Skip to content

Commit 23d3848

Browse files
julek-wolfssljulek-wolfssl
committed
Add message order sanity checks
Reorganize test_dtls tests to use TEST_DECL_GROUP
1 parent ea4554c commit 23d3848

4 files changed

Lines changed: 278 additions & 30 deletions

File tree

‎src/internal.c‎

Lines changed: 68 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17470,6 +17470,15 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1747017470
WOLFSSL_ERROR_VERBOSE(DUPLICATE_MSG_E);
1747117471
return DUPLICATE_MSG_E;
1747217472
}
17473+
if (!ssl->msgsReceived.got_server_hello ||
17474+
ssl->msgsReceived.got_change_cipher ||
17475+
ssl->msgsReceived.got_finished ||
17476+
(!ssl->options.resuming &&
17477+
!ssl->msgsReceived.got_server_hello_done)) {
17478+
WOLFSSL_MSG("session_ticket received in wrong order");
17479+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17480+
return OUT_OF_ORDER_E;
17481+
}
1747317482
ssl->msgsReceived.got_session_ticket = 1;
1747417483

1747517484
break;
@@ -17485,20 +17494,36 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1748517494

1748617495
#ifndef NO_WOLFSSL_CLIENT
1748717496
if (ssl->options.side == WOLFSSL_CLIENT_END) {
17488-
if ( ssl->msgsReceived.got_server_hello == 0) {
17497+
if (!ssl->msgsReceived.got_server_hello) {
1748917498
WOLFSSL_MSG("No ServerHello before Cert");
1749017499
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
1749117500
return OUT_OF_ORDER_E;
1749217501
}
17502+
if (ssl->msgsReceived.got_certificate_status ||
17503+
ssl->msgsReceived.got_server_key_exchange ||
17504+
ssl->msgsReceived.got_certificate_request ||
17505+
ssl->msgsReceived.got_server_hello_done) {
17506+
WOLFSSL_MSG("Cert received in wrong order");
17507+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17508+
return OUT_OF_ORDER_E;
17509+
}
1749317510
}
1749417511
#endif
1749517512
#ifndef NO_WOLFSSL_SERVER
1749617513
if (ssl->options.side == WOLFSSL_SERVER_END) {
17497-
if ( ssl->msgsReceived.got_client_hello == 0) {
17514+
if (!ssl->msgsReceived.got_client_hello) {
1749817515
WOLFSSL_MSG("No ClientHello before Cert");
1749917516
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
1750017517
return OUT_OF_ORDER_E;
1750117518
}
17519+
if (ssl->msgsReceived.got_client_key_exchange ||
17520+
ssl->msgsReceived.got_certificate_verify ||
17521+
ssl->msgsReceived.got_change_cipher ||
17522+
ssl->msgsReceived.got_finished) {
17523+
WOLFSSL_MSG("Cert received in wrong order");
17524+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17525+
return OUT_OF_ORDER_E;
17526+
}
1750217527
}
1750317528
#endif
1750417529
break;
@@ -17517,7 +17542,6 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1751717542
WOLFSSL_ERROR_VERBOSE(DUPLICATE_MSG_E);
1751817543
return DUPLICATE_MSG_E;
1751917544
}
17520-
ssl->msgsReceived.got_certificate_status = 1;
1752117545

1752217546
if (ssl->msgsReceived.got_certificate == 0) {
1752317547
WOLFSSL_MSG("No Certificate before CertificateStatus");
@@ -17529,7 +17553,15 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1752917553
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
1753017554
return OUT_OF_ORDER_E;
1753117555
}
17556+
if (ssl->msgsReceived.got_server_key_exchange ||
17557+
ssl->msgsReceived.got_certificate_request ||
17558+
ssl->msgsReceived.got_server_hello_done) {
17559+
WOLFSSL_MSG("CertificateStatus received in wrong order");
17560+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17561+
return OUT_OF_ORDER_E;
17562+
}
1753217563

