Add a test to verify that an SSL inherits the hostflags from the SSL_CTX

This is currently an expected failure that will be fixed shortly.
author: tb <> 2023-05-24 08:54:59 +0000
committer: tb <> 2023-05-24 08:54:59 +0000
commit: 61c81a83de1329c6eec47a61f17e68b7c5a335f9 (patch)
tree: 4af95fd970f26f3389693ed73c570d428a1f9675 /src/regress/lib/libssl
parent: 6ba3c246f09904342136fa7405a22d78b3db14ae (diff)
download: openbsd-61c81a83de1329c6eec47a61f17e68b7c5a335f9.tar.gz
openbsd-61c81a83de1329c6eec47a61f17e68b7c5a335f9.tar.bz2
openbsd-61c81a83de1329c6eec47a61f17e68b7c5a335f9.zip
2 files changed, 105 insertions, 1 deletions
diff --git a/src/regress/lib/libssl/unit/Makefile b/src/regress/lib/libssl/unit/Makefile
index 191aadf2bb..413307b7a0 100644
--- a/src/regress/lib/libssl/unit/Makefile
+++ b/src/regress/lib/libssl/unit/Makefile
@@ -1,9 +1,10 @@
-#       $OpenBSD: Makefile,v 1.14 2022/12/02 01:15:11 tb Exp $
+#       $OpenBSD: Makefile,v 1.15 2023/05/24 08:54:59 tb Exp $
 PROGS += cipher_list
 PROGS += ssl_get_shared_ciphers
 PROGS += ssl_methods
 PROGS += ssl_set_alpn_protos
+PROGS += ssl_verify_param
 PROGS += ssl_versions
 PROGS += tls_ext_alpn
 PROGS += tls_prf
@@ -15,4 +16,8 @@ CFLAGS+=	-DLIBRESSL_INTERNAL -Wall -Wundef -Werror
 CFLAGS+=        -DCERTSDIR=\"${.CURDIR}/../certs\"
 CFLAGS+=        -I${.CURDIR}/../../../../lib/libssl
+LDADD_ssl_verify_param = ${LIBSSL} ${CRYPTO_INT}
+REGRESS_EXPECTED_FAILURES+=     run-regress-ssl_verify_param
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/unit/ssl_verify_param.c b/src/regress/lib/libssl/unit/ssl_verify_param.c
new file mode 100644
index 0000000000..cdb52c56a8
--- /dev/null
+++ b/src/regress/lib/libssl/unit/ssl_verify_param.c
@@ -0,0 +1,99 @@
+/*      $OpenBSD: ssl_verify_param.c,v 1.1 2023/05/24 08:54:59 tb Exp $ */
+/*
+ * Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <err.h>
+#include <stdio.h>
+#include <openssl/ssl.h>
+#include <openssl/x509v3.h>
+unsigned int X509_VERIFY_PARAM_get_hostflags(X509_VERIFY_PARAM *param);
+static int
+ssl_verify_param_flags_inherited(void)
+{
+        SSL_CTX *ssl_ctx = NULL;
+        SSL *ssl = NULL;
+        X509_VERIFY_PARAM *param;
+        unsigned int defaultflags = 0;
+        unsigned int newflags = X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
+        unsigned int flags;
+        int failed = 1;
+        if ((ssl_ctx = SSL_CTX_new(TLS_method())) == NULL)
+                errx(1, "SSL_CTX_new");
+        if ((param = SSL_CTX_get0_param(ssl_ctx)) == NULL) {
+                fprintf(stderr, "FAIL: no verify param on ssl_ctx\n");
+                goto failure;
+        }
+        if ((flags = X509_VERIFY_PARAM_get_hostflags(param)) != defaultflags) {
+                fprintf(stderr, "FAIL: SSL_CTX default hostflags, "
+                    "want: %x, got: %x\n", defaultflags, flags);
+                goto failure;
+        }
+        X509_VERIFY_PARAM_set_hostflags(param, newflags);
+        if ((flags = X509_VERIFY_PARAM_get_hostflags(param)) != newflags) {
+                fprintf(stderr, "FAIL: SSL_CTX new hostflags, "
+                    "want: %x, got: %x\n", newflags, flags);
+                goto failure;
+        }
+        if ((ssl = SSL_new(ssl_ctx)) == NULL)
