Commit 1b1d8ae4 authored by Matt Caswell's avatar Matt Caswell
Browse files

Add a test for SSLv2 configuration 



SSLv2 should be off by default. You can only turn it on if you have called
SSL_CTX_clear_options(SSL_OP_NO_SSLv2) or
SSL_clear_options(SSL_OP_NO_SSLv2). You should not be able to inadvertantly
turn it on again via SSL_CONF without having done that first.

Reviewed-by: default avatarEmilia Käsper <emilia@openssl.org>
parent 021fb42d

ssl/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -15,7 +15,7 @@ KRB5_INCLUDES= 
CFLAGS= $(INCLUDES) $(CFLAG)



GENERAL=Makefile README ssl-lib.com install.com

TEST=ssltest.c heartbeat_test.c clienthellotest.c

TEST=ssltest.c heartbeat_test.c clienthellotest.c sslv2conftest.c

APPS=



LIB=$(TOP)/libssl.a

ssl/sslv2conftest.c

0 → 100644
+231 −0
Original line number Diff line number Diff line 
/* Written by Matt Caswell for the OpenSSL Project */

/* ====================================================================

 * Copyright (c) 2016 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    openssl-core@openssl.org.

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 *

 * This product includes cryptographic software written by Eric Young

 * (eay@cryptsoft.com).  This product includes software written by Tim

 * Hudson (tjh@cryptsoft.com).

 *

 */



#include <stdlib.h>

#include <openssl/bio.h>

#include <openssl/ssl.h>

#include <openssl/err.h>





#define TOTAL_NUM_TESTS                         2

#define TEST_SSL_CTX                            0



#define SSLV2ON                                 1

#define SSLV2OFF                                0



SSL_CONF_CTX *confctx;

SSL_CTX *ctx;

SSL *ssl;



static int checksslv2(int test, int sslv2)

{

    int options;

    if (test == TEST_SSL_CTX) {

        options = SSL_CTX_get_options(ctx);

    } else {

        options = SSL_get_options(ssl);

    }

    return ((options & SSL_OP_NO_SSLv2) == 0) ^ (sslv2 == SSLV2OFF);

}



int main(int argc, char *argv[])

{

    BIO *err;

    int testresult = 0;

    int currtest;



    SSL_library_init();

    SSL_load_error_strings();



    err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);



    CRYPTO_malloc_debug_init();

    CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);

    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);





    confctx = SSL_CONF_CTX_new();

    ctx = SSL_CTX_new(SSLv23_method());

    ssl = SSL_new(ctx);

    if (confctx == NULL || ctx == NULL)

        goto end;



    SSL_CONF_CTX_set_flags(confctx, SSL_CONF_FLAG_FILE

                                    | SSL_CONF_FLAG_CLIENT

                                    | SSL_CONF_FLAG_SERVER);



    /*

     * For each test set up an SSL_CTX and SSL and see whether SSLv2 is enabled

     * as expected after various SSL_CONF_cmd("Protocol", ...) calls.

     */

    for (currtest = 0; currtest < TOTAL_NUM_TESTS; currtest++) {

        BIO_printf(err, "SSLv2 CONF Test number %d\n", currtest);

        if (currtest == TEST_SSL_CTX)

            SSL_CONF_CTX_set_ssl_ctx(confctx, ctx);

        else

            SSL_CONF_CTX_set_ssl(confctx, ssl);



        /* SSLv2 should be off by default */

        if (!checksslv2(currtest, SSLV2OFF)) {

            BIO_printf(err, "SSLv2 CONF Test: Off by default test FAIL\n");

            goto end;

        }



        if (SSL_CONF_cmd(confctx, "Protocol", "ALL") != 2

                || !SSL_CONF_CTX_finish(confctx)) {

            BIO_printf(err, "SSLv2 CONF Test: SSL_CONF command FAIL\n");

            goto end;

        }



        /* Should still be off even after ALL Protocols on */

        if (!checksslv2(currtest, SSLV2OFF)) {

            BIO_printf(err, "SSLv2 CONF Test: Off after config #1 FAIL\n");

            goto end;

        }



        if (SSL_CONF_cmd(confctx, "Protocol", "SSLv2") != 2

                || !SSL_CONF_CTX_finish(confctx)) {

            BIO_printf(err, "SSLv2 CONF Test: SSL_CONF command FAIL\n");

            goto end;

        }



        /* Should still be off even if explicitly asked for */

        if (!checksslv2(currtest, SSLV2OFF)) {

            BIO_printf(err, "SSLv2 CONF Test: Off after config #2 FAIL\n");

            goto end;

        }



        if (SSL_CONF_cmd(confctx, "Protocol", "-SSLv2") != 2

                || !SSL_CONF_CTX_finish(confctx)) {

            BIO_printf(err, "SSLv2 CONF Test: SSL_CONF command FAIL\n");;

            goto end;

