1// Copyright 2009 The Go Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style 3// license that can be found in the LICENSE file. 4 5package tls 6 7import ( 8 "bytes" 9 "math/rand" 10 "reflect" 11 "strings" 12 "testing" 13 "testing/quick" 14 "time" 15) 16 17var tests = []interface{}{ 18 &clientHelloMsg{}, 19 &serverHelloMsg{}, 20 &finishedMsg{}, 21 22 &certificateMsg{}, 23 &certificateRequestMsg{}, 24 &certificateVerifyMsg{ 25 hasSignatureAlgorithm: true, 26 }, 27 &certificateStatusMsg{}, 28 &clientKeyExchangeMsg{}, 29 &newSessionTicketMsg{}, 30 &sessionState{}, 31 &sessionStateTLS13{}, 32 &encryptedExtensionsMsg{}, 33 &endOfEarlyDataMsg{}, 34 &keyUpdateMsg{}, 35 &newSessionTicketMsgTLS13{}, 36 &certificateRequestMsgTLS13{}, 37 &certificateMsgTLS13{}, 38} 39 40func TestMarshalUnmarshal(t *testing.T) { 41 rand := rand.New(rand.NewSource(time.Now().UnixNano())) 42 43 for i, iface := range tests { 44 ty := reflect.ValueOf(iface).Type() 45 46 n := 100 47 if testing.Short() { 48 n = 5 49 } 50 for j := 0; j < n; j++ { 51 v, ok := quick.Value(ty, rand) 52 if !ok { 53 t.Errorf("#%d: failed to create value", i) 54 break 55 } 56 57 m1 := v.Interface().(handshakeMessage) 58 marshaled := m1.marshal() 59 m2 := iface.(handshakeMessage) 60 if !m2.unmarshal(marshaled) { 61 t.Errorf("#%d failed to unmarshal %#v %x", i, m1, marshaled) 62 break 63 } 64 m2.marshal() // to fill any marshal cache in the message 65 66 if !reflect.DeepEqual(m1, m2) { 67 t.Errorf("#%d got:%#v want:%#v %x", i, m2, m1, marshaled) 68 break 69 } 70 71 if i >= 3 { 72 // The first three message types (ClientHello, 73 // ServerHello and Finished) are allowed to 74 // have parsable prefixes because the extension 75 // data is optional and the length of the 76 // Finished varies across versions. 77 for j := 0; j < len(marshaled); j++ { 78 if m2.unmarshal(marshaled[0:j]) { 79 t.Errorf("#%d unmarshaled a prefix of length %d of %#v", i, j, m1) 80 break 81 } 82 } 83 } 84 } 85 } 86} 87 88func TestFuzz(t *testing.T) { 89 rand := rand.New(rand.NewSource(0)) 90 for _, iface := range tests { 91 m := iface.(handshakeMessage) 92 93 for j := 0; j < 1000; j++ { 94 len := rand.Intn(100) 95 bytes := randomBytes(len, rand) 96 // This just looks for crashes due to bounds errors etc. 97 m.unmarshal(bytes) 98 } 99 } 100} 101 102func randomBytes(n int, rand *rand.Rand) []byte { 103 r := make([]byte, n) 104 if _, err := rand.Read(r); err != nil { 105 panic("rand.Read failed: " + err.Error()) 106 } 107 return r 108} 109 110func randomString(n int, rand *rand.Rand) string { 111 b := randomBytes(n, rand) 112 return string(b) 113} 114 115func (*clientHelloMsg) Generate(rand *rand.Rand, size int) reflect.Value { 116 m := &clientHelloMsg{} 117 m.vers = uint16(rand.Intn(65536)) 118 m.random = randomBytes(32, rand) 119 m.sessionId = randomBytes(rand.Intn(32), rand) 120 m.cipherSuites = make([]uint16, rand.Intn(63)+1) 121 for i := 0; i < len(m.cipherSuites); i++ { 122 cs := uint16(rand.Int31()) 123 if cs == scsvRenegotiation { 124 cs += 1 125 } 126 m.cipherSuites[i] = cs 127 } 128 m.compressionMethods = randomBytes(rand.Intn(63)+1, rand) 129 if rand.Intn(10) > 5 { 130 m.serverName = randomString(rand.Intn(255), rand) 131 for strings.HasSuffix(m.serverName, ".") { 132 m.serverName = m.serverName[:len(m.serverName)-1] 133 } 134 } 135 m.ocspStapling = rand.Intn(10) > 5 136 m.supportedPoints = randomBytes(rand.Intn(5)+1, rand) 137 m.supportedCurves = make([]CurveID, rand.Intn(5)+1) 138 for i := range m.supportedCurves { 139 m.supportedCurves[i] = CurveID(rand.Intn(30000) + 