coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1667 from gilles-peskine-arm/badmac_seen_or_in_hsfraglen-test-4.1

Browse Source 
Backport 4.1: test badmac_seen with renegotiation
This commit is contained in:
minosgalanakis 2026-06-22 15:49:58 +01:00 committed by GitHub
commit 0e69eb6990
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 469 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
programs/ssl/ssl_client2.c
View File

@ -86,6 +86,7 @@ int main(void)
#define DFL_HS_TO_MIN 0
#define DFL_HS_TO_MAX 0
#define DFL_DTLS_MTU -1
#define DFL_BADMAC_LIMIT -1
#define DFL_DGRAM_PACKING 1
#define DFL_FALLBACK -1
#define DFL_EXTENDED_MS -1
@ -269,7 +270,8 @@ int main(void)
" mtu=%%d default: (library default: unlimited)\n" \
" dgram_packing=%%d default: 1 (allowed)\n" \
" allow or forbid packing of multiple\n" \
" records within a single datgram.\n"
" records within a single datagram.\n" \
" badmac_limit=%%d default: (library default: disabled)\n"
#else
#define USAGE_DTLS ""
#endif
@ -294,7 +296,7 @@ int main(void)
#if defined(MBEDTLS_SSL_RENEGOTIATION)
#define USAGE_RENEGO \
" renegotiation=%%d default: 0 (disabled)\n" \
" renegotiate=%%d default: 0 (disabled)\n" \
" renegotiate=%%d default: 0 (disabled), 1 immediately, 2 after first exchange\n" \
" renego_delay=%%d default: -2 (library default)\n"
#else
#define USAGE_RENEGO ""
@ -491,7 +493,7 @@ struct options {
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
int renegotiation; /* enable / disable renegotiation */
int allow_legacy; /* allow legacy renegotiation */
int renegotiate; /* attempt renegotiation? */
int renegotiate; /* attempt renegotiation? 1: before data, 2: after first exchange */
int renego_delay; /* delay before enforcing renegotiation */
int exchanges; /* number of data exchanges */
int min_version; /* minimum protocol version accepted */
@ -518,6 +520,7 @@ struct options {
int dtls_mtu; /* UDP Maximum transport unit for DTLS */
int fallback; /* is this a fallback connection? */
int dgram_packing; /* allow/forbid datagram packing */
int badmac_limit; /* Limit of records with bad MAC */
int extended_ms; /* negotiate extended master secret? */
int etm; /* negotiate encrypt then mac? */
int context_crt_cb; /* use context-specific CRT verify callback */
@ -959,6 +962,7 @@ int main(int argc, char *argv[])
opt.extended_ms = DFL_EXTENDED_MS;
opt.etm = DFL_ETM;
opt.dgram_packing = DFL_DGRAM_PACKING;
opt.badmac_limit = DFL_BADMAC_LIMIT;
opt.serialize = DFL_SERIALIZE;
opt.context_file = DFL_CONTEXT_FILE;
opt.eap_tls = DFL_EAP_TLS;
@ -1164,7 +1168,7 @@ usage:
opt.renego_delay = (atoi(q));
} else if (strcmp(p, "renegotiate") == 0) {
opt.renegotiate = atoi(q);
if (opt.renegotiate < 0 || opt.renegotiate > 1) {
if (opt.renegotiate < 0 || opt.renegotiate > 2) {
goto usage;
}
} else if (strcmp(p, "exchanges") == 0) {
@ -1372,6 +1376,11 @@ usage:
opt.dgram_packing != 1) {
goto usage;
}
} else if (strcmp(p, "badmac_limit") == 0) {
opt.badmac_limit = atoi(q);
if (opt.badmac_limit < 0) {
goto usage;
}
} else if (strcmp(p, "recsplit") == 0) {
opt.recsplit = atoi(q);
if (opt.recsplit < 0 || opt.recsplit > 1) {
@ -1835,6 +1844,10 @@ usage:
if (opt.dgram_packing != DFL_DGRAM_PACKING) {
mbedtls_ssl_set_datagram_packing(&ssl, opt.dgram_packing);
}
if (opt.badmac_limit != DFL_BADMAC_LIMIT) {
mbedtls_ssl_conf_dtls_badmac_limit(&conf, opt.badmac_limit);
}
#endif /* MBEDTLS_SSL_PROTO_DTLS */
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
@ -2442,7 +2455,7 @@ usage:
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
#if defined(MBEDTLS_SSL_RENEGOTIATION)
if (opt.renegotiate) {
if (opt.renegotiate == 1) {
/*
* Perform renegotiation (this must be done when the server is waiting
* for input from our side).
@ -2817,6 +2830,44 @@ send_request:
goto send_request;
}
#if defined(MBEDTLS_SSL_RENEGOTIATION)
if (opt.renegotiate == 2) {
/* Perform renegotiation after the first data exchange.
* This is a one-time thing, we won't renegotiate even if there are
* more data exchanges that cause a `goto send_request` later.
*/
opt.renegotiate = 0;
mbedtls_printf(" . Performing renegotiation...");
fflush(stdout);
while ((ret = mbedtls_ssl_renegotiate(&ssl)) != 0) {
if (ret != MBEDTLS_ERR_SSL_WANT_READ &&
ret != MBEDTLS_ERR_SSL_WANT_WRITE &&
ret != MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) {
mbedtls_printf(" failed\n ! mbedtls_ssl_renegotiate returned %d\n\n",
ret);
goto exit;
}
#if defined(MBEDTLS_ECP_RESTARTABLE)
if (ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) {
continue;
}
#endif
/* For event-driven IO, wait for socket to become available */
if (opt.event == 1 /* level triggered IO */) {
#if defined(MBEDTLS_TIMING_C)
idle(&server_fd, &timer, ret);
#else
idle(&server_fd, ret);
#endif
}
}
mbedtls_printf(" ok\n");
}
#endif /* MBEDTLS_SSL_RENEGOTIATION */
/*
* 7c. Simulate serialize/deserialize and go back to data exchange
*/

