Merge branch 'maint-0.4.8'
[tor.git] / src / test / test_tortls.c
blob99c759e27606d1d217ed2cbfb07be20d831b8ab9
1 /* Copyright (c) 2010-2021, The Tor Project, Inc. */
2 /* See LICENSE for licensing information */
4 #define TORTLS_PRIVATE
5 #define TOR_X509_PRIVATE
6 #define LOG_PRIVATE
7 #include "orconfig.h"
9 #ifdef _WIN32
10 #include <winsock2.h>
11 #endif
12 #include <math.h>
13 #include <stddef.h>
15 #include "lib/cc/compat_compiler.h"
17 #include "core/or/or.h"
18 #include "lib/log/log.h"
19 #include "app/config/config.h"
20 #include "lib/crypt_ops/compat_openssl.h"
21 #include "lib/tls/x509.h"
22 #include "lib/tls/x509_internal.h"
23 #include "lib/tls/tortls.h"
24 #include "lib/tls/tortls_st.h"
25 #include "lib/tls/tortls_internal.h"
26 #include "lib/encoding/pem.h"
27 #include "app/config/or_state_st.h"
29 #include "test/test.h"
30 #include "test/log_test_helpers.h"
31 #include "test/test_tortls.h"
33 #include "tinytest.h"
35 const char* notCompletelyValidCertString =
36 "-----BEGIN CERTIFICATE-----\n"
37 "MIICVjCCAb8CAg37MA0GCSqGSIb3DQEBBQUAMIGbMQswCQYDVQQGEwJKUDEOMAwG\n"
38 "A1UECBMFVG9reW8xEDAOBgNVBAcTB0NodW8ta3UxETAPBgNVBAoTCEZyYW5rNERE\n"
39 "MRgwFgYDVQQLEw9XZWJDZXJ0IFN1cHBvcnQxGDAWBgNVBAMTD0ZyYW5rNEREIFdl\n"
40 "YiBDQTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBmcmFuazRkZC5jb20wHhcNMTIw\n"
41 "ODIyMDUyNzIzWhcNMTcwODIxMDUyNzIzWjBKMQswCQYDVQQGEwJKUDEOMAwGA1UE\n"
42 "CAwFVG9reW8xETAPBgNVBAoMCEZyYW5rNEREMRgwFgYDVQQDDA93d3cuZXhhbXBs\n"
43 "ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMYBBrx5PlP0WNI/ZdzD\n"
44 "+6Pktmurn+F2kQYbtc7XQh8/LTBvCo+P6iZoLEmUA9e7EXLRxgU1CVqeAi7QcAn9\n"
45 "MwBlc8ksFJHB0rtf9pmf8Oza9E0Bynlq/4/Kb1x+d+AyhL7oK9tQwB24uHOueHi1\n"
46 "C/iVv8CSWKiYe6hzN1txYe8rAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAASPdjigJ\n"
47 "kXCqKWpnZ/Oc75EUcMi6HztaW8abUMlYXPIgkV2F7YanHOB7K4f7OOLjiz8DTPFf\n"
48 "jC9UeuErhaA/zzWi8ewMTFZW/WshOrm3fNvcMrMLKtH534JKvcdMg6qIdjTFINIr\n"
49 "evnAhf0cwULaebn+lMs8Pdl7y37+sfluVok=\n"
50 "-----END CERTIFICATE-----\n";
52 const char* validCertString = "-----BEGIN CERTIFICATE-----\n"
53 "MIIDpTCCAY0CAg3+MA0GCSqGSIb3DQEBBQUAMF4xCzAJBgNVBAYTAlVTMREwDwYD\n"
54 "VQQIDAhJbGxpbm9pczEQMA4GA1UEBwwHQ2hpY2FnbzEUMBIGA1UECgwLVG9yIFRl\n"
55 "c3RpbmcxFDASBgNVBAMMC1RvciBUZXN0aW5nMB4XDTE1MDkwNjEzMzk1OVoXDTQz\n"
