OpenVPN
test_tls_crypt.c File Reference
#include "syshead.h"
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <setjmp.h>
#include <cmocka.h>
#include "test_common.h"
#include "tls_crypt.c"
Include dependency graph for test_tls_crypt.c:

Go to the source code of this file.

Data Structures

struct  test_tls_crypt_context
struct  test_tls_crypt_v2_context

Macros

#define TESTBUF_SIZE   128
#define PATH1   "/s p a c e"
#define PATH2   "/foo bar/baz"
#define PARAM1   "param1"
#define PARAM2   "param two"

Functions

bool key_state_export_keying_material (struct tls_session *session, const char *label, size_t label_size, void *ekm, size_t ekm_size)
 Keying Material Exporters [RFC 5705] allows additional keying material to be derived from existing TLS channel.
int __wrap_parse_line (const char *line, char **p, const int n, const char *file, const int line_num, msglvl_t msglevel, struct gc_arena *gc)
bool __wrap_buffer_write_file (const char *filename, const struct buffer *buf)
struct buffer __wrap_buffer_read_from_file (const char *filename, struct gc_arena *gc)
int __wrap_rand_bytes (uint8_t *output, int len)
 Predictable random for tests.
static int test_tls_crypt_setup (void **state)
static int test_tls_crypt_teardown (void **state)
static void skip_if_tls_crypt_not_supported (struct test_tls_crypt_context *ctx)
static void tls_crypt_loopback (void **state)
 Check that short messages are successfully wrapped-and-unwrapped.
static void test_tls_crypt_secure_reneg_key (void **state)
 Test generating dynamic tls-crypt key.
static void tls_crypt_loopback_zero_len (void **state)
 Check that zero-byte messages are successfully wrapped-and-unwrapped.
static void tls_crypt_loopback_max_len (void **state)
 Check that max-length messages are successfully wrapped-and-unwrapped.
static void tls_crypt_fail_msg_too_long (void **state)
 Check that too-long messages are gracefully rejected.
static void tls_crypt_fail_invalid_key (void **state)
 Check that packets that were wrapped (or unwrapped) with a different key are not accepted.
static void tls_crypt_fail_replay (void **state)
 Check that replayed packets are not accepted.
static void tls_crypt_ignore_replay (void **state)
 Check that packet replays are accepted when CO_IGNORE_PACKET_ID is set.
static int test_tls_crypt_v2_setup (void **state)
static int test_tls_crypt_v2_teardown (void **state)
static void tls_crypt_v2_wrap_unwrap_no_metadata (void **state)
 Check wrapping and unwrapping a tls-crypt-v2 client key without metadata.
static void tls_crypt_v2_wrap_unwrap_max_metadata (void **state)
 Check wrapping and unwrapping a tls-crypt-v2 client key with maximum length metadata.
static void tls_crypt_v2_wrap_too_long_metadata (void **state)
 Check that wrapping a tls-crypt-v2 client key with too long metadata fails as expected.
static void tls_crypt_v2_wrap_unwrap_wrong_key (void **state)
 Check that unwrapping a tls-crypt-v2 client key with the wrong server key fails as expected.
static void tls_crypt_v2_wrap_unwrap_dst_too_small (void **state)
 Check that unwrapping a tls-crypt-v2 client key to a too small metadata buffer fails as expected.
static struct buffer create_metadata_days_ago (struct gc_arena *gc, int days_ago)
static struct buffer create_client_key_input (struct test_tls_crypt_v2_context *ctx, int days_ago)
 Creates a minimal buffer that allows tls_crypt_v2_extract_client_key to extract the client key.
static void tls_crypt_v2_wrap_unwrap_invalid (void **state)
 Check that unwrapping an invalid key fails as expected and does not leave extra memory around (via ASAN).
static void tls_crypt_v2_unwrap_checks (void **state)
static void test_tls_crypt_v2_write_server_key_file (void **state)
static void test_tls_crypt_v2_write_client_key_file (void **state)
static void test_tls_crypt_v2_write_client_key_file_metadata (void **state)
int main (void)

Variables

static const char * test_server_key
static const char * test_client_key
static const char * test_client_key_metadata

Macro Definition Documentation

◆ PARAM1

#define PARAM1   "param1"

Definition at line 55 of file test_tls_crypt.c.

◆ PARAM2

#define PARAM2   "param two"

Definition at line 56 of file test_tls_crypt.c.

◆ PATH1

#define PATH1   "/s p a c e"

Definition at line 53 of file test_tls_crypt.c.

◆ PATH2

#define PATH2   "/foo bar/baz"

Definition at line 54 of file test_tls_crypt.c.