7
programs/ssl/ssl_server2.c
View File

@ -367,9 +367,6 @@ int main(void)
#define USAGE_ANTI_REPLAY ""
#endif
#define USAGE_BADMAC_LIMIT \
" badmac_limit=%%d default: (library default: disabled)\n"
#if defined(MBEDTLS_SSL_PROTO_DTLS)
#define USAGE_DTLS \
" dtls=%%d default: 0 (TLS)\n" \
@ -378,7 +375,8 @@ int main(void)
" mtu=%%d default: (library default: unlimited)\n" \
" dgram_packing=%%d default: 1 (allowed)\n" \
" allow or forbid packing of multiple\n" \
" records within a single datgram.\n"
" records within a single datagram.\n" \
" badmac_limit=%%d default: (library default: disabled)\n"
#else
#define USAGE_DTLS ""
#endif
@ -524,7 +522,6 @@ int main(void)
USAGE_SRTP \
USAGE_COOKIES \
USAGE_ANTI_REPLAY \
USAGE_BADMAC_LIMIT \
"\n"
#define USAGE2 \
" auth_mode=%%s default: (library default: none)\n" \

101
programs/test/udp_proxy.c
View File

@ -103,6 +103,12 @@ int main(void)
" May be used multiple times, even for the same\n" \
" message, in which case the respective message\n" \
" gets delayed multiple times.\n" \
" delay_encrypted_hs_cli=%%d default: 0 (don't delay)\n" \
" delay the Nth encrypted handshake message from\n" \
" client to server.\n" \
" delay_encrypted_hs_srv=%%d default: 0 (don't delay)\n" \
" delay the Nth encrypted handshake message from\n" \
" server to client.\n" \
" delay_srv=%%s Handshake message from server that should be\n" \
" delayed. Possible values are 'HelloRequest',\n" \
" 'ServerHello', 'ServerHelloDone', 'Certificate'\n" \
@ -116,6 +122,12 @@ int main(void)
" mtu=%%d default: 0 (unlimited)\n" \
" drop packets larger than N bytes\n" \
" bad_ad=0/1 default: 0 (don't add bad ApplicationData)\n" \
" bad_ad_cli_once=%%d default: 0 (don't add bad ApplicationData)\n" \
" add bad ApplicationData before the Nth\n" \
" ApplicationData from client to server.\n" \
" bad_ad_srv_once=%%d default: 0 (don't add bad ApplicationData)\n" \
" add bad ApplicationData before the Nth\n" \
" ApplicationData from server to client.\n" \
" bad_cid=%%d default: 0 (don't corrupt Connection IDs)\n" \
" duplicate 1:N packets containing a CID,\n" \
" modifying CID in first instance of the packet.\n" \
@ -148,9 +160,13 @@ static struct options {
char *delay_srv[MAX_DELAYED_HS]; /* handshake types of messages from
* server that should be delayed. */
uint8_t delay_srv_cnt; /* Number of entries in delay_srv. */
int delay_encrypted_hs_cli; /* Delay Nth encrypted HS from client. */
int delay_encrypted_hs_srv; /* Delay Nth encrypted HS from server. */
int drop; /* drop 1 packet in N (none if 0) */
int mtu; /* drop packets larger than this */
int bad_ad; /* inject corrupted ApplicationData record */
int bad_ad_cli_once; /* Inject corrupted Nth AD from client. */
int bad_ad_srv_once; /* Inject corrupted Nth AD from server. */
unsigned bad_cid; /* inject corrupted CID record */
int protect_hvr; /* never drop or delay HelloVerifyRequest */
int protect_len; /* never drop/delay packet of the given size*/
@ -219,6 +235,16 @@ static void get_options(int argc, char *argv[])