1) 140 } 141 if rand.Intn(10) > 5 { 142 m.ticketSupported = true 143 if rand.Intn(10) > 5 { 144 m.sessionTicket = randomBytes(rand.Intn(300), rand) 145 } else { 146 m.sessionTicket = make([]byte, 0) 147 } 148 } 149 if rand.Intn(10) > 5 { 150 m.supportedSignatureAlgorithms = supportedSignatureAlgorithms 151 } 152 if rand.Intn(10) > 5 { 153 m.supportedSignatureAlgorithmsCert = supportedSignatureAlgorithms 154 } 155 for i := 0; i < rand.Intn(5); i++ { 156 m.alpnProtocols = append(m.alpnProtocols, randomString(rand.Intn(20)+1, rand)) 157 } 158 if rand.Intn(10) > 5 { 159 m.scts = true 160 } 161 if rand.Intn(10) > 5 { 162 m.secureRenegotiationSupported = true 163 m.secureRenegotiation = randomBytes(rand.Intn(50)+1, rand) 164 } 165 for i := 0; i < rand.Intn(5); i++ { 166 m.supportedVersions = append(m.supportedVersions, uint16(rand.Intn(0xffff)+1)) 167 } 168 if rand.Intn(10) > 5 { 169 m.cookie = randomBytes(rand.Intn(500)+1, rand) 170 } 171 for i := 0; i < rand.Intn(5); i++ { 172 var ks keyShare 173 ks.group = CurveID(rand.Intn(30000) + 1) 174 ks.data = randomBytes(rand.Intn(200)+1, rand) 175 m.keyShares = append(m.keyShares, ks) 176 } 177 switch rand.Intn(3) { 178 case 1: 179 m.pskModes = []uint8{pskModeDHE} 180 case 2: 181 m.pskModes = []uint8{pskModeDHE, pskModePlain} 182 } 183 for i := 0; i < rand.Intn(5); i++ { 184 var psk pskIdentity 185 psk.obfuscatedTicketAge = uint32(rand.Intn(500000)) 186 psk.label = randomBytes(rand.Intn(500)+1, rand) 187 m.pskIdentities = append(m.pskIdentities, psk) 188 m.pskBinders = append(m.pskBinders, randomBytes(rand.Intn(50)+32, rand)) 189 } 190 if rand.Intn(10) > 5 { 191 m.earlyData = true 192 } 193 194 return reflect.ValueOf(m) 195} 196 197func (*serverHelloMsg) Generate(rand *rand.Rand, size int) reflect.Value { 198 m := &serverHelloMsg{} 199 m.vers = uint16(rand.Intn(65536)) 200 m.random = randomBytes(32, rand) 201 m.sessionId = randomBytes(rand.Intn(32), rand) 202 m.cipherSuite = uint16(rand.Int31()) 203 m.compressionMethod = uint8(rand.Intn(256)) 204 m.supportedPoints = randomBytes(rand.Intn(5)+1, rand) 205 206 if rand.Intn(10) > 5 { 207 m.ocspStapling = true 208 } 209 if rand.Intn(10) > 5 { 210 m.ticketSupported = true 211 } 212 if rand.Intn(10) > 5 { 213 m.alpnProtocol = randomString(rand.Intn(32)+1, rand) 214 } 215 216 for i := 0; i < rand.Intn(4); i++ { 217 m.scts = append(m.scts, randomBytes(rand.Intn(500)+1, rand)) 218 } 219 220 if rand.Intn(10) > 5 { 221 m.secureRenegotiationSupported = true 222 m.secureRenegotiation = randomBytes(rand.Intn(50)+1, rand) 223 } 224 if rand.Intn(10) > 5 { 225 m.supportedVersion = uint16(rand.Intn(0xffff) + 1) 226 } 227 if rand.Intn(10) > 5 { 228 m.cookie = randomBytes(rand.Intn(500)+1, rand) 229 } 230 if rand.Intn(10) > 5 { 231 for i := 0; i < rand.Intn(5); i++ { 232 m.serverShare.group = CurveID(rand.Intn(30000) + 1) 233 m.serverShare.data = randomBytes(rand.Intn(200)+1, rand) 234 } 235 } else if rand.Intn(10) > 5 { 236 m.selectedGroup = CurveID(rand.Intn(30000) + 1) 237 } 238 if rand.Intn(10) > 5 { 239 m.selectedIdentityPresent = true 240 m.selectedIdentity = uint16(rand.Intn(0xffff)) 241 } 242 243 return reflect.ValueOf(m) 244} 245 246func (*encryptedExtensionsMsg) Generate(rand *rand.Rand, size int) reflect.Value { 247 m := &encryptedExtensionsMsg{} 248 249 if rand.Intn(10) > 5 { 250 m.alpnProtocol = randomString(rand.Intn(32)+1, rand) 251 } 252 253 return reflect.ValueOf(m) 254} 255 256func (*certificateMsg) Generate(rand *rand.Rand, size int) reflect.Value { 257 m := &certificateMsg{} 258 numCerts := rand.Intn(20) 259 m.certificates = make([][]byte, numCerts) 260 for i := 0; i < numCerts; i++ { 261 m.certificates[i] = randomBytes(rand.Intn(10)+1, rand) 262 } 263 return reflect.ValueOf(m) 264} 265 266func (*certificateRequestMsg) Generate(rand *rand.Rand, size int) reflect.Value { 267 m := &certificateRequestMsg{} 268 m.certificateTypes = randomBytes(rand.Intn(5)+1, rand) 269 for i := 0; i < rand.Intn(100); i++ { 270 m.certificateAuthorities = append(m.certificateAuthorities, randomBytes(rand.Intn(15)+1, rand)) 271 } 272 return reflect.ValueOf(m) 273} 274 275func (*certificateVerifyMsg) Generate(rand *rand.Rand, size int) reflect.Value { 276 m := &certificateVerifyMsg{} 277 m.hasSignatureAlgorithm = true 278 m.signatureAlgorithm = SignatureScheme(rand.Intn(30000)) 279 m.signature = randomBytes(rand.Intn(15)+1, rand) 280 return reflect.ValueOf(m) 281} 282 283func (*certificateStatusMsg) Generate(rand *rand.Rand, size int) reflect.Value { 284 m := &certificateStatusMsg{} 285 m.response = randomBytes(rand.Intn(10)+1, rand) 286 return reflect.ValueOf(m) 287} 288 289func (*clientKeyExchangeMsg) Generate(rand *rand.Rand, size int) reflect.Value { 290 m := &clientKeyExchangeMsg{} 291 m.ciphertext = randomBytes(rand.Intn(1000)+1, rand) 292 return reflect.ValueOf(m) 293} 294 295func (*finishedMsg) Generate(rand *rand.Rand, size int) reflect.Value { 296 m := &finishedMsg{} 297 m.verifyData = randomBytes(12, rand) 298 return reflect.ValueOf(m) 299} 300 301func (*newSessionTicketMsg) Generate(rand *rand.Rand, size int) reflect.Value { 302 m := &newSessionTicketMsg{} 303 m.ticket = randomBytes(rand.Intn(4), rand) 304 return reflect.ValueOf(m) 305} 306 307func (*sessionState) Generate(rand *rand.Rand, size int) reflect.Value { 308 s := &sessionState{} 309 s.vers = uint16(rand.Intn(10000)) 310 s.cipherSuite = uint16(rand.Intn(10000)) 311 s.masterSecret = randomBytes(rand.Intn(100), rand) 312 numCerts := rand.Intn(20) 313 s.certificates = make([][]byte, numCerts) 314 for i := 0; i < numCerts; i++ { 315 s.certificates[i] = randomBytes(rand.Intn(10)+1, rand) 316 } 317 return reflect.ValueOf(s) 318} 319 320func (*sessionStateTLS13) Generate(rand *rand.Rand, size int) reflect.Value { 321 s := &sessionStateTLS13{} 322 s.cipherSuite = uint16(rand.Intn(10000)) 323 s.resumptionSecret = randomBytes(rand.Intn(100)+1, rand) 324 s.createdAt = uint64(rand.Int63()) 325 for i := 0; i < rand.Intn(2)+1; i++ { 326 s.certificate.Certificate = append( 327 s.certificate.Certificate, randomBytes(rand.Intn(500)+1, rand)) 328 } 329 if rand.Intn(10) > 5 { 330 s.certificate.OCSPStaple = randomBytes(rand.Intn(100)+1, rand) 331 } 332 if rand.Intn(10) > 5 { 333 for i := 0; i < rand.Intn(2)+1; i++ { 334 s.certificate.SignedCertificateTimestamps = append( 335 s.certificate.SignedCertificateTimestamps, randomBytes(rand.Intn(500)+1, rand)) 336 } 337 } 338 return reflect.ValueOf(s) 339} 340 341func (*endOfEarlyDataMsg) Generate(rand *rand.Rand, size int) reflect.Value { 342 m := &endOfEarlyDataMsg{} 343 return reflect.ValueOf(m) 344} 345 346func (*keyUpdateMsg) Generate(rand *rand.Rand, size int) reflect.Value { 347 m := &keyUpdateMsg{} 348 m.updateRequested = rand.Intn(10) > 5 349 return reflect.ValueOf(m) 350} 351 352func (*newSessionTicketMsgTLS13) Generate(rand *rand.Rand, size int) reflect.Value { 353 m := &newSessionTicketMsgTLS13{} 354 m.lifetime = uint32(rand.Intn(500000)) 355 m.ageAdd = uint32(rand.Intn(500000)) 356 m.nonce = randomBytes(rand.Intn(100), rand) 357 m.label = randomBytes(rand.Intn(1000), rand) 358 if