◆ TESTBUF_SIZE

#define TESTBUF_SIZE   128

Function Documentation

◆ __wrap_buffer_read_from_file()

struct buffer __wrap_buffer_read_from_file ( const char * filename,
struct gc_arena * gc )

◆ __wrap_buffer_write_file()

bool __wrap_buffer_write_file ( const char * filename,
const struct buffer * buf )

◆ __wrap_parse_line()

int __wrap_parse_line ( const char * line,
char ** p,
const int n,
const char * file,
const int line_num,
msglvl_t msglevel,
struct gc_arena * gc )

Definition at line 100 of file test_tls_crypt.c.

References gc, PARAM1, PARAM2, PATH1, and PATH2.

◆ __wrap_rand_bytes()

int __wrap_rand_bytes ( uint8_t * output,
int len )

Predictable random for tests.

Definition at line 155 of file test_tls_crypt.c.

References buffer::len.

◆ create_client_key_input()

struct buffer create_client_key_input ( struct test_tls_crypt_v2_context * ctx,
int days_ago )
static

Creates a minimal buffer that allows tls_crypt_v2_extract_client_key to extract the client key.

This will add metadata with a tls-crypt key created with the given days_ago.

Definition at line 649 of file test_tls_crypt.c.

References alloc_buf_gc(), buf_copy(), buf_len(), buf_reset_len(), buf_write_u8(), create_client_key_input(), create_metadata_days_ago(), and tls_crypt_v2_wrap_client_key().

Referenced by create_client_key_input(), tls_crypt_v2_unwrap_checks(), and tls_crypt_v2_wrap_unwrap_invalid().

◆ create_metadata_days_ago()

struct buffer create_metadata_days_ago ( struct gc_arena * gc,
int days_ago )
static

◆ key_state_export_keying_material()

bool key_state_export_keying_material ( struct tls_session * session,
const char * label,
size_t label_size,
void * ekm,
size_t ekm_size )

Keying Material Exporters [RFC 5705] allows additional keying material to be derived from existing TLS channel.

This exported keying material can then be used for a variety of purposes.

Parameters
sessionThe session associated with the given key_state
labelThe label to use when exporting the key
label_sizeThe size of the label to use when exporting the key
ekmBuffer to return the exported key material in
ekm_sizeThe size of ekm, in bytes
Returns
true if exporting succeeded, false otherwise

Definition at line 42 of file test_tls_crypt.c.

References session::key, KS_PRIMARY, and secure_memzero().

Referenced by export_user_keying_material(), generate_key_expansion_tls_export(), p2p_ncp_set_options(), and tls_session_generate_dynamic_tls_crypt_key().

◆ main()

◆ skip_if_tls_crypt_not_supported()

◆ test_tls_crypt_secure_reneg_key()

◆ test_tls_crypt_setup()

◆ test_tls_crypt_teardown()

◆ test_tls_crypt_v2_setup()

◆ test_tls_crypt_v2_teardown()

int test_tls_crypt_v2_teardown ( void ** state)
static

◆ test_tls_crypt_v2_write_client_key_file()

void test_tls_crypt_v2_write_client_key_file ( void ** state)
static

◆ test_tls_crypt_v2_write_client_key_file_metadata()

void test_tls_crypt_v2_write_client_key_file_metadata ( void ** state)
static

◆ test_tls_crypt_v2_write_server_key_file()

void test_tls_crypt_v2_write_server_key_file ( void ** state)
static

Definition at line 777 of file test_tls_crypt.c.

References __wrap_buffer_write_file(), test_server_key, and tls_crypt_v2_write_server_key_file().

Referenced by main().

◆ tls_crypt_fail_invalid_key()

void tls_crypt_fail_invalid_key ( void ** state)
static

◆ tls_crypt_fail_msg_too_long()

void tls_crypt_fail_msg_too_long ( void ** state)
static

◆ tls_crypt_fail_replay()

void tls_crypt_fail_replay ( void ** state)
static

◆ tls_crypt_ignore_replay()

void tls_crypt_ignore_replay ( void ** state)
static

Check that packet replays are accepted when CO_IGNORE_PACKET_ID is set.

This is used for the first control channel packet that arrives, because we don't know the packet ID yet.

Definition at line 424 of file test_tls_crypt.c.

References BLEN, buf_clear(), test_tls_crypt_context::ciphertext, test_tls_crypt_context::co, CO_IGNORE_PACKET_ID, crypto_options::flags, skip_if_tls_crypt_not_supported(), test_tls_crypt_context::source, tls_crypt_unwrap(), tls_crypt_wrap(), and test_tls_crypt_context::unwrapped.

Referenced by main().