if (opt.delay_ccs < 0 || opt.delay_ccs > 1) {
exit_usage(p, q);
}
} else if (strcmp(p, "delay_encrypted_hs_cli") == 0) {
opt.delay_encrypted_hs_cli = atoi(q);
if (opt.delay_encrypted_hs_cli < 0) {
exit_usage(p, q);
}
} else if (strcmp(p, "delay_encrypted_hs_srv") == 0) {
opt.delay_encrypted_hs_srv = atoi(q);
if (opt.delay_encrypted_hs_srv < 0) {
exit_usage(p, q);
}
} else if (strcmp(p, "delay_cli") == 0 ||
strcmp(p, "delay_srv") == 0) {
uint8_t *delay_cnt;
@ -271,6 +297,16 @@ static void get_options(int argc, char *argv[])
if (opt.bad_ad < 0 || opt.bad_ad > 1) {
exit_usage(p, q);
}
} else if (strcmp(p, "bad_ad_cli_once") == 0) {
opt.bad_ad_cli_once = atoi(q);
if (opt.bad_ad_cli_once < 0) {
exit_usage(p, q);
}
} else if (strcmp(p, "bad_ad_srv_once") == 0) {
opt.bad_ad_srv_once = atoi(q);
if (opt.bad_ad_srv_once < 0) {
exit_usage(p, q);
}
}
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
else if (strcmp(p, "bad_cid") == 0) {
@ -528,6 +564,35 @@ typedef enum {
static inject_clihlo_state_t inject_clihlo_state;
static packet initial_clihlo;
static unsigned bad_ad_cli_seen;
static unsigned bad_ad_srv_seen;
static int bad_ad_once(const packet *p)
{
unsigned *seen;
int bad_ad_at;
if (strcmp(p->type, "ApplicationData") != 0) {
return 0;
}
if (strcmp(p->way, "S <- C") == 0) {
seen = &bad_ad_cli_seen;
bad_ad_at = opt.bad_ad_cli_once;
} else {
seen = &bad_ad_srv_seen;
bad_ad_at = opt.bad_ad_srv_once;
}
if (bad_ad_at <= 0) {
return 0;
}
++*seen;
return *seen == (unsigned) bad_ad_at;
}
static int send_packet(const packet *p, const char *why)
{
int ret;
@ -559,7 +624,7 @@ static int send_packet(const packet *p, const char *why)
}
/* insert corrupted ApplicationData record? */
if (opt.bad_ad &&
if ((bad_ad_once(p) || opt.bad_ad) &&
strcmp(p->type, "ApplicationData") == 0) {
unsigned char buf[MAX_MSG_SIZE];
memcpy(buf, p->buf, p->len);
@ -664,6 +729,31 @@ static int send_delayed(void)
static unsigned char held[2048] = { 0 };
#define HOLD_MAX 2
static unsigned encrypted_hs_cli_seen;
static unsigned encrypted_hs_srv_seen;
static int delay_encrypted_hs(const packet *p)
{
unsigned *seen;
int delay_at;
if (strcmp(p->type, "Encrypted handshake") != 0) {
return 0;
}
if (strcmp(p->way, "S <- C") == 0) {
seen = &encrypted_hs_cli_seen;
delay_at = opt.delay_encrypted_hs_cli;
} else {
seen = &encrypted_hs_srv_seen;
delay_at = opt.delay_encrypted_hs_srv;
}
++*seen;
return delay_at > 0 && *seen == (unsigned) delay_at;
}
static int handle_message(const char *way,
mbedtls_net_context *dst,
mbedtls_net_context *src)
@ -717,6 +807,11 @@ static int handle_message(const char *way,
}
}
if (delay_encrypted_hs(&cur)) {
delay_packet(&cur);
return 0;
}
/* do we want to drop, delay, or forward it? */
if ((opt.mtu != 0 &&
cur.len > (unsigned) opt.mtu) ||
@ -851,6 +946,10 @@ accept:
*/
clear_pending();
memset(held, 0, sizeof(held));
encrypted_hs_cli_seen = 0;
encrypted_hs_srv_seen = 0;
bad_ad_cli_seen = 0;
bad_ad_srv_seen = 0;
nb_fds = client_fd.fd;
if (nb_fds < server_fd.fd) {