17564+
ssl->msgsReceived.got_certificate_status = 1;
1753317565
break;
1753417566
#endif
1753517567

@@ -17547,14 +17579,19 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1754717579
WOLFSSL_ERROR_VERBOSE(DUPLICATE_MSG_E);
1754817580
return DUPLICATE_MSG_E;
1754917581
}
17550-
ssl->msgsReceived.got_server_key_exchange = 1;
17551-
1755217582
if (ssl->msgsReceived.got_server_hello == 0) {
1755317583
WOLFSSL_MSG("No ServerHello before ServerKeyExchange");
1755417584
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
1755517585
return OUT_OF_ORDER_E;
1755617586
}
17587+
if (ssl->msgsReceived.got_certificate_request ||
17588+
ssl->msgsReceived.got_server_hello_done) {
17589+
WOLFSSL_MSG("ServerKeyExchange received in wrong order");
17590+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17591+
return OUT_OF_ORDER_E;
17592+
}
1755717593

17594+
ssl->msgsReceived.got_server_key_exchange = 1;
1755817595
break;
1755917596
#endif
1756017597

@@ -17572,6 +17609,16 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1757217609
WOLFSSL_ERROR_VERBOSE(DUPLICATE_MSG_E);
1757317610
return DUPLICATE_MSG_E;
1757417611
}
17612+
if (ssl->msgsReceived.got_server_hello == 0) {
17613+
WOLFSSL_MSG("No ServerHello before CertificateRequest");
17614+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17615+
return OUT_OF_ORDER_E;
17616+
}
17617+
if (ssl->msgsReceived.got_server_hello_done) {
17618+
WOLFSSL_MSG("CertificateRequest received in wrong order");
17619+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17620+
return OUT_OF_ORDER_E;
17621+
}
1757517622
ssl->msgsReceived.got_certificate_request = 1;
1757617623

1757717624
break;
@@ -17691,13 +17738,18 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1769117738
WOLFSSL_ERROR_VERBOSE(DUPLICATE_MSG_E);
1769217739
return DUPLICATE_MSG_E;
1769317740
}
17694-
ssl->msgsReceived.got_certificate_verify = 1;
17695-
1769617741
if ( ssl->msgsReceived.got_certificate == 0) {
1769717742
WOLFSSL_MSG("No Cert before CertVerify");
1769817743
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
1769917744
return OUT_OF_ORDER_E;
1770017745
}
17746+
if (ssl->msgsReceived.got_change_cipher ||
17747+
ssl->msgsReceived.got_finished) {
17748+
WOLFSSL_MSG("CertVerify received in wrong order");
17749+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17750+
return OUT_OF_ORDER_E;
17751+
}
17752+
ssl->msgsReceived.got_certificate_verify = 1;
1770117753
break;
1770217754
#endif
1770317755

@@ -17715,13 +17767,19 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1771517767
WOLFSSL_ERROR_VERBOSE(DUPLICATE_MSG_E);
1771617768
return DUPLICATE_MSG_E;
1771717769
}
17718-
ssl->msgsReceived.got_client_key_exchange = 1;
17719-
1772017770
if (ssl->msgsReceived.got_client_hello == 0) {
1772117771
WOLFSSL_MSG("No ClientHello before ClientKeyExchange");
1772217772
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
1772317773
return OUT_OF_ORDER_E;
1772417774
}
17775+
if (ssl->msgsReceived.got_certificate_verify||
17776+
ssl->msgsReceived.got_change_cipher ||
17777+
ssl->msgsReceived.got_finished) {
17778+
WOLFSSL_MSG("ClientKeyExchange received in wrong order");
17779+
WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E);
17780+
return OUT_OF_ORDER_E;
17781+
}
17782+
ssl->msgsReceived.got_client_key_exchange = 1;
1772517783
break;
1772617784
#endif
1772717785