◆ tls_crypt_loopback()

void tls_crypt_loopback ( void ** state)
static

◆ tls_crypt_loopback_max_len()

void tls_crypt_loopback_max_len ( void ** state)
static

◆ tls_crypt_loopback_zero_len()

void tls_crypt_loopback_zero_len ( void ** state)
static

◆ tls_crypt_v2_unwrap_checks()

◆ tls_crypt_v2_wrap_too_long_metadata()

void tls_crypt_v2_wrap_too_long_metadata ( void ** state)
static

◆ tls_crypt_v2_wrap_unwrap_dst_too_small()

◆ tls_crypt_v2_wrap_unwrap_invalid()

void tls_crypt_v2_wrap_unwrap_invalid ( void ** state)
static

Check that unwrapping an invalid key fails as expected and does not leave extra memory around (via ASAN).

Definition at line 671 of file test_tls_crypt.c.

References buf_bptr(), buf_len(), create_client_key_input(), key_ctx_bi::encrypt, test_tls_crypt_v2_context::server_keys, tls_crypt_v2_extract_client_key(), tls_wrap_ctx::TLS_WRAP_CRYPT, tls_wrap_free(), and update_time().

Referenced by main().

◆ tls_crypt_v2_wrap_unwrap_max_metadata()

◆ tls_crypt_v2_wrap_unwrap_no_metadata()

◆ tls_crypt_v2_wrap_unwrap_wrong_key()

Variable Documentation

◆ test_client_key

const char* test_client_key
static
Initial value:
=
"-----BEGIN OpenVPN tls-crypt-v2 client key-----\n"
"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4v\n"
"MDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5f\n"
"YGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6P\n"
"kJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/\n"
"wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v\n"
"8PHy8/T19vf4+fr7/P3+/xd9pcB0qUYZsWvkrLcfGmzPJPM8a7r0mEWdXwbDadSV\n"
"LHg5bv2TwlmPR3HgaMr8o9LTh9hxUTkrH3S0PfKRNwcso86ua/dBFTyXsM9tg4aw\n"
"3dS6ogH9AkaT+kRRDgNcKWkQCbwmJK2JlfkXHBwbAtmn78AkNuho6QCFqCdqGab3\n"
"zh2vheFqGMPdGpukbFrT3rcO3VLxUeG+RdzXiMTCpJSovFBP1lDkYwYJPnz6daEh\n"
"j0TzJ3BVru9W3CpotdNt7u09knxAfpCxjtrP3semsDew/gTBtcfQ/OoTFyFHnN5k\n"
"RZ+q17SC4nba3Pp8/Fs0+hSbv2tJozoD8SElFq7SIWJsciTYh8q8f5yQxjdt4Wxu\n"
"/Z5wtPCAZ0tOzj4ItTI77fBOYRTfEayzHgEr\n"
"-----END OpenVPN tls-crypt-v2 client key-----\n"

Definition at line 65 of file test_tls_crypt.c.

Referenced by test_tls_crypt_v2_write_client_key_file().

◆ test_client_key_metadata

const char* test_client_key_metadata
static
Initial value:
=
"-----BEGIN OpenVPN tls-crypt-v2 client key-----\n"
"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4v\n"
"MDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5f\n"
"YGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6P\n"
"kJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/\n"
"wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v\n"
"8PHy8/T19vf4+fr7/P3+/2ntp1WCqhcLjJQY/igkjNt3Yb6i0neqFkfrOp2UCDcz\n"
"6RSJtPLZbvOOKUHk2qwxPYUsFCnz/IWV6/ZiLRrabzUpS8oSN1HS6P7qqAdrHKgf\n"
"hVTHasdSf2UdMTPC7HBgnP9Ll0FhKN0h7vSzbbt7QM7wH9mr1ecc/Mt0SYW2lpwA\n"
"aJObYGTyk6hTgWm0g/MLrworLrezTqUHBZzVsu+LDyqLWK1lzJNd66MuNOsGA4YF\n"
"fbCsDh8n3H+Cw1k5YNBZDYYJOtVUgBWXheO6vgoOmqDdI0dAQ3hVo9DE+SkCFjgf\n"
"l4FY2yLEh9ZVZZrl1eD1Owh/X178CkHrBJYl9LNQSyQEKlDGWwBLQ/pY3qtjctr3\n"
"pV62MPQdBo+1lcsjDCJVQA6XUyltas4BKQ==\n"
"-----END OpenVPN tls-crypt-v2 client key-----\n"

Definition at line 83 of file test_tls_crypt.c.

Referenced by test_tls_crypt_v2_write_client_key_file_metadata().

◆ test_server_key

const char* test_server_key
static
Initial value:
=
"-----BEGIN OpenVPN tls-crypt-v2 server key-----\n"
"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4v\n"
"MDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5f\n"
"YGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn8=\n"
"-----END OpenVPN tls-crypt-v2 server key-----\n"

Definition at line 58 of file test_tls_crypt.c.

Referenced by test_tls_crypt_v2_write_client_key_file(), test_tls_crypt_v2_write_client_key_file_metadata(), and test_tls_crypt_v2_write_server_key_file().