Computer, Inc.
+ *
+ * ssl2Padding.cpp - test CSSM_PADDING_APPLE_SSLv2.
+ */
+
+
+ /*
+ * This table illustrates the combinations of:
+ *
+ * -- SSLv2 (v2) and SSLv3/TLSv1 (v3+) enables (0/1) on the client and server side
+ * -- the resulting negotiated protocols (including those forced by a man-in-the-middle
+ * attacker, denoted by (m))
+ * -- the padding generated by the client (client pad)
+ * -- the padding style checked by the server (server pad)
+ * -- and the end results
+ *
+ * client server
+ * ------ ------
+ * v2 v3+ v2 v3+ negotiate client pad server pad result
+ * -- -- -- -- --------- ---------- ---------- ------
+ * 0 0 x x impossible
+ * x x 0 0 impossible
+ * 0 1 0 1 v3+ PKCS1 PKCS1 normal
+ * 0 1 0 1 v2 (m) Attack fails, client rejects server hello
+ * 0 1 1 0 fail incompatible
+ * 0 1 1 1 v3+ PKCS1 PKCS1 normal
+ * 0 1 1 1 v2 (m) Attack fails, client rejects server hello
+ * 1 0 0 1 fail incompatible
+ * 1 0 1 0 v2 PKCS1 PKCS1 normal, both sides are dumb SSL2
+ * 1 0 1 0 v3+ Attack fails, server rejects client hello
+ * 1 0 1 1 v2 PKCS1 SSLv2 normal, dumb client
+ * 1 0 1 1 v3+ (m) Attack fails, client rejects server hello
+ * 1 1 0 1 v3+ PKCS1 PKCS1 normal
+ * 1 1 0 1 v2 (m) Attack fails, server rejects SSL2 handshake
+ * 1 1 1 0 v2 SSLv2 PKCS1 normal, dumb server
+ * 1 1 1 0 v3+ (m) Attack fails, server rejects SSL3 handshakes
+ * 1 1 1 1 v3+ PKCS1 PKCS1 normal
+ * 1 1 1 1 v2 (m) SSLv2 SSLv2 Attack fails due to SSLv2 pad detect
+ *
+ * The client generates SSLv2 padding if it's capable of v3+ but is currently operating
+ * in v2 per negotiation.
+ *
+ * The server checks for SSLv2 padding if it's capable of v3+ but is currently operating
+ * in v2 per negotiation. If SSLv2 padding is seen, fail.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+#include <Security/cssm.h>
+#include "cspwrap.h"
+#include "common.h"
+#include "cspdlTesting.h"
+
+#define USAGE_NAME "noUsage"
+#define USAGE_NAME_LEN (strlen(USAGE_NAME))
+#define LOOPS_DEF 10
+
+#define KEY_SIZE_DEF 1024
+#define KEY_SIZE_SMALL 512
+
+#define PTEXT_LEN 32 /* bytes */
+
+static void usage(char **argv)
+{
+ printf("usage: %s [options]\n", argv[0]);
+ printf(" Options:\n");
+ printf(" l=loops (default=%d; 0=forever)\n", LOOPS_DEF);
+ printf(" k=keySizeInBits; default=%d\n", KEY_SIZE_DEF);
+ printf(" D (CSP/DL; default = bare CSP)\n");
+ printf(" p (pause on each loop)\n");
+ printf(" u (quick; small keys)\n");
+ printf(" v(erbose)\n");
+ printf(" q(uiet)\n");
+ printf(" h(elp)\n");
+ exit(1);
+}
+
+/* special-purpose generate-context, encrypt, and decrypt routines just for this test */
+static int genRsaCryptContext(
+ CSSM_CSP_HANDLE cspHand,
+ CSSM_KEY_PTR key,
+ CSSM_PADDING padding,
+ CSSM_BOOL quiet,
+ CSSM_CC_HANDLE &ccHand) // RETURNED
+{
+ CSSM_RETURN crtn;
+ CSSM_ACCESS_CREDENTIALS creds;
+
+ memset(&creds, 0, sizeof(CSSM_ACCESS_CREDENTIALS));
+ crtn = CSSM_CSP_CreateAsymmetricContext(cspHand,
+ CSSM_ALGID_RSA,
+ &creds, // access
+ key,
+ padding,
+ &ccHand);
+ if(crtn) {
+ cssmPerror("CSSM_CSP_CreateAsymmetricContext", crtn);
+ return testError(quiet);
+ }
+ return 0;
+}
+
+static int doRsaEncrypt(
+ CSSM_CSP_HANDLE cspHand,
+ CSSM_KEY_PTR key,
+ CSSM_PADDING padding,
+ CSSM_BOOL quiet,
+ CSSM_DATA *ptext,
+ CSSM_DATA *ctext)
+{
+ CSSM_CC_HANDLE ccHand;
+ int rtn;
+ CSSM_RETURN crtn;
+ CSSM_SIZE bytesMoved;
+ CSSM_DATA remData = {0, NULL};
+
+ rtn = genRsaCryptContext(cspHand, key, padding, quiet, ccHand);
+ if(rtn) {
+ return rtn;
+ }
+ crtn = CSSM_EncryptData(ccHand,
+ ptext,
+ 1,
+ ctext,
+ 1,
+ &bytesMoved,
+ &remData);
+ CSSM_DeleteContext(ccHand);
+ if(crtn == CSSM_OK) {
+ /*
+ * Deal with remData - its contents are included in bytesMoved.