+                errx(1, "SSL_new");
+        if ((param = SSL_get0_param(ssl)) == NULL) {
+                fprintf(stderr, "FAIL: no verify param on ssl\n");
+                goto failure;
+        }
+        if ((flags = X509_VERIFY_PARAM_get_hostflags(param)) != newflags) {
+                fprintf(stderr, "FAIL: SSL inherited hostflags, "
+                    "want: %x, got: %x\n", newflags, flags);
+                goto failure;
+        }
+        SSL_set_hostflags(ssl, defaultflags);
+        if ((flags = X509_VERIFY_PARAM_get_hostflags(param)) != defaultflags) {
+                fprintf(stderr, "FAIL: SSL set hostflags, "
+                    "want: %x, got: %x\n", defaultflags, flags);
+                goto failure;
+        }
+        failed = 0;
+ failure:
+        SSL_CTX_free(ssl_ctx);
+        SSL_free(ssl);
+        return failed;
+}
+int
+main(void)
+{
+        int failed = 0;
+        failed |= ssl_verify_param_flags_inherited();
+        return failed;
+}
author	tb <>	2023-05-24 08:54:59 +0000
committer	tb <>	2023-05-24 08:54:59 +0000
commit	61c81a83de1329c6eec47a61f17e68b7c5a335f9 (patch)
tree	4af95fd970f26f3389693ed73c570d428a1f9675 /src/regress/lib/libssl
parent	6ba3c246f09904342136fa7405a22d78b3db14ae (diff)
download	openbsd-61c81a83de1329c6eec47a61f17e68b7c5a335f9.tar.gz openbsd-61c81a83de1329c6eec47a61f17e68b7c5a335f9.tar.bz2 openbsd-61c81a83de1329c6eec47a61f17e68b7c5a335f9.zip

diff --git a/src/regress/lib/libssl/unit/Makefile b/src/regress/lib/libssl/unit/Makefile index 191aadf2bb..413307b7a0 100644 --- a/src/regress/lib/libssl/unit/Makefile +++ b/src/regress/lib/libssl/unit/Makefile
@@ -1,9 +1,10 @@
1	# $OpenBSD: Makefile,v 1.14 2022/12/02 01:15:11 tb Exp $	1	# $OpenBSD: Makefile,v 1.15 2023/05/24 08:54:59 tb Exp $
2		2
3	PROGS += cipher_list	3	PROGS += cipher_list
4	PROGS += ssl_get_shared_ciphers	4	PROGS += ssl_get_shared_ciphers
5	PROGS += ssl_methods	5	PROGS += ssl_methods
6	PROGS += ssl_set_alpn_protos	6	PROGS += ssl_set_alpn_protos
		7	PROGS += ssl_verify_param
7	PROGS += ssl_versions	8	PROGS += ssl_versions
8	PROGS += tls_ext_alpn	9	PROGS += tls_ext_alpn
9	PROGS += tls_prf	10	PROGS += tls_prf
@@ -15,4 +16,8 @@ CFLAGS+= -DLIBRESSL_INTERNAL -Wall -Wundef -Werror
15	CFLAGS+= -DCERTSDIR=\"${.CURDIR}/../certs\"	16	CFLAGS+= -DCERTSDIR=\"${.CURDIR}/../certs\"
16	CFLAGS+= -I${.CURDIR}/../../../../lib/libssl	17	CFLAGS+= -I${.CURDIR}/../../../../lib/libssl
17		18
		19	LDADD_ssl_verify_param = ${LIBSSL} ${CRYPTO_INT}
		20
		21	REGRESS_EXPECTED_FAILURES+= run-regress-ssl_verify_param
		22
18	.include <bsd.regress.mk>	23	.include <bsd.regress.mk>


diff --git a/src/regress/lib/libssl/unit/ssl_verify_param.c b/src/regress/lib/libssl/unit/ssl_verify_param.c new file mode 100644 index 0000000000..cdb52c56a8 --- /dev/null +++ b/src/regress/lib/libssl/unit/ssl_verify_param.c
@@ -0,0 +1,99 @@
		1	/* $OpenBSD: ssl_verify_param.c,v 1.1 2023/05/24 08:54:59 tb Exp $ */
		2
		3	/*
		4	* Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
		5	*
		6	* Permission to use, copy, modify, and distribute this software for any
		7	* purpose with or without fee is hereby granted, provided that the above
		8	* copyright notice and this permission notice appear in all copies.