        }



        if (!checksslv2(currtest, SSLV2OFF)) {

            BIO_printf(err, "SSLv2 CONF Test: Off after config #3 FAIL\n");

            goto end;

        }



        if (currtest == TEST_SSL_CTX)

            SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);

        else

            SSL_clear_options(ssl, SSL_OP_NO_SSLv2);



        if (!checksslv2(currtest, SSLV2ON)) {

            BIO_printf(err, "SSLv2 CONF Test: On after clear FAIL\n");

            goto end;

        }



        if (SSL_CONF_cmd(confctx, "Protocol", "ALL") != 2

                || !SSL_CONF_CTX_finish(confctx)) {

            BIO_printf(err, "SSLv2 CONF Test: SSL_CONF command FAIL\n");

            goto end;

        }



        /* Option has been cleared and config says have SSLv2 so should be on */

        if (!checksslv2(currtest, SSLV2ON)) {

            BIO_printf(err, "SSLv2 CONF Test: On after config #1 FAIL\n");

            goto end;

        }



        if (SSL_CONF_cmd(confctx, "Protocol", "SSLv2") != 2

                || !SSL_CONF_CTX_finish(confctx)) {

            BIO_printf(err, "SSLv2 CONF Test: SSL_CONF command FAIL\n");

            goto end;

        }



        /* Option has been cleared and config says have SSLv2 so should be on */

        if (!checksslv2(currtest, SSLV2ON)) {

            BIO_printf(err, "SSLv2 CONF Test: On after config #2 FAIL\n");

            goto end;

        }



        if (SSL_CONF_cmd(confctx, "Protocol", "-SSLv2") != 2

                || !SSL_CONF_CTX_finish(confctx)) {

            BIO_printf(err, "SSLv2 CONF Test: SSL_CONF command FAIL\n");

            goto end;

        }



        /* Option has been cleared but config says no SSLv2 so should be off */

        if (!checksslv2(currtest, SSLV2OFF)) {

            BIO_printf(err, "SSLv2 CONF Test: Off after config #4 FAIL\n");

            goto end;

        }



    }



    testresult = 1;



 end:

    SSL_free(ssl);

    SSL_CTX_free(ctx);

    SSL_CONF_CTX_free(confctx);



    if (!testresult) {

        printf("SSLv2 CONF test: FAILED (Test %d)\n", currtest);

        ERR_print_errors(err);

    } else {

        printf("SSLv2 CONF test: PASSED\n");

    }



    ERR_free_strings();

    ERR_remove_thread_state(NULL);

    EVP_cleanup();

    CRYPTO_cleanup_all_ex_data();

    CRYPTO_mem_leaks(err);

    BIO_free(err);



    return testresult ? EXIT_SUCCESS : EXIT_FAILURE;

}

test/Makefile

+31 −4
Original line number Diff line number Diff line
@@ -70,6 +70,7 @@ HEARTBEATTEST= heartbeat_test 
CONSTTIMETEST=  constant_time_test

VERIFYEXTRATEST=	verify_extra_test

CLIENTHELLOTEST=	clienthellotest

SSLV2CONFTEST = 	sslv2conftest



TESTS=		alltests
@@ -83,7 +84,7 @@ EXE= $(BNTEST)$(EXE_EXT) $(ECTEST)$(EXE_EXT) $(ECDSATEST)$(EXE_EXT) $(ECDHTEST) 
	$(EVPTEST)$(EXE_EXT) $(EVPEXTRATEST)$(EXE_EXT) $(IGETEST)$(EXE_EXT) $(JPAKETEST)$(EXE_EXT) $(SRPTEST)$(EXE_EXT) \

	$(ASN1TEST)$(EXE_EXT) $(V3NAMETEST)$(EXE_EXT) $(HEARTBEATTEST)$(EXE_EXT) \

	$(CONSTTIMETEST)$(EXE_EXT) $(VERIFYEXTRATEST)$(EXE_EXT) \

	$(CLIENTHELLOTEST)$(EXE_EXT)

	$(CLIENTHELLOTEST)$(EXE_EXT) $(SSLV2CONFTEST)$(EXE_EXT)



# $(METHTEST)$(EXE_EXT)
@@ -97,7 +98,7 @@ OBJ= $(BNTEST).o $(ECTEST).o $(ECDSATEST).o $(ECDHTEST).o $(IDEATEST).o \ 
	$(BFTEST).o  $(SSLTEST).o  $(DSATEST).o  $(EXPTEST).o $(RSATEST).o \

