1 // Copyright 2021 The Pigweed Authors
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License"); you may not
4 // use this file except in compliance with the License. You may obtain a copy of
5 // the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
11 // WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
12 // License for the specific language governing permissions and limitations under
13 // the License.
14
15 #include "pw_tls_client/test/test_server.h"
16
17 #include <string>
18
19 #include "pw_span/span.h"
20 #include "pw_unit_test/framework.h"
21
22 // The following header contains a set of test certificates and keys.
23 // It is generated by
24 // third_party/boringssl/py/boringssl/generate_test_data.py.
25 #include "test_certs_and_keys.h"
26
27 #define ASSERT_OK(expr) ASSERT_EQ(pw::OkStatus(), expr)
28
29 namespace pw::tls_client::test {
30 namespace {
31
TestClientBioRead(BIO * bio,char * out,int outl)32 int TestClientBioRead(BIO* bio, char* out, int outl) {
33 auto read_writer = static_cast<stream::ReaderWriter*>(bio->ptr);
34 auto res = read_writer->Read(out, outl);
35 if (!res.ok()) {
36 return -1;
37 }
38 if (res.value().empty()) {
39 BIO_set_retry_read(bio);
40 return -1;
41 }
42 return res.value().size();
43 }
44
TestClientBioWrite(BIO * bio,const char * in,int inl)45 int TestClientBioWrite(BIO* bio, const char* in, int inl) {
46 auto read_writer = static_cast<stream::ReaderWriter*>(bio->ptr);
47 auto res = read_writer->Write(in, inl);
48 if (!res.ok()) {
49 return -1;
50 }
51 return inl;
52 }
53
TestClientBioNew(BIO * bio)54 int TestClientBioNew(BIO* bio) {
55 bio->init = 1;
56 return 1;
57 }
58
TestClientBioCtrl(BIO *,int,long,void *)59 long TestClientBioCtrl(BIO*, int, long, void*) { return 1; }
60
TestClientBioFree(BIO *)61 int TestClientBioFree(BIO*) { return 1; }
62
63 const BIO_METHOD bio_method = {
64 BIO_TYPE_MEM,
65 "bio test server test",
66 TestClientBioWrite,
67 TestClientBioRead,
68 nullptr,
69 nullptr,
70 TestClientBioCtrl,
71 TestClientBioNew,
72 TestClientBioFree,
73 nullptr,
74 };
75
76 // Server needs to send certificate. Thus the send buffer needs to be bigger.
77 std::array<std::byte, 4096> server_send_buffer;
78 std::array<std::byte, 512> server_receive_buffer;
79
80 // Create a raw BoringSSL client and load test trust anchors.
CreateSSLClient(bssl::UniquePtr<SSL_CTX> * ctx,bssl::UniquePtr<SSL> * client,stream::ReaderWriter * read_writer)81 void CreateSSLClient(bssl::UniquePtr<SSL_CTX>* ctx,
82 bssl::UniquePtr<SSL>* client,
83 stream::ReaderWriter* read_writer) {
84 *ctx = bssl::UniquePtr<SSL_CTX>(SSL_CTX_new(TLS_method()));
85 ASSERT_NE(*ctx, nullptr);
86 *client = bssl::UniquePtr<SSL>(SSL_new(ctx->get()));
87 ASSERT_NE(*client, nullptr);
88 BIO* bio = BIO_new(&bio_method);
89 ASSERT_NE(bio, nullptr);
90
91 // Load trust anchors to client
92 auto store = SSL_CTX_get_cert_store(ctx->get());
93 X509_VERIFY_PARAM_clear_flags(X509_STORE_get0_param(store),
94 X509_V_FLAG_USE_CHECK_TIME);
95 const pw::ConstByteSpan kTrustAnchors[] = {kRootACert, kRootBCert};
96 for (auto cert : kTrustAnchors) {
97 auto res = ParseDerCertificate(cert);
98 ASSERT_OK(res.status());
99 ASSERT_EQ(X509_STORE_add_cert(store, res.value()), 1);
100 X509_free(res.value());
101 }
102 bio->ptr = read_writer;
103 SSL_set_bio(client->get(), bio, bio);
104 }
105
106 } // namespace
107
TEST(InMemoryTestServer,NormalConnectionSucceed)108 TEST(InMemoryTestServer, NormalConnectionSucceed) {
109 InMemoryTestServer server(server_receive_buffer, server_send_buffer);
110 const ConstByteSpan kIntermediates[] = {kSubCACert};
111 ASSERT_OK(server.Initialize(kServerKey, kServerCert, kIntermediates));
112
113 // Create a raw BoringSSL client
114 bssl::UniquePtr<SSL_CTX> client_ctx;
115 bssl::UniquePtr<SSL> ssl_client;
116 CreateSSLClient(&client_ctx, &ssl_client, &server);
117
118 // Handshake should be OK
119 ASSERT_EQ(SSL_connect(ssl_client.get()), 1);
120 ASSERT_TRUE(server.SessionEstablished());
121
122 // Client should pass certificate verification.
123 ASSERT_EQ(SSL_get_verify_result(ssl_client.get()), 0);
124
125 // Send some data to server
126 const char send_expected[] = "hello";
127 int send_len =
128 SSL_write(ssl_client.get(), send_expected, sizeof(send_expected));
129 ASSERT_EQ(static_cast<size_t>(send_len), sizeof(send_expected));
130
131 char receive_actual[sizeof(send_expected) + 1] = {0};
132 int read_ret =
133 SSL_read(ssl_client.get(), receive_actual, sizeof(receive_actual));
134 ASSERT_EQ(static_cast<size_t>(read_ret), sizeof(send_expected));
135 ASSERT_STREQ(send_expected, receive_actual);
136
137 // Shutdown
138 EXPECT_FALSE(server.ClientShutdownReceived());
139 ASSERT_NE(SSL_shutdown(ssl_client.get()), -1);
140 ASSERT_TRUE(server.ClientShutdownReceived());
141 }
142
TEST(InMemoryTestServer,BufferTooSmallErrorsOut)143 TEST(InMemoryTestServer, BufferTooSmallErrorsOut) {
144 std::array<std::byte, 1> insufficient_buffer;
145 InMemoryTestServer server(server_receive_buffer, insufficient_buffer);
146 const ConstByteSpan kIntermediates[] = {kSubCACert};
147 ASSERT_OK(server.Initialize(kServerKey, kServerCert, kIntermediates));
148
149 // Create a raw BoringSSL client
150 bssl::UniquePtr<SSL_CTX> client_ctx;
151 bssl::UniquePtr<SSL> ssl_client;
152 CreateSSLClient(&client_ctx, &ssl_client, &server);
153
154 // Handshake should fail as server shouldn't have enough buffer
155 ASSERT_NE(SSL_connect(ssl_client.get()), 1);
156 ASSERT_EQ(server.GetLastBioStatus(), Status::ResourceExhausted());
157 }
158
159 } // namespace pw::tls_client::test
160