		9	*
		10	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
		11	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
		12	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
		13	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
		14	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
		15	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
		16	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
		17	*/
		18
		19	#include <err.h>
		20	#include <stdio.h>
		21
		22	#include <openssl/ssl.h>
		23	#include <openssl/x509v3.h>
		24
		25	unsigned int X509_VERIFY_PARAM_get_hostflags(X509_VERIFY_PARAM *param);
		26
		27	static int
		28	ssl_verify_param_flags_inherited(void)
		29	{
		30	SSL_CTX *ssl_ctx = NULL;
		31	SSL *ssl = NULL;
		32	X509_VERIFY_PARAM *param;
		33	unsigned int defaultflags = 0;
		34	unsigned int newflags = X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
		35	unsigned int flags;
		36	int failed = 1;
		37
		38	if ((ssl_ctx = SSL_CTX_new(TLS_method())) == NULL)
		39	errx(1, "SSL_CTX_new");
		40
		41	if ((param = SSL_CTX_get0_param(ssl_ctx)) == NULL) {
		42	fprintf(stderr, "FAIL: no verify param on ssl_ctx\n");
		43	goto failure;
		44	}
		45
		46	if ((flags = X509_VERIFY_PARAM_get_hostflags(param)) != defaultflags) {
		47	fprintf(stderr, "FAIL: SSL_CTX default hostflags, "
		48	"want: %x, got: %x\n", defaultflags, flags);
		49	goto failure;
		50	}
		51
		52	X509_VERIFY_PARAM_set_hostflags(param, newflags);
		53
		54	if ((flags = X509_VERIFY_PARAM_get_hostflags(param)) != newflags) {
		55	fprintf(stderr, "FAIL: SSL_CTX new hostflags, "
		56	"want: %x, got: %x\n", newflags, flags);
		57	goto failure;
		58	}
		59
		60	if ((ssl = SSL_new(ssl_ctx)) == NULL)
		61	errx(1, "SSL_new");
		62
		63	if ((param = SSL_get0_param(ssl)) == NULL) {
		64	fprintf(stderr, "FAIL: no verify param on ssl\n");
		65	goto failure;
		66	}
		67
		68	if ((flags = X509_VERIFY_PARAM_get_hostflags(param)) != newflags) {
		69	fprintf(stderr, "FAIL: SSL inherited hostflags, "
		70	"want: %x, got: %x\n", newflags, flags);
		71	goto failure;
		72	}
		73
		74	SSL_set_hostflags(ssl, defaultflags);
		75
		76	if ((flags = X509_VERIFY_PARAM_get_hostflags(param)) != defaultflags) {
		77	fprintf(stderr, "FAIL: SSL set hostflags, "
		78	"want: %x, got: %x\n", defaultflags, flags);
		79	goto failure;
		80	}
		81
		82	failed = 0;
		83
		84	failure:
		85	SSL_CTX_free(ssl_ctx);
		86	SSL_free(ssl);
		87
		88	return failed;
		89	}
		90
		91	int
		92	main(void)
		93	{
		94	int failed = 0;
		95
		96	failed \|= ssl_verify_param_flags_inherited();
		97
		98	return failed;
		99	}