+ */
+ if(remData.Length != 0) {
+ /* malloc and copy a new one */
+ uint8 *newCdata = (uint8 *)appMalloc(bytesMoved, NULL);
+ memmove(newCdata, ctext->Data, ctext->Length);
+ memmove(newCdata+ctext->Length, remData.Data, remData.Length);
+ CSSM_FREE(ctext->Data);
+ ctext->Data = newCdata;
+ }
+ ctext->Length = bytesMoved;
+ return 0;
+ }
+ else {
+ cssmPerror("CSSM_EncryptData", crtn);
+ return testError(quiet);
+ }
+}
+
+static int doRsaDecrypt(
+ CSSM_CSP_HANDLE cspHand,
+ CSSM_KEY_PTR key,
+ CSSM_PADDING padding,
+ CSSM_BOOL quiet,
+ CSSM_RETURN expectRtn,
+ CSSM_DATA *ctext,
+ CSSM_DATA *rptext)
+{
+ CSSM_CC_HANDLE ccHand;
+ int rtn;
+ CSSM_RETURN crtn;
+ CSSM_SIZE bytesMoved;
+ CSSM_DATA remData = {0, NULL};
+
+ rtn = genRsaCryptContext(cspHand, key, padding, quiet, ccHand);
+ if(rtn) {
+ return rtn;
+ }
+ crtn = CSSM_DecryptData(ccHand,
+ ctext,
+ 1,
+ rptext,
+ 1,
+ &bytesMoved,
+ &remData);
+ CSSM_DeleteContext(ccHand);
+ if(crtn != expectRtn) {
+ printf(" CSSM_DecryptData: expect %s\n", cssmErrToStr(expectRtn));
+ printf(" CSSM_DecryptData: got %s\n", cssmErrToStr(crtn));
+ return testError(quiet);
+ }
+ if(crtn) {
+ /* no need to process further */
+ return 0;
+ }
+ if(crtn == CSSM_OK) {
+ /*
+ * Deal with remData - its contents are included in bytesMoved.
+ */
+ if(remData.Length != 0) {
+ /* malloc and copy a new one */
+ uint8 *newRpdata = (uint8 *)appMalloc(bytesMoved, NULL);
+ memmove(newRpdata, rptext->Data, rptext->Length);
+ memmove(newRpdata+rptext->Length, remData.Data, remData.Length);
+ CSSM_FREE(rptext->Data);
+ rptext->Data = newRpdata;
+ }
+ rptext->Length = bytesMoved;
+ return 0;
+ }
+ else {
+ cssmPerror("CSSM_DecryptData", crtn);
+ return testError(quiet);
+ }
+}
+
+/*
+ * encrypt with specified pad
+ * decrypt with specified pad, verify expected result (which may be failure)
+ */
+static int doTest(
+ CSSM_CSP_HANDLE cspHand,
+ CSSM_KEY_PTR pubKey,
+ CSSM_KEY_PTR privKey,
+ CSSM_PADDING encrPad,
+ CSSM_PADDING decrPad,
+ CSSM_BOOL quiet,
+ CSSM_RETURN expectResult)
+{
+ int rtn;
+ uint8 ptext[PTEXT_LEN];
+ CSSM_DATA ptextData = {PTEXT_LEN, ptext};
+ CSSM_DATA ctext = {0, NULL};
+ CSSM_DATA rptext = {0, NULL};
+
+ simpleGenData(&ptextData, PTEXT_LEN, PTEXT_LEN);
+ rtn = doRsaEncrypt(cspHand, pubKey, encrPad, quiet, &ptextData, &ctext);
+ if(rtn) {
+ goto errOut;
+ }
+ rtn = doRsaDecrypt(cspHand, privKey, decrPad, quiet, expectResult, &ctext, &rptext);
+ if(rtn) {
+ goto errOut;
+ }
+ if(expectResult == CSSM_OK) {
+ if(memcmp(rptext.Data, ptextData.Data, PTEXT_LEN)) {
+ printf("***Data miscomapare after decrypt\n");
+ rtn = testError(quiet);
+ }
+ }
+errOut:
+ if(ctext.Data) {
+ CSSM_FREE(ctext.Data);
+ }
+ if(rptext.Data) {
+ CSSM_FREE(rptext.Data);
+ }
+ return rtn;
+}
+
+int main(int argc, char **argv)
+{
+ int arg;
+ char *argp;
+ unsigned loop;
+ CSSM_CSP_HANDLE cspHand;