56 "MDEyMjEzMzk1OVowVjELMAkGA1UEBhMCVVMxEDAOBgNVBAcMB0NoaWNhZ28xFDAS\n"
57 "BgNVBAoMC1RvciBUZXN0aW5nMR8wHQYDVQQDDBZ0ZXN0aW5nLnRvcnByb2plY3Qu\n"
58 "b3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoT6uyVVhWyOF3wkHjjYbd\n"
59 "nKaykyRv4JVtKQdZ4OpEErmX1zw4MmyzpQNV6iR4bQnWiyLfzyVJMZDIC/WILBfX\n"
60 "w2Pza/yuLgUvDc3twMuhOACzOQVO8PrEF/aVv2+hbCCy2udXvKhnYn+CCXl3ozc8\n"
61 "XcKYvujTXDyvGWY3xwAjlQIDAQABMA0GCSqGSIb3DQEBBQUAA4ICAQCUvnhzQWuQ\n"
62 "MrN+pERkE+zcTI/9dGS90rUMMLgu8VDNqTa0TUQh8uO0EQ6uDvI8Js6e8tgwS0BR\n"
63 "UBahqb7ZHv+rejGCBr5OudqD+x4STiiuPNJVs86JTLN8SpM9CHjIBH5WCCN2KOy3\n"
64 "mevNoRcRRyYJzSFULCunIK6FGulszigMYGscrO4oiTkZiHPh9KvWT40IMiHfL+Lw\n"
65 "EtEWiLex6064LcA2YQ1AMuSZyCexks63lcfaFmQbkYOKqXa1oLkIRuDsOaSVjTfe\n"
66 "vec+X6jvf12cFTKS5WIeqkKF2Irt+dJoiHEGTe5RscUMN/f+gqHPzfFz5dR23sxo\n"
67 "g+HC6MZHlFkLAOx3wW6epPS8A/m1mw3zMPoTnb2U2YYt8T0dJMMlUn/7Y1sEAa+a\n"
68 "dSTMaeUf6VnJ//11m454EZl1to9Z7oJOgqmFffSrdD4BGIWe8f7hhW6L1Enmqe/J\n"
69 "BKL3wbzZh80O1W0bndAwhnEEhlzneFY84cbBo9pmVxpODHkUcStpr5Z7pBDrcL21\n"
70 "Ss/aB/1YrsVXhdvJdOGxl3Mnl9dUY57CympLGlT8f0pPS6GAKOelECOhFMHmJd8L\n"
71 "dj3XQSmKtYHevZ6IvuMXSlB/fJvSjSlkCuLo5+kJoaqPuRu+i/S1qxeRy3CBwmnE\n"
72 "LdSNdcX4N79GQJ996PA8+mUCQG7YRtK+WA==\n"
73 "-----END CERTIFICATE-----\n";
75 const char* caCertString = "-----BEGIN CERTIFICATE-----\n"
76 "MIIFjzCCA3egAwIBAgIJAKd5WgyfPMYRMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV\n"
77 "BAYTAlVTMREwDwYDVQQIDAhJbGxpbm9pczEQMA4GA1UEBwwHQ2hpY2FnbzEUMBIG\n"
78 "A1UECgwLVG9yIFRlc3RpbmcxFDASBgNVBAMMC1RvciBUZXN0aW5nMB4XDTE1MDkw\n"
79 "NjEzMzc0MVoXDTQzMDEyMjEzMzc0MVowXjELMAkGA1UEBhMCVVMxETAPBgNVBAgM\n"
80 "CElsbGlub2lzMRAwDgYDVQQHDAdDaGljYWdvMRQwEgYDVQQKDAtUb3IgVGVzdGlu\n"
81 "ZzEUMBIGA1UEAwwLVG9yIFRlc3RpbmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw\n"
82 "ggIKAoICAQCpLMUEiLW5leUgBZoEJms2V7lZRhIAjnJBhVMHD0e3UubNknmaQoxf\n"
83 "ARz3rvqOaRd0JlV+qM9qE0DjiYcCVP1cAfqAo9d83uS1vwY3YMVJzADlaIiHfyVW\n"
84 "uEgBy0vvkeUBqaua24dYlcwsemOiXYLu41yM1wkcGHW1AhBNHppY6cznb8TyLgNM\n"
85 "2x3SGUdzc5XMyAFx51faKGBA3wjs+Hg1PLY7d30nmCgEOBavpm5I1disM/0k+Mcy\n"
86 "YmAKEo/iHJX/rQzO4b9znP69juLlR8PDBUJEVIG/CYb6+uw8MjjUyiWXYoqfVmN2\n"
87 "hm/lH8b6rXw1a2Aa3VTeD0DxaWeacMYHY/i01fd5n7hCoDTRNdSw5KJ0L3Z0SKTu\n"
88 "0lzffKzDaIfyZGlpW5qdouACkWYzsaitQOePVE01PIdO30vUfzNTFDfy42ccx3Di\n"