32
tests/include/test/ssl_helpers.h
View File

@ -117,6 +117,9 @@ enum {
#define MBEDTLS_TEST_MAX_ALPN_LIST_SIZE 10
#endif
/* Forward declaration. Defined below. */
struct mbedtls_test_ssl_endpoint;
typedef struct mbedtls_test_ssl_log_pattern {
const char *pattern;
size_t counter;
@ -147,6 +150,35 @@ typedef struct mbedtls_test_handshake_test_options {
int expected_srv_fragments;
int renegotiate;
int legacy_renegotiation;
/** Hook that mbedtls_test_ssl_perform_handshake() runs just before
* the initial handshake. */
void (*pre_handshake_fun)(struct mbedtls_test_ssl_endpoint *client,
struct mbedtls_test_ssl_endpoint *server,
void *param);
/** Value passed to ::pre_handshake_fun. */
void *pre_handshake_param;
/** Hook that mbedtls_test_ssl_perform_handshake() runs after
* the initial handshake succeeds. */
void (*post_handshake_fun)(struct mbedtls_test_ssl_endpoint *client,
struct mbedtls_test_ssl_endpoint *server,
void *param);
/** Value passed to ::post_handshake_fun. */
void *post_handshake_param;
/** Hook that mbedtls_test_ssl_perform_handshake() runs after
* exchanging some data, before testing additional features such as
* serialization and renegotiation. */
void (*post_data_fun)(struct mbedtls_test_ssl_endpoint *client,
struct mbedtls_test_ssl_endpoint *server,
void *param);
/** Value passed to ::post_data_fun. */
void *post_data_param;
/** Hook that mbedtls_test_ssl_perform_handshake() runs after a successful
* connection, just before closing down. */
void (*pre_shutdown_fun)(struct mbedtls_test_ssl_endpoint *client,
struct mbedtls_test_ssl_endpoint *server,
void *param);
/** Value passed to ::pre_shutdown_fun. */
void *pre_shutdown_param;
void *srv_log_obj;
void *cli_log_obj;
void (*srv_log_fun)(void *, int, const char *, int, const char *);