+ int rtn = 0;
+
+ /*
+ * User-spec'd params
+ */
+ unsigned loops = LOOPS_DEF;
+ CSSM_BOOL verbose = CSSM_FALSE;
+ CSSM_BOOL quiet = CSSM_FALSE;
+ uint32 keySizeInBits = KEY_SIZE_DEF;
+ CSSM_BOOL bareCsp = CSSM_TRUE;
+ CSSM_BOOL doPause = CSSM_FALSE;
+
+ for(arg=1; arg<argc; arg++) {
+ argp = argv[arg];
+ switch(argp[0]) {
+ case 'l':
+ loops = atoi(&argp[2]);
+ break;
+ case 'k':
+ keySizeInBits = atoi(&argv[arg][2]);
+ break;
+ case 'D':
+ bareCsp = CSSM_FALSE;
+ break;
+ case 'u':
+ keySizeInBits = KEY_SIZE_SMALL;
+ break;
+ case 'v':
+ verbose = CSSM_TRUE;
+ break;
+ case 'p':
+ doPause = CSSM_TRUE;
+ break;
+ case 'q':
+ quiet = CSSM_TRUE;
+ break;
+ case 'h':
+ default:
+ usage(argv);
+ }
+ }
+
+ testStartBanner("ssl2Padding", argc, argv);
+
+ cspHand = cspDlDbStartup(bareCsp, NULL);
+ if(cspHand == 0) {
+ exit(1);
+ }
+ CSSM_KEY pubKey;
+ CSSM_KEY privKey;
+
+ CSSM_RETURN crtn = cspGenKeyPair(cspHand, CSSM_ALGID_RSA,
+ USAGE_NAME, USAGE_NAME_LEN,
+ keySizeInBits,
+ &pubKey, CSSM_TRUE /* ref */, CSSM_KEYUSE_ANY, CSSM_KEYBLOB_RAW_FORMAT_NONE,
+ &privKey, CSSM_TRUE /* ref */, CSSM_KEYUSE_ANY, CSSM_KEYBLOB_RAW_FORMAT_NONE,
+ CSSM_FALSE);
+ if(crtn) {
+ printf("***Error generating key pair. Aborting.\n");
+ exit(1);
+ }
+ for(loop=1; ; loop++) {
+ if(doPause) {
+ fpurge(stdin);
+ printf("Top of loop; hit CR to proceed: ");
+ getchar();
+ }
+
+ /* encrypt by client, decrypt by server. */
+
+ /*
+ * SSLv3+ negotiated, normal case, or
+ * both sides support SSLv2 only
+ */
+ if(!quiet) {
+ printf("...loop %u\n", loop);
+ printf(" encrPad PKCS1 decrPad PKCS1\n");
+ }
+ rtn = doTest(cspHand, &pubKey, &privKey,
+ CSSM_PADDING_PKCS1, CSSM_PADDING_PKCS1,
+ quiet, CSSM_OK);
+ if(rtn) {
+ break;
+ }
+
+ /*
+ * Server supports SSLv2 and SSLv3+, client supports SSLv2 only
+ */
+ if(!quiet) {
+ printf(" encrPad PKCS1 decrPad SSLv2\n");
+ }
+ rtn = doTest(cspHand, &pubKey, &privKey,
+ CSSM_PADDING_PKCS1, CSSM_PADDING_APPLE_SSLv2,
+ quiet, CSSM_OK);
+ if(rtn) {
+ break;
+ }
+
+ /*
+ * Server supports SSLv2 only, client supports SSLv2 and SSLv3+
+ */
+ if(!quiet) {
+ printf(" encrPad SSLv2 decrPad PKCS1\n");
+ }
+ rtn = doTest(cspHand, &pubKey, &privKey,
+ CSSM_PADDING_APPLE_SSLv2, CSSM_PADDING_PKCS1,
+ quiet, CSSM_OK);
+ if(rtn) {
+ break;
+ }
+
+ /*
+ * Both sides support SSLv3+ but a man in the middle has forced the
+ * negotiated protocol down to SSLv2
+ */
+ if(!quiet) {
+ printf(" encrPad SSLv2 decrPad SSLv2, expect failure\n");
+ }
+ rtn = doTest(cspHand, &pubKey, &privKey,
+ CSSM_PADDING_APPLE_SSLv2, CSSM_PADDING_APPLE_SSLv2,
+ quiet, CSSMERR_CSP_APPLE_SSLv2_ROLLBACK);
+ if(rtn) {
+ break;
+ }
+
+ if(loops && (loop == loops)) {
+ break;
+ }
+ } /* for loop */
+
+ CSSM_ModuleDetach(cspHand);
+ if((rtn == 0) && !quiet) {
+ printf("%s test complete\n", argv[0]);
+ }
+ return rtn;
+}
projects / apple / security.git / blobdiff