89 "59UCu+IXB+eMtrBfsok0Qc63vtF1linJgjHW1z/8ujk8F7/qkOfODhk4l7wngc2A\n"
90 "EmwWFIFoGaiTEZHB9qteXr4unbXZ0AHpM02uGGwZEGohjFyebEb73M+J57WKKAFb\n"
91 "PqbLcGUksL1SHNBNAJcVLttX55sO4nbidOS/kA3m+F1R04MBTyQF9qA6YDDHqdI3\n"
92 "h/3pw0Z4fxVouTYT4/NfRnX4JTP4u+7Mpcoof28VME0qWqD1LnRhFQIDAQABo1Aw\n"
93 "TjAdBgNVHQ4EFgQUMoAgIXH7pZ3QMRwTjT+DM9Yo/v0wHwYDVR0jBBgwFoAUMoAg\n"
94 "IXH7pZ3QMRwTjT+DM9Yo/v0wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n"
95 "AgEAUJxacjXR9sT+Xs6ISFiUsyd0T6WVKMnV46xrYJHirGfx+krWHrjxMY+ZtxYD\n"
96 "DBDGlo11Qc4v6QrclNf5QUBfIiGQsP9Cm6hHcQ+Tpg9HHCgSqG1YNPwCPReCR4br\n"
97 "BLvLfrfkcBL2IWM0PdQdCze+59DBfipsULD2mEn9fjYRXQEwb2QWtQ9qRc20Yb/x\n"
98 "Q4b/+CvUodLkaq7B8MHz0BV8HHcBoph6DYaRmO/N+hPauIuSp6XyaGYcEefGKVKj\n"
99 "G2+fcsdyXsoijNdL8vNKwm4j2gVwCBnw16J00yfFoV46YcbfqEdJB2je0XSvwXqt\n"
100 "14AOTngxso2h9k9HLtrfpO1ZG/B5AcCMs1lzbZ2fp5DPHtjvvmvA2RJqgo3yjw4W\n"
101 "4DHAuTglYFlC3mDHNfNtcGP20JvepcQNzNP2UzwcpOc94hfKikOFw+gf9Vf1qd0y\n"
102 "h/Sk6OZHn2+JVUPiWHIQV98Vtoh4RmUZDJD+b55ia3fQGTGzt4z1XFzQYSva5sfs\n"
103 "wocS/papthqWldQU7x+3wofNd5CNU1x6WKXG/yw30IT/4F8ADJD6GeygNT8QJYvt\n"
104 "u/8lAkbOy6B9xGmSvr0Kk1oq9P2NshA6kalxp1Oz/DTNDdL4AeBXV3JmM6WWCjGn\n"
105 "Yy1RT69d0rwYc5u/vnqODz1IjvT90smsrkBumGt791FAFeg=\n"
106 "-----END CERTIFICATE-----\n";
108 static tor_x509_cert_t *fixed_x509_cert = NULL;
109 static tor_x509_cert_t *
110 get_peer_cert_mock_return_fixed(tor_tls_t *tls)
112 (void)tls;
113 if (fixed_x509_cert)
114 return tor_x509_cert_dup(fixed_x509_cert);
115 else
116 return NULL;
119 tor_x509_cert_impl_t *
120 read_cert_from(const char *str)
122 size_t len = strlen(str);
123 uint8_t *raw_cert = tor_malloc(len);
124 ssize_t true_len = pem_decode(raw_cert, len, str, len, "CERTIFICATE");
125 if (true_len < 0) {
126 tor_free(raw_cert);
127 return NULL;
129 tor_x509_cert_t *cert = tor_x509_cert_decode(raw_cert, true_len);
130 tor_free(raw_cert);
131 if (! cert) {
132 return NULL;
134 tor_x509_cert_impl_t *res = tor_x509_cert_impl_dup_(cert->cert);
135 tor_x509_cert_free(cert);
136 return res;
139 static tor_x509_cert_impl_t *
140 fixed_try_to_extract_certs_from_tls_cert_out_result = NULL;
141 static tor_x509_cert_impl_t *
142 fixed_try_to_extract_certs_from_tls_id_cert_out_result = NULL;
144 static void
