TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-04-11 23:00:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10065 from minosgalanakis/task9887_extend_defragmentation_tests_36

Browse Source 
[Backport 3.6]  Extend ssl-opt testing for TLS HS defragmentation
This commit is contained in:
Gilles Peskine
2025-03-18 12:46:29 +00:00
committed by GitHub
parent b6ad19b2b8 6c129c36ff
commit f985bee481
2 changed files with 173 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
programs/ssl/ssl_client2.c
View File

@@ -76,6 +76,7 @@ int main(void)
#define DFL_RECO_SERVER_NAME NULL
#define DFL_RECO_DELAY 0
#define DFL_RECO_MODE 1
#define DFL_RENEGO_DELAY -2
#define DFL_CID_ENABLED 0
#define DFL_CID_VALUE ""
#define DFL_CID_ENABLED_RENEGO -1
@@ -308,7 +309,8 @@ int main(void)
#if defined(MBEDTLS_SSL_RENEGOTIATION)
#define USAGE_RENEGO \
" renegotiation=%%d default: 0 (disabled)\n" \
" renegotiate=%%d default: 0 (disabled)\n"
" renegotiate=%%d default: 0 (disabled)\n" \
" renego_delay=%%d default: -2 (library default)\n"
#else
#define USAGE_RENEGO ""
#endif
@@ -957,6 +959,7 @@ int main(int argc, char *argv[])
opt.renegotiation = DFL_RENEGOTIATION;
opt.allow_legacy = DFL_ALLOW_LEGACY;
opt.renegotiate = DFL_RENEGOTIATE;
opt.renego_delay = DFL_RENEGO_DELAY;
opt.exchanges = DFL_EXCHANGES;
opt.min_version = DFL_MIN_VERSION;
opt.max_version = DFL_MAX_VERSION;
@@ -1193,6 +1196,8 @@ usage:
break;
default: goto usage;
}
} else if (strcmp(p, "renego_delay") == 0) {
opt.renego_delay = (atoi(q));
} else if (strcmp(p, "renegotiate") == 0) {
opt.renegotiate = atoi(q);
if (opt.renegotiate < 0 || opt.renegotiate > 1) {
@@ -1966,6 +1971,9 @@ usage:
}
#if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedtls_ssl_conf_renegotiation(&conf, opt.renegotiation);
if (opt.renego_delay != DFL_RENEGO_DELAY) {
mbedtls_ssl_conf_renegotiation_enforced(&conf, opt.renego_delay);
}
#endif
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
@@ -2510,6 +2518,8 @@ usage:
}
mbedtls_printf(" ok\n");
}
#endif /* MBEDTLS_SSL_RENEGOTIATION */
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)

