From 60f34b21bc181edb6c523a8b1fd49b3bfcb7c8ae Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 9 Feb 2026 11:17:28 +0000 Subject: [PATCH] test_suite_ssl: Extended tests for extention duplication Adds tls13_client/server_rejects_extension_duplicate() tests. Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.data | 6 ++ tests/suites/test_suite_ssl.function | 128 +++++++++++++++++++++++++++ 2 files changed, 134 insertions(+) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index c27c6fc622..f76a61bfe8 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3377,6 +3377,12 @@ cookie_parsing:"16fefd0000000000000000002F010000de000000000000011efefd7b72727272 TLS 1.3: duplicate extension rejected tls13_check_received_extension_duplicate +TLS 1.3 srv Certificate msg - duplicate extension rejected from client +tls13_client_rejects_extension_duplicate + +TLS 1.3 srv Certificate msg - duplicate extension rejected from server +tls13_server_rejects_extension_duplicate + TLS 1.3 srv Certificate msg - wrong vector lengths tls13_server_certificate_msg_invalid_vector_len diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 2d3ee94151..5a61ab684b 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4317,6 +4317,134 @@ exit: } /* END_CASE */ + +/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3:!MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:PSA_WANT_ECC_SECP_R1_384 */ +void tls13_client_rejects_extension_duplicate() +{ + int ret = -1; + mbedtls_test_ssl_endpoint client_ep, server_ep; + memset(&client_ep, 0, sizeof(client_ep)); + memset(&server_ep, 0, sizeof(server_ep)); + unsigned char *buf; + size_t buf_len; + int step = 0; + mbedtls_test_handshake_test_options client_options; + mbedtls_test_handshake_test_options server_options; + + /* + * Test set-up + */ + + mbedtls_test_init_handshake_options(&client_options); + MD_OR_USE_PSA_INIT(); + + client_options.pk_alg = MBEDTLS_PK_ECDSA; + ret = mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, + &client_options); + TEST_EQUAL(ret, 0); + + mbedtls_test_init_handshake_options(&server_options); + server_options.pk_alg = MBEDTLS_PK_ECDSA; + ret = mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, + &server_options); + TEST_EQUAL(ret, 0); + + ret = mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 1024); + TEST_EQUAL(ret, 0); + + while (1) { + mbedtls_test_set_step(++step); + + ret = mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + MBEDTLS_SSL_ENCRYPTED_EXTENSIONS); + TEST_EQUAL(ret, 0); + + ret = mbedtls_ssl_flush_output(&(server_ep.ssl)); + TEST_EQUAL(ret, 0); + + ret = mbedtls_ssl_tls13_fetch_handshake_msg(&(client_ep.ssl), + MBEDTLS_SSL_HS_SERVER_HELLO, + &buf, &buf_len); + TEST_EQUAL(ret, 0); + client_ep.ssl.keep_current_message = 1; + } + +exit: + mbedtls_ssl_reset_chk_buf_ptr_fail_args(); + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_free_handshake_options(&client_options); + mbedtls_test_free_handshake_options(&server_options); + MD_OR_USE_PSA_DONE(); +} +/* END_CASE */ + +/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3:!MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:PSA_WANT_ECC_SECP_R1_384 */ +void tls13_server_rejects_extension_duplicate() +{ + int ret = -1; + mbedtls_test_ssl_endpoint client_ep, server_ep; + memset(&client_ep, 0, sizeof(client_ep)); + memset(&server_ep, 0, sizeof(server_ep)); + unsigned char *buf; + size_t buf_len; + int step = 0; + mbedtls_test_handshake_test_options client_options; + mbedtls_test_handshake_test_options server_options; + + /* + * Test set-up + */ + + mbedtls_test_init_handshake_options(&client_options); + MD_OR_USE_PSA_INIT(); + + client_options.pk_alg = MBEDTLS_PK_ECDSA; + ret = mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, + &client_options); + TEST_EQUAL(ret, 0); + + mbedtls_test_init_handshake_options(&server_options); + server_options.pk_alg = MBEDTLS_PK_ECDSA; + ret = mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, + &server_options); + TEST_EQUAL(ret, 0); + + ret = mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 1024); + TEST_EQUAL(ret, 0); + + while (1) { + mbedtls_test_set_step(++step); + + ret = mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + MBEDTLS_SSL_CLIENT_HELLO); + TEST_EQUAL(ret, 0); + + ret = mbedtls_ssl_flush_output(&(server_ep.ssl)); + TEST_EQUAL(ret, 0); + + ret = mbedtls_ssl_tls13_fetch_handshake_msg(&(server_ep.ssl), + MBEDTLS_SSL_HS_CLIENT_HELLO, + &buf, &buf_len); + TEST_EQUAL(ret, 0); + server_ep.ssl.keep_current_message = 1; + } + +exit: + mbedtls_ssl_reset_chk_buf_ptr_fail_args(); + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_free_handshake_options(&client_options); + mbedtls_test_free_handshake_options(&server_options); + MD_OR_USE_PSA_DONE(); + +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_SSL_PROTO_TLS1_3:!MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384 */ void tls13_server_certificate_msg_invalid_vector_len() {