145 fixed_try_to_extract_certs_from_tls(int severity, tor_tls_t *tls,
146 tor_x509_cert_impl_t **cert_out,
147 tor_x509_cert_impl_t **id_cert_out)
149 (void) severity;
150 (void) tls;
151 *cert_out = tor_x509_cert_impl_dup_(
152 fixed_try_to_extract_certs_from_tls_cert_out_result);
153 *id_cert_out = tor_x509_cert_impl_dup_(
154 fixed_try_to_extract_certs_from_tls_id_cert_out_result);
157 static void
158 test_tortls_errno_to_tls_error(void *data)
160 (void) data;
161 tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ECONNRESET)),OP_EQ,
162 TOR_TLS_ERROR_CONNRESET);
163 tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ETIMEDOUT)),OP_EQ,
164 TOR_TLS_ERROR_TIMEOUT);
165 tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(EHOSTUNREACH)),OP_EQ,
166 TOR_TLS_ERROR_NO_ROUTE);
167 tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ENETUNREACH)),OP_EQ,
168 TOR_TLS_ERROR_NO_ROUTE);
169 tt_int_op(tor_errno_to_tls_error(SOCK_ERRNO(ECONNREFUSED)),OP_EQ,
170 TOR_TLS_ERROR_CONNREFUSED);
171 tt_int_op(tor_errno_to_tls_error(0),OP_EQ,TOR_TLS_ERROR_MISC);
172 done:
173 (void)1;
176 static void
177 test_tortls_err_to_string(void *data)
179 (void) data;
180 tt_str_op(tor_tls_err_to_string(1),OP_EQ,"[Not an error.]");
181 tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_MISC),OP_EQ,"misc error");
182 tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_IO),OP_EQ,"unexpected close");
183 tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_CONNREFUSED),OP_EQ,
184 "connection refused");
185 tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_CONNRESET),OP_EQ,
186 "connection reset");
187 tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_NO_ROUTE),OP_EQ,
188 "host unreachable");
189 tt_str_op(tor_tls_err_to_string(TOR_TLS_ERROR_TIMEOUT),OP_EQ,
190 "connection timed out");
191 tt_str_op(tor_tls_err_to_string(TOR_TLS_CLOSE),OP_EQ,"closed");
192 tt_str_op(tor_tls_err_to_string(TOR_TLS_WANTREAD),OP_EQ,"want to read");
193 tt_str_op(tor_tls_err_to_string(TOR_TLS_WANTWRITE),OP_EQ,"want to write");
194 tt_str_op(tor_tls_err_to_string(-100),OP_EQ,"(unknown error code)");
195 done:
196 (void)1;
199 #ifdef ENABLE_OPENSSL
200 static int
201 mock_tls_cert_matches_key(const tor_tls_t *tls, const tor_x509_cert_t *cert)
203 (void) tls;
204 (void) cert; // XXXX look at this.