@@ -17740,13 +17798,12 @@ static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
1774017798
}
1774117799
}
1774217800
#endif
17743-
ssl->msgsReceived.got_finished = 1;
17744-
1774517801
if (ssl->msgsReceived.got_change_cipher == 0) {
1774617802
WOLFSSL_MSG("Finished received before ChangeCipher");
1774717803
WOLFSSL_ERROR_VERBOSE(NO_CHANGE_CIPHER_E);
1774817804
return NO_CHANGE_CIPHER_E;
1774917805
}
17806+
ssl->msgsReceived.got_finished = 1;
1775017807
break;
1775117808

1775217809
case change_cipher_hs:

‎tests/api.c‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -51323,13 +51323,6 @@ TEST_DECL(test_wc_RsaPSS_DigitalSignVerify),
5132351323
/* Can't memory test as client/server hangs. */
5132451324
TEST_DECL(test_dtls_msg_from_other_peer),
5132551325
TEST_DECL(test_dtls_ipv6_check),
51326-
TEST_DECL(test_dtls_short_ciphertext),
51327-
TEST_DECL(test_dtls12_record_length_mismatch),
51328-
TEST_DECL(test_dtls12_short_read),
51329-
TEST_DECL(test_dtls13_longer_length),
51330-
TEST_DECL(test_dtls13_short_read),
51331-
TEST_DECL(test_records_span_network_boundaries),
51332-
TEST_DECL(test_dtls_record_cross_boundaries),
5133351326
TEST_DECL(test_wolfSSL_SCR_after_resumption),
5133451327
TEST_DECL(test_dtls_no_extensions),
5133551328
TEST_DECL(test_tls_alert_no_server_hello),
@@ -51349,12 +51342,10 @@ TEST_DECL(test_wc_RsaPSS_DigitalSignVerify),
5134951342
TEST_DECL(test_dtls13_frag_ch_pq),
5135051343
TEST_DECL(test_dtls_empty_keyshare_with_cookie),
5135151344
TEST_DECL(test_dtls_old_seq_number),
51352-
TEST_DECL(test_dtls12_basic_connection_id),
51353-
TEST_DECL(test_dtls13_basic_connection_id),
5135451345
TEST_DECL(test_dtls12_missing_finished),
5135551346
TEST_DECL(test_dtls13_missing_finished_client),
5135651347
TEST_DECL(test_dtls13_missing_finished_server),
51357-
TEST_DECL(test_wolfSSL_dtls_set_pending_peer),
51348+
TEST_DTLS_DECLS,
5135851349
TEST_DECL(test_tls_multi_handshakes_one_record),
5135951350
TEST_DECL(test_write_dup),
5136051351
TEST_DECL(test_read_write_hs),
@@ -51365,15 +51356,6 @@ TEST_DECL(test_wc_RsaPSS_DigitalSignVerify),
5136551356
TEST_DECL(test_wolfSSL_SendUserCanceled),
5136651357
TEST_DECL(test_wolfSSL_SSLDisableRead),
5136751358
TEST_DECL(test_wolfSSL_inject),
51368-
TEST_DECL(test_wolfSSL_dtls_cid_parse),
51369-
TEST_DECL(test_dtls13_epochs),
51370-
TEST_DECL(test_dtls_rtx_across_epoch_change),
51371-
TEST_DECL(test_dtls_drop_client_ack),
51372-
TEST_DECL(test_dtls_bogus_finished_epoch_zero),
51373-
TEST_DECL(test_dtls_replay),
51374-
TEST_DECL(test_dtls_srtp),
51375-
TEST_DECL(test_dtls13_ack_order),
51376-
TEST_DECL(test_dtls_version_checking),
5137751359
TEST_DECL(test_ocsp_status_callback),
5137851360
TEST_DECL(test_ocsp_basic_verify),
5137951361
TEST_DECL(test_ocsp_response_parsing),

0 commit comments

Comments
 (0)