17
tests/src/test_helpers/ssl_helpers.c
View File

@ -2282,6 +2282,10 @@ int mbedtls_test_ssl_perform_connection(
expected_handshake_result = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
}
if (options->pre_handshake_fun != NULL) {
options->pre_handshake_fun(client, server, options->pre_handshake_param);
}
TEST_EQUAL(mbedtls_test_move_handshake_to_state(&(client->ssl),
&(server->ssl),
MBEDTLS_SSL_HANDSHAKE_OVER),
@ -2313,6 +2317,10 @@ int mbedtls_test_ssl_perform_connection(
options->expected_ciphersuite);
}
if (options->post_handshake_fun != NULL) {
options->post_handshake_fun(client, server, options->post_handshake_param);
}
#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
if (options->resize_buffers != 0) {
/* A server, when using DTLS, might delay a buffer resize to happen
@ -2339,6 +2347,11 @@ int mbedtls_test_ssl_perform_connection(
options->expected_srv_fragments),
0);
}
if (options->post_data_fun != NULL) {
options->post_data_fun(client, server, options->post_data_param);
}
#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
if (options->serialize == 1) {
TEST_ASSERT(test_serialization(options, client, server));
@ -2396,6 +2409,10 @@ void mbedtls_test_ssl_perform_handshake(
TEST_ASSERT(mbedtls_ssl_conf_get_user_data_p(&server->conf) == server);
TEST_ASSERT(mbedtls_ssl_get_user_data_p(&server->ssl) == server);
if (options->pre_shutdown_fun != NULL) {
options->pre_shutdown_fun(client, server, options->pre_shutdown_param);
}
exit:
mbedtls_test_ssl_endpoint_free(client);
mbedtls_test_ssl_endpoint_free(server);

147
tests/ssl-opt.sh
View File

@ -5269,6 +5269,7 @@ run_test "Renegotiation: client-initiated, server-rejected" \
-c "=> renegotiate" \
-S "=> renegotiate" \
-S "write hello request" \
-s "refusing renegotiation" \
-c "SSL - Unexpected message at ServerHello in renegotiation" \
-c "failed"
@ -5285,6 +5286,7 @@ run_test "Renegotiation: server-initiated, client-rejected, default" \
-C "=> renegotiate" \
-S "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-S "SSL - An unexpected message was received from our peer" \
-S "failed"
@ -5302,6 +5304,7 @@ run_test "Renegotiation: server-initiated, client-rejected, not enforced" \
-C "=> renegotiate" \
-S "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-S "SSL - An unexpected message was received from our peer" \
-S "failed"
@ -5320,6 +5323,7 @@ run_test "Renegotiation: server-initiated, client-rejected, delay 2" \
-C "=> renegotiate" \
-S "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-S "SSL - An unexpected message was received from our peer" \
-S "failed"
@ -5337,6 +5341,7 @@ run_test "Renegotiation: server-initiated, client-rejected, delay 0" \
-C "=> renegotiate" \
-S "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-s "SSL - An unexpected message was received from our peer"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
@ -5353,6 +5358,7 @@ run_test "Renegotiation: server-initiated, client-accepted, delay 0" \
-c "=> renegotiate" \
-s "=> renegotiate" \
-s "write hello request" \
-C "refusing renegotiation" \
-S "SSL - An unexpected message was received from our peer" \
-S "failed"
@ -11800,6 +11806,147 @@ run_test "DTLS proxy: inject invalid AD record, badmac_limit 2, exchanges 2"\
-s "too many records with bad MAC" \
-s "Verification of the message MAC failed"
# The next few tests exercise renegotiation in DTLS when `ssl->badmac_seen != 0`.
#
# This seems unrelated, but was the location of a bug in Mbed TLS 3.6.3 to
# 3.6.6 (CVE-2026-50713) due to `ssl->badmac_seen` being unified with
# `ssl->in_hsfraglen` (to preserve the ABI when adding support for handshake
# defragmentation in TLS in 3.6.3), with some mistakes in using the unified
# field that were fixed in 3.6.7.
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then reject renego" \
-p "$P_PXY bad_ad_srv_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "write hello request" \
-c "refusing renegotiation" \
-S "=> renegotiate" \
-C "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-c "discarding invalid record (mac)" \
-C "too many records with bad MAC" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then reject renego" \
-p "$P_PXY bad_ad_cli_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=0 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \
1 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
-S "=> renegotiate" \
-s "refusing renegotiation" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then accept renego" \
-p "$P_PXY bad_ad_srv_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "=> renegotiate" \
-c "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-c "discarding invalid record (mac)" \
-C "too many records with bad MAC" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then accept renego" \
-p "$P_PXY bad_ad_cli_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \
0 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
-s "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
# The next few tests have "early renego". A DTLS handshake message is delayed
# past another handshake message. From the perspective of the recipient,
# this means that a DTLS handshake arrives early (its epoch number is still
# in the future) and needs to be queued.
#
# In Mbed TLS 3.6.3 through 3.6.6, due to the fields `ssl->badmac_seen`
# and `ssl->in_hsfraglen` being unified, the early message was parsed
# incorrectly, leading to heap corruption.
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then reject early renego" \
-p "$P_PXY bad_ad_srv_once=1 delay_encrypted_hs_srv=3" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-S "=> renegotiate" \
-C "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-C "=> ssl_buffer_message" \
-C "initialize reassembly, total length = 0" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-c "discarding invalid record (mac)" \
-C "too many records with bad MAC" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
# Delay the third encrypted handshake message from the server:
# 1. Finished message of the initial handshake.
# 2. HelloRequest to request renegotiation.
# 3. ServerHello of renegotiation, delayed.
# 4. Subsequent handshake message, which the client receives and enqueues.
#
# In Mbed TLS 3.6.3 though 3.6.6, the processing of (4) caused heap corruption.
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then accept early renego" \
-p "$P_PXY bad_ad_srv_once=1 delay_encrypted_hs_srv=3" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "=> renegotiate" \
-c "=> renegotiate" \
-c "=> ssl_buffer_message" \
-C "initialize reassembly, total length = 0" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-c "discarding invalid record (mac)" \
-C "too many records with bad MAC" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS proxy: delay ChangeCipherSpec" \
-p "$P_PXY delay_ccs=1" \