205 return 1;
208 static void
209 test_tortls_tor_tls_get_error(void *data)
211 (void) data;
212 MOCK(tor_tls_cert_matches_key, mock_tls_cert_matches_key);
213 crypto_pk_t *key1 = NULL, *key2 = NULL;
214 key1 = pk_generate(2);
215 key2 = pk_generate(3);
217 tor_tls_t *tls = NULL;
218 tt_int_op(tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
219 key1, key2, 86400), OP_EQ, 0);
220 tls = tor_tls_new(-1, 0);
221 setup_capture_of_logs(LOG_WARN);
222 tor_tls_get_error(tls, 0, 0,
223 (const char *)"in unit test", LOG_WARN, LD_GENERAL);
224 expect_single_log_msg_containing("unexpected close while in unit test");
226 done:
227 UNMOCK(tor_tls_cert_matches_key);
228 UNMOCK(logv);
229 crypto_pk_free(key1);
230 crypto_pk_free(key2);
231 tor_tls_free(tls);
233 #endif /* defined(ENABLE_OPENSSL) */
235 static void
236 test_tortls_x509_cert_get_id_digests(void *ignored)
238 (void)ignored;
239 tor_x509_cert_t *cert;
240 common_digests_t *d;
241 const common_digests_t *res;
242 cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
243 d = tor_malloc_zero(sizeof(common_digests_t));
244 d->d[0][0] = 42;
246 res = tor_x509_cert_get_id_digests(cert);
247 tt_assert(!res);
249 cert->pkey_digests_set = 1;
250 cert->pkey_digests = *d;
251 res = tor_x509_cert_get_id_digests(cert);
252 tt_assert(res);
253 tt_int_op(res->d[0][0], OP_EQ, 42);
255 done:
256 tor_free(cert);
257 tor_free(d);
260 static void
261 test_tortls_get_my_certs(void *ignored)
263 (void)ignored;
264 int ret;
265 tor_tls_context_t *ctx;
266 const tor_x509_cert_t *link_cert_out = NULL;
267 const tor_x509_cert_t *id_cert_out = NULL;
269 ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
271 client_tls_context = NULL;
272 ret = tor_tls_get_my_certs(0, NULL, NULL);
273 tt_int_op(ret, OP_EQ, -1);
275 server_tls_context = NULL;
276 ret = tor_tls_get_my_certs(1, NULL, NULL);
277 tt_int_op(ret, OP_EQ, -1);
279 client_tls_context = ctx;
280 ret = tor_tls_get_my_certs(0, NULL, NULL);
281 tt_int_op(ret, OP_EQ, 0);
283 client_tls_context = ctx;
284 ret = tor_tls_get_my_certs(0, &link_cert_out, &id_cert_out);
285 tt_int_op(ret, OP_EQ, 0);
287 server_tls_context = ctx;
288 ret = tor_tls_get_my_certs(1, &link_cert_out, &id_cert_out);
289 tt_int_op(ret, OP_EQ, 0);
291 done:
292 (void)1;
295 #ifdef ENABLE_OPENSSL
296 static void
297 test_tortls_get_forced_write_size(void *ignored)
299 (void)ignored;
300 long ret;
301 tor_tls_t *tls;
303 tls = tor_malloc_zero(sizeof(tor_tls_t));
305 tls->wantwrite_n = 43;
306 ret = tor_tls_get_forced_write_size(tls);
307 tt_int_op(ret, OP_EQ, 43);
309 done:
310 tor_free(tls);
313 static void
314 test_tortls_used_v1_handshake(void *ignored)
316 (void)ignored;
317 int ret;
318 tor_tls_t *tls;
319 tls = tor_malloc_zero(sizeof(tor_tls_t));