rand.Intn(10) > 5 { 359 m.maxEarlyData = uint32(rand.Intn(500000)) 360 } 361 return reflect.ValueOf(m) 362} 363 364func (*certificateRequestMsgTLS13) Generate(rand *rand.Rand, size int) reflect.Value { 365 m := &certificateRequestMsgTLS13{} 366 if rand.Intn(10) > 5 { 367 m.ocspStapling = true 368 } 369 if rand.Intn(10) > 5 { 370 m.scts = true 371 } 372 if rand.Intn(10) > 5 { 373 m.supportedSignatureAlgorithms = supportedSignatureAlgorithms 374 } 375 if rand.Intn(10) > 5 { 376 m.supportedSignatureAlgorithmsCert = supportedSignatureAlgorithms 377 } 378 if rand.Intn(10) > 5 { 379 m.certificateAuthorities = make([][]byte, 3) 380 for i := 0; i < 3; i++ { 381 m.certificateAuthorities[i] = randomBytes(rand.Intn(10)+1, rand) 382 } 383 } 384 return reflect.ValueOf(m) 385} 386 387func (*certificateMsgTLS13) Generate(rand *rand.Rand, size int) reflect.Value { 388 m := &certificateMsgTLS13{} 389 for i := 0; i < rand.Intn(2)+1; i++ { 390 m.certificate.Certificate = append( 391 m.certificate.Certificate, randomBytes(rand.Intn(500)+1, rand)) 392 } 393 if rand.Intn(10) > 5 { 394 m.ocspStapling = true 395 m.certificate.OCSPStaple = randomBytes(rand.Intn(100)+1, rand) 396 } 397 if rand.Intn(10) > 5 { 398 m.scts = true 399 for i := 0; i < rand.Intn(2)+1; i++ { 400 m.certificate.SignedCertificateTimestamps = append( 401 m.certificate.SignedCertificateTimestamps, randomBytes(rand.Intn(500)+1, rand)) 402 } 403 } 404 return reflect.ValueOf(m) 405} 406 407func TestRejectEmptySCTList(t *testing.T) { 408 // RFC 6962, Section 3.3.1 specifies that empty SCT lists are invalid. 409 410 var random [32]byte 411 sct := []byte{0x42, 0x42, 0x42, 0x42} 412 serverHello := serverHelloMsg{ 413 vers: VersionTLS12, 414 random: random[:], 415 scts: [][]byte{sct}, 416 } 417 serverHelloBytes := serverHello.marshal() 418 419 var serverHelloCopy serverHelloMsg 420 if !serverHelloCopy.unmarshal(serverHelloBytes) { 421 t.Fatal("Failed to unmarshal initial message") 422 } 423 424 // Change serverHelloBytes so that the SCT list is empty 425 i := bytes.Index(serverHelloBytes, sct) 426 if i < 0 { 427 t.Fatal("Cannot find SCT in ServerHello") 428 } 429 430 var serverHelloEmptySCT []byte 431 serverHelloEmptySCT = append(serverHelloEmptySCT, serverHelloBytes[:i-6]...) 432 // Append the extension length and SCT list length for an empty list. 433 serverHelloEmptySCT = append(serverHelloEmptySCT, []byte{0, 2, 0, 0}...) 434 serverHelloEmptySCT = append(serverHelloEmptySCT, serverHelloBytes[i+4:]...) 435 436 // Update the handshake message length. 437 serverHelloEmptySCT[1] = byte((len(serverHelloEmptySCT) - 4) >> 16) 438 serverHelloEmptySCT[2] = byte((len(serverHelloEmptySCT) - 4) >> 8) 439 serverHelloEmptySCT[3] = byte(len(serverHelloEmptySCT) - 4) 440 441 // Update the extensions length 442 serverHelloEmptySCT[42] = byte((len(serverHelloEmptySCT) - 44) >> 8) 443 serverHelloEmptySCT[43] = byte((len(serverHelloEmptySCT) - 44)) 444 445 if serverHelloCopy.unmarshal(serverHelloEmptySCT) { 446 t.Fatal("Unmarshaled ServerHello with empty SCT list") 447 } 448} 449 450func TestRejectEmptySCT(t *testing.T) { 451 // Not only must the SCT list be non-empty, but the SCT elements must 452 // not be zero length. 453 454 var random [32]byte 455 serverHello := serverHelloMsg{ 456 vers: VersionTLS12, 457 random: random[:], 458 scts: [][]byte{nil}, 459 } 460 serverHelloBytes := serverHello.marshal() 461 462 var serverHelloCopy serverHelloMsg 463 if serverHelloCopy.unmarshal(serverHelloBytes) { 464 t.Fatal("Unmarshaled ServerHello with zero-length SCT") 465 } 466} 467