163
tests/ssl-opt.sh
View File

@@ -103,12 +103,14 @@ if [ -n "${OPENSSL_NEXT:-}" ]; then
O_NEXT_SRV_NO_CERT="$OPENSSL_NEXT s_server -www "
O_NEXT_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_NEXT s_client -CAfile $DATA_FILES_PATH/test-ca_cat12.crt"
O_NEXT_CLI_NO_CERT="echo 'GET / HTTP/1.0' | $OPENSSL_NEXT s_client"
O_NEXT_CLI_RENEGOTIATE="echo 'R' | $OPENSSL_NEXT s_client -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key"
else
O_NEXT_SRV=false
O_NEXT_SRV_NO_CERT=false
O_NEXT_SRV_EARLY_DATA=false
O_NEXT_CLI_NO_CERT=false
O_NEXT_CLI=false
O_NEXT_CLI_RENEGOTIATE=false
fi
if [ -n "${GNUTLS_NEXT_SERV:-}" ]; then
@@ -14463,7 +14465,7 @@ run_test "TLS 1.2 ClientHello indicating support for deflate compression meth
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=32, TLS 1.2 ClientHello" \
run_test "Handshake defragmentation on server: len=32, TLS 1.2 ClientHello (unsupported)" \
"$P_SRV debug_level=4 force_version=tls12 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 32 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
1 \
@@ -14471,6 +14473,165 @@ run_test "Handshake defragmentation on server: len=32, TLS 1.2 ClientHello" \
-s "bad client hello message" \
-s "SSL - A message could not be parsed due to a syntactic error"
# Test server-side buffer resizing with fragmented handshake on TLS1.2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
requires_config_enabled MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
requires_max_content_len 1025
run_test "Handshake defragmentation on server: len=256, buffer resizing with MFL=1024" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 256 -maxfraglen 1024 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
-s "Reallocating in_buf" \
-s "Reallocating out_buf" \
-s "reassembled record" \
-s "initial handshake fragment: 256, 0\\.\\.256 of [0-9]\\+" \
-s "Prepare: waiting for more handshake fragments 256/" \
-s "Consume: waiting for more handshake fragments 256/"
# Test client-initiated renegotiation with fragmented handshake on TLS1.2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on server: len=512, client-initiated renegotiation" \
"$P_SRV debug_level=4 exchanges=2 renegotiation=1 auth_mode=required" \
"$O_NEXT_CLI_RENEGOTIATE -tls1_2 -split_send_frag 512 -connect 127.0.0.1:+$SRV_PORT" \
0 \
-s "received TLS_EMPTY_RENEGOTIATION_INFO" \
-s "found renegotiation extension" \
-s "server hello, secure renegotiation extension" \
-s "=> renegotiate" \
-S "write hello request" \
-s "reassembled record" \
-s "initial handshake fragment: 512, 0\\.\\.512 of [0-9]\\+" \
-s "Prepare: waiting for more handshake fragments 512/" \
-s "Consume: waiting for more handshake fragments 512/" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on server: len=256, client-initiated renegotiation" \
"$P_SRV debug_level=4 exchanges=2 renegotiation=1 auth_mode=required" \
"$O_NEXT_CLI_RENEGOTIATE -tls1_2 -split_send_frag 256 -connect 127.0.0.1:+$SRV_PORT" \
0 \
-s "received TLS_EMPTY_RENEGOTIATION_INFO" \
-s "found renegotiation extension" \
-s "server hello, secure renegotiation extension" \
-s "=> renegotiate" \
-S "write hello request" \
-s "reassembled record" \
-s "initial handshake fragment: 256, 0\\.\\.256 of [0-9]\\+" \
-s "Prepare: waiting for more handshake fragments 256/" \
-s "Consume: waiting for more handshake fragments 256/" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on server: len=128, client-initiated renegotiation" \
"$P_SRV debug_level=4 exchanges=2 renegotiation=1 auth_mode=required" \
"$O_NEXT_CLI_RENEGOTIATE -tls1_2 -split_send_frag 128 -connect 127.0.0.1:+$SRV_PORT" \
0 \
-s "received TLS_EMPTY_RENEGOTIATION_INFO" \
-s "found renegotiation extension" \
-s "server hello, secure renegotiation extension" \
-s "=> renegotiate" \
-S "write hello request" \
-s "reassembled record" \
-s "initial handshake fragment: 128, 0\\.\\.128 of [0-9]\\+" \
-s "Prepare: waiting for more handshake fragments 128/" \
-s "Consume: waiting for more handshake fragments 128/" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on server: len=4, client-initiated renegotiation" \
"$P_SRV debug_level=4 exchanges=2 renegotiation=1 auth_mode=required" \
"$O_NEXT_CLI_RENEGOTIATE -tls1_2 -split_send_frag 4 -connect 127.0.0.1:+$SRV_PORT" \
0 \
-s "received TLS_EMPTY_RENEGOTIATION_INFO" \
-s "found renegotiation extension" \
-s "server hello, secure renegotiation extension" \
-s "=> renegotiate" \
-S "write hello request" \
-s "reassembled record" \
-s "initial handshake fragment: 4, 0\\.\\.4 of [0-9]\\+" \
-s "Prepare: waiting for more handshake fragments 4/" \
-s "Consume: waiting for more handshake fragments 4/" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on server: len=4, client-initiated server-rejected renegotiation" \
"$P_SRV debug_level=4 exchanges=2 renegotiation=0 auth_mode=required" \
"$O_NEXT_CLI_RENEGOTIATE -tls1_2 -split_send_frag 4 -connect 127.0.0.1:+$SRV_PORT" \
1 \
-s "received TLS_EMPTY_RENEGOTIATION_INFO" \
-s "refusing renegotiation, sending alert" \
-s "server hello, secure renegotiation extension" \
-s "initial handshake fragment: 4, 0\\.\\.4 of [0-9]\\+" \
-s "Prepare: waiting for more handshake fragments 4/" \
-s "Consume: waiting for more handshake fragments 4/" \
# Test server-initiated renegotiation with fragmented handshake on TLS1.2
# Note: The /reneg endpoint serves as a directive for OpenSSL's s_server
# to initiate a handshake renegotiation.
# Note: Adjusting the renegotiation delay beyond the library's default
# value of 16 is necessary. This parameter defines the maximum
# number of records received before renegotiation is completed.
# By fragmenting records and thereby increasing their quantity,
# the default threshold can be reached more quickly.
# Setting it to -1 disables that policy's enforment.
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on client: len=512, server-initiated renegotiation" \
"$O_NEXT_SRV -tls1_2 -split_send_frag 512 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
"$P_CLI debug_level=3 renegotiation=1 request_page=/reneg" \
0 \
-c "initial handshake fragment: 512, 0\\.\\.512 of [0-9]\\+" \
-c "Prepare: waiting for more handshake fragments 512/" \
-c "Consume: waiting for more handshake fragments 512/" \
-c "client hello, adding renegotiation extension" \
-c "found renegotiation extension" \
-c "=> renegotiate"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on client: len=256, server-initiated renegotiation" \
"$O_NEXT_SRV -tls1_2 -split_send_frag 256 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
"$P_CLI debug_level=3 renegotiation=1 renego_delay=-1 request_page=/reneg" \
0 \
-c "initial handshake fragment: 256, 0\\.\\.256 of [0-9]\\+" \
-c "Prepare: waiting for more handshake fragments 256/" \
-c "Consume: waiting for more handshake fragments 256/" \
-c "client hello, adding renegotiation extension" \
-c "found renegotiation extension" \
-c "=> renegotiate"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on client: len=128, server-initiated renegotiation" \
"$O_NEXT_SRV -tls1_2 -split_send_frag 128 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
"$P_CLI debug_level=3 renegotiation=1 renego_delay=-1 request_page=/reneg" \
0 \
-c "initial handshake fragment: 128, 0\\.\\.128 of [0-9]\\+" \
-c "Prepare: waiting for more handshake fragments 128/" \
-c "Consume: waiting for more handshake fragments 128/" \
-c "client hello, adding renegotiation extension" \
-c "found renegotiation extension" \
-c "=> renegotiate"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "Handshake defragmentation on client: len=4, server-initiated renegotiation" \
"$O_NEXT_SRV -tls1_2 -split_send_frag 4 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
"$P_CLI debug_level=3 renegotiation=1 renego_delay=-1 request_page=/reneg" \
0 \
-c "initial handshake fragment: 4, 0\\.\\.4 of [0-9]\\+" \
-c "Prepare: waiting for more handshake fragments 4/" \
-c "Consume: waiting for more handshake fragments 4/" \
-c "client hello, adding renegotiation extension" \
-c "found renegotiation extension" \
-c "=> renegotiate"
# Test heap memory usage after handshake
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_MEMORY_DEBUG