321 // These tests assume both V2 handshake server and client are enabled
322 tls->wasV2Handshake = 0;
323 ret = tor_tls_used_v1_handshake(tls);
324 tt_int_op(ret, OP_EQ, 1);
326 tls->wasV2Handshake = 1;
327 ret = tor_tls_used_v1_handshake(tls);
328 tt_int_op(ret, OP_EQ, 0);
330 done:
331 tor_free(tls);
334 static void
335 test_tortls_server_got_renegotiate(void *ignored)
337 (void)ignored;
338 int ret;
339 tor_tls_t *tls;
341 tls = tor_malloc_zero(sizeof(tor_tls_t));
343 tls->got_renegotiate = 1;
344 ret = tor_tls_server_got_renegotiate(tls);
345 tt_int_op(ret, OP_EQ, 1);
347 done:
348 tor_free(tls);
350 #endif /* defined(ENABLE_OPENSSL) */
352 static void
353 test_tortls_evaluate_ecgroup_for_tls(void *ignored)
355 (void)ignored;
356 int ret;
358 ret = evaluate_ecgroup_for_tls(NULL);
359 tt_int_op(ret, OP_EQ, 1);
361 ret = evaluate_ecgroup_for_tls("foobar");
362 tt_int_op(ret, OP_EQ, 0);
364 ret = evaluate_ecgroup_for_tls("P256");
365 tt_int_op(ret, OP_EQ, 1);
367 ret = evaluate_ecgroup_for_tls("P224");
368 // tt_int_op(ret, OP_EQ, 1); This varies between machines
369 tt_assert(ret == 0 || ret == 1);
371 done:
372 (void)0;
375 static void
376 test_tortls_double_init(void *arg)
378 (void) arg;
379 /* If we call tor_tls_context_init() a second time, nothing should go
380 * wrong.
382 crypto_pk_t *pk1 = NULL, *pk2 = NULL;
383 pk1 = pk_generate(2);
384 pk2 = pk_generate(0);
386 int r = tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
387 pk1, pk2, 86400);
388 tt_int_op(r, OP_EQ, 0);
390 r = tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
391 pk2, pk1, 86400);
392 tt_int_op(r, OP_EQ, 0);
393 /* For a public server context, these are the same */
394 tt_ptr_op(tor_tls_context_get(0), OP_EQ, tor_tls_context_get(1));
396 done:
397 crypto_pk_free(pk1);
398 crypto_pk_free(pk2);
401 static void
402 test_tortls_bridge_init(void *arg)
404 (void)arg;
405 crypto_pk_t *pk1 = NULL, *pk2 = NULL;
406 pk1 = pk_generate(2);
407 pk2 = pk_generate(0);
409 /* If we pass in a server identity key but not the
410 TOR_TLS_CTX_IS_PUBLIC_SERVER flag, we should get a bridge-style
411 configuration, with two distinct contexts. */
412 int r = tor_tls_context_init(0 /* flags */, pk1, pk2, 86400);
414 tt_int_op(r, OP_EQ, 0);
415 tt_ptr_op(tor_tls_context_get(0), OP_NE, tor_tls_context_get(1));
416 done:
417 crypto_pk_free(pk1);
418 crypto_pk_free(pk2);
421 static void
422 test_tortls_address(void *arg)
424 (void)arg;
425 tor_tls_t *tls = NULL;
426 crypto_pk_t *pk1=NULL, *pk2=NULL;
427 pk1 = pk_generate(2);
428 pk2 = pk_generate(0);
430 int r = tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
431 pk1, pk2, 86400);
432 tt_int_op(r, OP_EQ, 0);
434 tls = tor_tls_new(-1, 0);