20
tests/suites/test_suite_ssl.data
View File

@ -471,6 +471,14 @@ Handshake, select ECDHE-ECDSA-WITH-AES-256-CCM, opaque, bad usage
depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
handshake_ciphersuite_select:"TLS-ECDHE-ECDSA-WITH-AES-256-CCM":MBEDTLS_PK_ECDSA:"":PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_ALG_NONE:PSA_KEY_USAGE_DERIVE:MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:0
Handshake: DTLS 1.2, badmac_seen on client
depends_on:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_PROTO_TLS1_2
handshake_with_forced_context:1:MBEDTLS_SSL_VERSION_TLS1_2:PRE_HANDSHAKE_BADMAC_SEEN:0
Handshake: DTLS 1.2, badmac_seen on server
depends_on:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_PROTO_TLS1_2
handshake_with_forced_context:1:MBEDTLS_SSL_VERSION_TLS1_2:0:PRE_HANDSHAKE_BADMAC_SEEN
Sending app data via TLS, MFL=512 without fragmentation
depends_on:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
app_data_tls:MBEDTLS_SSL_MAX_FRAG_LEN_512:400:512:1:1
@ -548,13 +556,19 @@ Sending app data via DTLS, without MFL and with fragmentation
app_data_dtls:MBEDTLS_SSL_MAX_FRAG_LEN_NONE:16385:100000:0:0
DTLS renegotiation: no legacy renegotiation
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:-1
DTLS renegotiation: legacy renegotiation
renegotiation:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION
renegotiation:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION:-1
DTLS renegotiation: legacy break handshake
renegotiation:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE
renegotiation:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE:-1
DTLS renegotiation: after bad MAC on client
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:MBEDTLS_SSL_IS_CLIENT
DTLS renegotiation: after bad MAC on server
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:MBEDTLS_SSL_IS_SERVER
DTLS serialization with MFL=512
resize_buffers_serialize_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_512

