mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-02-17 14:32:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Allow an empty NPN/ALPN protocol list in the tests

Browse Source 
Allow ourselves to configure an empty NPN/ALPN protocol list and test what
happens if we do.

Follow on from CVE-2024-5535

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24716)
This commit is contained in:
Matt Caswell 2024-06-04 15:47:32 +01:00
parent 0d883f6309
commit 9925c97a8e
5 changed files with 552 additions and 347 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
test/helpers/handshake.c
View File

@ -348,6 +348,12 @@ static int parse_protos(const char *protos, unsigned char **out, size_t *outlen)
len = strlen(protos);
if (len == 0) {
*out = NULL;
*outlen = 0;
return 1;
}
/* Should never have reuse. */
if (!TEST_ptr_null(*out)
/* Test values are small, so we omit length limit checks. */

759
test/ssl-tests/08-npn.cnf
View File

File diff suppressed because it is too large Load Diff

35
test/ssl-tests/08-npn.cnf.in
View File

@ -110,6 +110,41 @@ our @tests = (
"ExpectedNPNProtocol" => undef,
},
},
{
name => "npn-empty-client-list",
server => {
extra => {
"NPNProtocols" => "foo",
},
},
client => {
extra => {
"NPNProtocols" => "",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedResult" => "ClientFail",
"ExpectedClientAlert" => "HandshakeFailure"
},
},
{
name => "npn-empty-server-list",
server => {
extra => {
"NPNProtocols" => "",
},
},
client => {
extra => {
"NPNProtocols" => "foo",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedNPNProtocol" => "foo"
},
},
{
name => "npn-with-sni-no-context-switch",
server => {

66
test/ssl-tests/09-alpn.cnf
View File

@ -1,6 +1,6 @@
# Generated with generate_ssl_tests.pl
num_tests = 16
num_tests = 18
test-0 = 0-alpn-simple
test-1 = 1-alpn-server-finds-match
@ -18,6 +18,8 @@ test-12 = 12-alpn-client-switch-resumption
test-13 = 13-alpn-alert-on-mismatch-resumption
test-14 = 14-alpn-no-server-support-resumption
test-15 = 15-alpn-no-client-support-resumption
test-16 = 16-alpn-empty-client-list
test-17 = 17-alpn-empty-server-list
# ===========================================================
[0-alpn-simple]
@ -617,3 +619,65 @@ ALPNProtocols = foo
ALPNProtocols = foo
# ===========================================================
[16-alpn-empty-client-list]
ssl_conf = 16-alpn-empty-client-list-ssl
[16-alpn-empty-client-list-ssl]
server = 16-alpn-empty-client-list-server
client = 16-alpn-empty-client-list-client
[16-alpn-empty-client-list-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-alpn-empty-client-list-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
server = 16-alpn-empty-client-list-server-extra
client = 16-alpn-empty-client-list-client-extra
[16-alpn-empty-client-list-server-extra]
ALPNProtocols = foo
[16-alpn-empty-client-list-client-extra]
ALPNProtocols =
# ===========================================================
[17-alpn-empty-server-list]
ssl_conf = 17-alpn-empty-server-list-ssl
[17-alpn-empty-server-list-ssl]
server = 17-alpn-empty-server-list-server
client = 17-alpn-empty-server-list-client
[17-alpn-empty-server-list-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-alpn-empty-server-list-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-17]
ExpectedResult = ServerFail
ExpectedServerAlert = NoApplicationProtocol
server = 17-alpn-empty-server-list-server-extra
client = 17-alpn-empty-server-list-client-extra
[17-alpn-empty-server-list-server-extra]
ALPNProtocols =
[17-alpn-empty-server-list-client-extra]
ALPNProtocols = foo

33
test/ssl-tests/09-alpn.cnf.in
View File

@ -322,4 +322,37 @@ our @tests = (
"ExpectedALPNProtocol" => undef,
},
},
{
name => "alpn-empty-client-list",
server => {
extra => {
"ALPNProtocols" => "foo",
},
},
client => {
extra => {
"ALPNProtocols" => "",
},
},
test => {
"ExpectedALPNProtocol" => undef,
},
},
{
name => "alpn-empty-server-list",
server => {
extra => {
"ALPNProtocols" => "",
},
},
client => {
extra => {
"ALPNProtocols" => "foo",
},
},
test => {
"ExpectedResult" => "ServerFail",
"ExpectedServerAlert" => "NoApplicationProtocol",
},
},
);