435 tls->state = TOR_TLS_ST_OPEN;
436 tor_tls_set_logged_address(tls, "zombo.com");
438 /* This write should fail, since the fd is -1. */
439 setup_capture_of_logs(LOG_INFO);
440 int n = tor_tls_write(tls, "welcome", 7);
441 tt_int_op(n, OP_LT, 0);
442 expect_log_msg_containing("with zombo.com");
444 done:
445 teardown_capture_of_logs();
446 tor_tls_free(tls);
447 crypto_pk_free(pk1);
448 crypto_pk_free(pk2);
451 static void
452 test_tortls_is_server(void *arg)
454 (void)arg;
455 crypto_pk_t *pk1=NULL, *pk2=NULL;
456 tor_tls_t *tls1=NULL, *tls2=NULL;
457 pk1 = pk_generate(2);
458 pk2 = pk_generate(0);
460 int r = tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER,
461 pk1, pk2, 86400);
462 tt_int_op(r, OP_EQ, 0);
463 tls1 = tor_tls_new(-1, 0);
464 tls2 = tor_tls_new(-1, 1);
466 tt_assert(! tor_tls_is_server(tls1));
467 tt_assert(tor_tls_is_server(tls2));
469 done:
470 tor_tls_free(tls1);
471 tor_tls_free(tls2);
472 crypto_pk_free(pk1);
473 crypto_pk_free(pk2);
476 static void
477 test_tortls_verify(void *ignored)
479 (void)ignored;
480 int ret;
481 tor_tls_t *tls;
482 crypto_pk_t *k = NULL;
483 tor_x509_cert_impl_t *cert1 = NULL, *cert2 = NULL, *invalidCert = NULL,
484 *validCert = NULL, *caCert = NULL;
486 validCert = read_cert_from(validCertString);
487 caCert = read_cert_from(caCertString);
488 invalidCert = read_cert_from(notCompletelyValidCertString);
490 tls = tor_malloc_zero(sizeof(tor_tls_t));
492 MOCK(try_to_extract_certs_from_tls, fixed_try_to_extract_certs_from_tls);
494 fixed_try_to_extract_certs_from_tls_cert_out_result = cert1;
495 ret = tor_tls_verify(LOG_WARN, tls, &k);
496 tt_int_op(ret, OP_EQ, -1);
498 fixed_try_to_extract_certs_from_tls_id_cert_out_result = cert2;
499 ret = tor_tls_verify(LOG_WARN, tls, &k);
500 tt_int_op(ret, OP_EQ, -1);
502 fixed_try_to_extract_certs_from_tls_cert_out_result = invalidCert;
503 fixed_try_to_extract_certs_from_tls_id_cert_out_result = invalidCert;
505 ret = tor_tls_verify(LOG_WARN, tls, &k);
506 tt_int_op(ret, OP_EQ, -1);
508 fixed_try_to_extract_certs_from_tls_cert_out_result = validCert;
509 fixed_try_to_extract_certs_from_tls_id_cert_out_result = caCert;
511 ret = tor_tls_verify(LOG_WARN, tls, &k);
512 tt_int_op(ret, OP_EQ, 0);
513 tt_assert(k);
515 done:
516 UNMOCK(try_to_extract_certs_from_tls);
517 tor_x509_cert_impl_free(cert1);
518 tor_x509_cert_impl_free(cert2);
519 tor_x509_cert_impl_free(validCert);
520 tor_x509_cert_impl_free(invalidCert);
521 tor_x509_cert_impl_free(caCert);
523 tor_free(tls);
524 crypto_pk_free(k);
527 static void
528 test_tortls_cert_matches_key(void *ignored)
530 (void)ignored;
532 tor_x509_cert_impl_t *cert1 = NULL,
533 *cert2 = NULL,
534 *cert3 = NULL,
535 *cert4 = NULL;