103
tests/suites/test_suite_ssl.function
View File

@ -66,6 +66,39 @@ exit:
}
#endif
typedef enum {
PRE_HANDSHAKE_BADMAC_SEEN = 1u << 0,
} pre_handshake_tweaks_t;
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \
defined(PSA_HAVE_ALG_SOME_RSA_SIGN) && \
defined(PSA_WANT_ECC_SECP_R1_384) && \
defined(PSA_WANT_ALG_SHA_256) && \
defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \
defined(MBEDTLS_CAN_HANDLE_RSA_TEST_KEY)
typedef struct {
uint32_t client;
uint32_t server;
} pre_handshake_tweak_spec_t;
static void pre_handshake_tweak_context(mbedtls_ssl_context *ssl,
int tweaks)
{
if (tweaks & PRE_HANDSHAKE_BADMAC_SEEN) {
ssl->badmac_seen = 1;
}
}
static void pre_handshake_tweak_contexts(mbedtls_test_ssl_endpoint *client,
mbedtls_test_ssl_endpoint *server,
void *param)
{
const pre_handshake_tweak_spec_t *tweaks = param;
pre_handshake_tweak_context(&client->ssl, tweaks->client);
pre_handshake_tweak_context(&server->ssl, tweaks->server);
}
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \
defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) && \
defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
@ -109,6 +142,30 @@ static void resize_buffers(int mfl, int renegotiation, int legacy_renegotiation,
#define TEST_GCM_OR_CHACHAPOLY_ENABLED
#endif
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \
defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
defined(PSA_HAVE_ALG_SOME_RSA_SIGN) && \
defined(PSA_WANT_ECC_SECP_R1_384) && \
defined(MBEDTLS_SSL_PROTO_DTLS) && \
defined(MBEDTLS_SSL_RENEGOTIATION) && \
defined(PSA_WANT_ALG_SHA_256) && \
defined(MBEDTLS_CAN_HANDLE_RSA_TEST_KEY)
static void simulate_badmac_seen_on(mbedtls_test_ssl_endpoint *client,
mbedtls_test_ssl_endpoint *server,
void *param)
{
int on = *(int *) param;
switch (on) {
case MBEDTLS_SSL_IS_CLIENT:
client->ssl.badmac_seen = 1;
break;
case MBEDTLS_SSL_IS_SERVER:
server->ssl.badmac_seen = 1;
break;
}
}
#endif
typedef enum {
RECOMBINE_NOMINAL, /* param: ignored */
RECOMBINE_SPLIT_FIRST, /* param: offset of split (<=0 means from end) */
@ -2870,7 +2927,7 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:!MBEDTLS_SSL_PROTO_TLS1_3:PSA_WANT_ALG_SHA_256 */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */
void mbedtls_endpoint_sanity(int endpoint_type)
{
enum { BUFFSIZE = 1024 };
@ -3065,6 +3122,40 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
/* Test a handshake in forced conditions.
*
* This can be used for defense in depths for scenarios that we think
* can't happen, but might actually happen due to a bug, or due to
* a new feature that is insufficiently tested.
*
* This can also be a proxy for testing aspects of renegotiation or
* session resumption in circumstances that are hard to arrange.
*/
void handshake_with_forced_context(int dtls, int version,
int client_tweaks, int server_tweaks)
{
pre_handshake_tweak_spec_t tweaks = { client_tweaks, server_tweaks };
mbedtls_test_handshake_test_options options;
mbedtls_test_init_handshake_options(&options);
options.dtls = dtls;
options.client_min_version = version;
options.client_max_version = version;
options.expected_negotiated_version = version;
options.pre_handshake_fun = &pre_handshake_tweak_contexts;
options.pre_handshake_param = &tweaks;
mbedtls_test_ssl_perform_handshake(&options);
/* The goto below is used to avoid an "unused label" warning.*/
goto exit;
exit:
mbedtls_test_free_handshake_options(&options);
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */
void app_data(int mfl, int cli_msg_len, int srv_msg_len,
int expected_cli_fragments,
@ -3106,7 +3197,7 @@ void app_data_tls(int mfl, int cli_msg_len, int srv_msg_len,
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_PROTO_TLS1_2:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_PROTO_TLS1_2:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void app_data_dtls(int mfl, int cli_msg_len, int srv_msg_len,
int expected_cli_fragments,
int expected_srv_fragments)
@ -3135,7 +3226,7 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_SHA_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
void handshake_fragmentation(int mfl,
int expected_srv_hs_fragmentation,
int expected_cli_hs_fragmentation)
@ -3332,8 +3423,8 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_PROTO_TLS1_2:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void renegotiation(int legacy_renegotiation)
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_PROTO_TLS1_2:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void renegotiation(int legacy_renegotiation, int badmac_seen_on)
{
mbedtls_test_handshake_test_options options;
mbedtls_test_init_handshake_options(&options);
@ -3342,6 +3433,8 @@ void renegotiation(int legacy_renegotiation)
options.legacy_renegotiation = legacy_renegotiation;
options.dtls = 1;
options.expected_negotiated_version = MBEDTLS_SSL_VERSION_TLS1_2;
options.post_data_fun = &simulate_badmac_seen_on;
options.post_data_param = &badmac_seen_on;
mbedtls_test_ssl_perform_handshake(&options);