	$(EVPTEST).o $(EVPEXTRATEST).o $(IGETEST).o $(JPAKETEST).o $(ASN1TEST).o $(V3NAMETEST).o \

	$(HEARTBEATTEST).o $(CONSTTIMETEST).o $(VERIFYEXTRATEST).o \

	$(CLIENTHELLOTEST).o

	$(CLIENTHELLOTEST).o  $(SSLV2CONFTEST).o



SRC=	$(BNTEST).c $(ECTEST).c  $(ECDSATEST).c $(ECDHTEST).c $(IDEATEST).c \

	$(MD2TEST).c  $(MD4TEST).c $(MD5TEST).c \
@@ -108,7 +109,7 @@ SRC= $(BNTEST).c $(ECTEST).c $(ECDSATEST).c $(ECDHTEST).c $(IDEATEST).c \ 
	$(BFTEST).c  $(SSLTEST).c $(DSATEST).c   $(EXPTEST).c $(RSATEST).c \

	$(EVPTEST).c $(EVPEXTRATEST).c $(IGETEST).c $(JPAKETEST).c $(SRPTEST).c $(ASN1TEST).c \

	$(V3NAMETEST).c $(HEARTBEATTEST).c $(CONSTTIMETEST).c $(VERIFYEXTRATEST).c \

	$(CLIENTHELLOTEST).c

	$(CLIENTHELLOTEST).c  $(SSLV2CONFTEST).c



EXHEADER= 

HEADER=	testutil.h $(EXHEADER)
@@ -152,7 +153,7 @@ alltests: \ 
	test_gen test_req test_pkcs7 test_verify test_dh test_dsa \

	test_ss test_ca test_engine test_evp test_evp_extra test_ssl test_tsa test_ige \

	test_jpake test_srp test_cms test_ocsp test_v3name test_heartbeat \

	test_constant_time test_verify_extra test_clienthello

	test_constant_time test_verify_extra test_clienthello test_sslv2conftest



test_evp: $(EVPTEST)$(EXE_EXT) evptests.txt

	../util/shlib_wrap.sh ./$(EVPTEST) evptests.txt
@@ -361,6 +362,10 @@ test_clienthello: $(CLIENTHELLOTEST)$(EXE_EXT) 
	@echo $(START) $@

	../util/shlib_wrap.sh ./$(CLIENTHELLOTEST)



test_sslv2conftest: $(SSLV2CONFTEST)$(EXE_EXT)

	@echo $(START) $@

	../util/shlib_wrap.sh ./$(SSLV2CONFTEST)



lint:

	lint -DLINT $(INCLUDES) $(SRC)>fluff
@@ -538,6 +543,9 @@ $(VERIFYEXTRATEST)$(EXE_EXT): $(VERIFYEXTRATEST).o 
$(CLIENTHELLOTEST)$(EXE_EXT): $(CLIENTHELLOTEST).o

	@target=$(CLIENTHELLOTEST) $(BUILD_CMD)



$(SSLV2CONFTEST)$(EXE_EXT): $(SSLV2CONFTEST).o

	@target=$(SSLV2CONFTEST) $(BUILD_CMD)



#$(AESTEST).o: $(AESTEST).c

#	$(CC) -c $(CFLAGS) -DINTERMEDIATE_VALUE_KAT -DTRACE_KAT_MCT $(AESTEST).c
@@ -848,6 +856,25 @@ ssltest.o: ../include/openssl/ssl3.h ../include/openssl/stack.h 
ssltest.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h

ssltest.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h

ssltest.o: ../include/openssl/x509v3.h ssltest.c

sslv2conftest.o: ../include/openssl/asn1.h ../include/openssl/bio.h

sslv2conftest.o: ../include/openssl/buffer.h ../include/openssl/comp.h

sslv2conftest.o: ../include/openssl/crypto.h ../include/openssl/dtls1.h

sslv2conftest.o: ../include/openssl/e_os2.h ../include/openssl/ec.h

sslv2conftest.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h

sslv2conftest.o: ../include/openssl/err.h ../include/openssl/evp.h

sslv2conftest.o: ../include/openssl/hmac.h ../include/openssl/kssl.h

sslv2conftest.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h

sslv2conftest.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h

sslv2conftest.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h

sslv2conftest.o: ../include/openssl/pem.h ../include/openssl/pem2.h

sslv2conftest.o: ../include/openssl/pkcs7.h ../include/openssl/pqueue.h

sslv2conftest.o: ../include/openssl/safestack.h ../include/openssl/sha.h

sslv2conftest.o: ../include/openssl/srtp.h ../include/openssl/ssl.h

sslv2conftest.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h

sslv2conftest.o: ../include/openssl/ssl3.h ../include/openssl/stack.h

sslv2conftest.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h

sslv2conftest.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h

sslv2conftest.o: sslv2conftest.c

v3nametest.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h

v3nametest.o: ../include/openssl/buffer.h ../include/openssl/conf.h

v3nametest.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h