536 tor_x509_cert_t *c1 = NULL, *c2 = NULL, *c3 = NULL, *c4 = NULL;
537 crypto_pk_t *k1 = NULL, *k2 = NULL, *k3 = NULL;
539 k1 = pk_generate(1);
540 k2 = pk_generate(2);
541 k3 = pk_generate(3);
543 cert1 = tor_tls_create_certificate(k1, k2, "A", "B", 1000);
544 cert2 = tor_tls_create_certificate(k1, k3, "C", "D", 1000);
545 cert3 = tor_tls_create_certificate(k2, k3, "C", "D", 1000);
546 cert4 = tor_tls_create_certificate(k3, k2, "E", "F", 1000);
548 tt_assert(cert1 && cert2 && cert3 && cert4);
550 c1 = tor_x509_cert_new(cert1); cert1 = NULL;
551 c2 = tor_x509_cert_new(cert2); cert2 = NULL;
552 c3 = tor_x509_cert_new(cert3); cert3 = NULL;
553 c4 = tor_x509_cert_new(cert4); cert4 = NULL;
555 tt_assert(c1 && c2 && c3 && c4);
557 MOCK(tor_tls_get_peer_cert, get_peer_cert_mock_return_fixed);
559 fixed_x509_cert = NULL;
560 /* If the peer has no certificate, it shouldn't match anything. */
561 tt_assert(! tor_tls_cert_matches_key(NULL, c1));
562 tt_assert(! tor_tls_cert_matches_key(NULL, c2));
563 tt_assert(! tor_tls_cert_matches_key(NULL, c3));
564 tt_assert(! tor_tls_cert_matches_key(NULL, c4));
565 fixed_x509_cert = c1;
566 /* If the peer has a certificate, it should match every cert with the same
567 * subject key. */
568 tt_assert(tor_tls_cert_matches_key(NULL, c1));
569 tt_assert(tor_tls_cert_matches_key(NULL, c2));
570 tt_assert(! tor_tls_cert_matches_key(NULL, c3));
571 tt_assert(! tor_tls_cert_matches_key(NULL, c4));
573 done:
574 tor_x509_cert_free(c1);
575 tor_x509_cert_free(c2);
576 tor_x509_cert_free(c3);
577 tor_x509_cert_free(c4);
578 if (cert1) tor_x509_cert_impl_free(cert1);
579 if (cert2) tor_x509_cert_impl_free(cert2);
580 if (cert3) tor_x509_cert_impl_free(cert3);
581 if (cert4) tor_x509_cert_impl_free(cert4);
582 crypto_pk_free(k1);
583 crypto_pk_free(k2);
584 crypto_pk_free(k3);
585 UNMOCK(tor_tls_get_peer_cert);
588 #define LOCAL_TEST_CASE(name, flags) \
589 { #name, test_tortls_##name, (flags|TT_FORK), NULL, NULL }
591 struct testcase_t tortls_tests[] = {
592 LOCAL_TEST_CASE(errno_to_tls_error, 0),
593 LOCAL_TEST_CASE(err_to_string, 0),
594 LOCAL_TEST_CASE(x509_cert_get_id_digests, 0),
595 LOCAL_TEST_CASE(get_my_certs, TT_FORK),
596 #ifdef ENABLE_OPENSSL
597 LOCAL_TEST_CASE(tor_tls_get_error, 0),
598 LOCAL_TEST_CASE(get_forced_write_size, 0),
599 LOCAL_TEST_CASE(used_v1_handshake, TT_FORK),
600 LOCAL_TEST_CASE(server_got_renegotiate, 0),
601 #endif /* defined(ENABLE_OPENSSL) */
602 LOCAL_TEST_CASE(evaluate_ecgroup_for_tls, 0),
603 LOCAL_TEST_CASE(double_init, TT_FORK),
604 LOCAL_TEST_CASE(address, TT_FORK),
605 LOCAL_TEST_CASE(is_server, 0),
606 LOCAL_TEST_CASE(bridge_init, TT_FORK),
607 LOCAL_TEST_CASE(verify, TT_FORK),
608 LOCAL_TEST_CASE(cert_matches_key, 0),
609 END_OF_TESTCASES