path: root/tests/resume-with-previous-stek.c

/*
 * Copyright (C) 2018 Free Software Foundation, Inc.
 *
 * Author: Ander Juaristi
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <stdio.h>
#include <stdlib.h>

#if defined(_WIN32)
int main(int argc, char **argv)
{
	exit(77);
}
#else

#include <stdint.h>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <gnutls/gnutls.h>
#include <assert.h>
#include "utils.h"
#include "cert-common.h"
#include "virt-time.h"

#define TICKET_EXPIRATION 1 /* seconds */
#define TICKET_ROTATION_PERIOD 3 /* seconds */

unsigned num_stek_rotations;

static void stek_rotation_callback(const gnutls_datum_t *prev_key,
		const gnutls_datum_t *new_key,
		uint64_t t)
{
	num_stek_rotations++;
	success("STEK was rotated!\n");
}

static int client_handshake(gnutls_session_t session, gnutls_datum_t *session_data,
			    int resume)
{
	int ret;

	if (resume) {
		if ((ret = gnutls_session_set_data(session,
						   session_data->data,
						   session_data->size)) < 0) {
			fail("client: Could not get session data\n");
		}
	}

	do {
		ret = gnutls_handshake(session);
	} while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);

	if (ret < 0) {
		fail("client: Handshake failed\n");
	} else {
		success("client: Handshake was completed\n");
	}

	if (gnutls_session_is_resumed(session))
		fail("client: Session was resumed (but should not)\n");
	else
		success("client: Success: Session was NOT resumed\n");

	if (!resume) {
		if ((ret = gnutls_session_get_data2(session, session_data)) < 0) {
			fail("client: Could not get session data\n");
		}
	}

	do {
		ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
	} while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);

	return 0;
}

static void client(int fd, int *resume, unsigned rounds, const char *prio)
{
	gnutls_session_t session;
	gnutls_datum_t session_data;
	gnutls_certificate_credentials_t clientx509cred = NULL;

	for (unsigned i = 0; i < rounds; i++) {
		assert(gnutls_certificate_allocate_credentials(&clientx509cred)>=0);

		assert(gnutls_init(&session, GNUTLS_CLIENT)>=0);
		assert(gnutls_priority_set_direct(session, prio, NULL)>=0);

		gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE,
				       clientx509cred);

		gnutls_transport_set_int(session, fd);
		gnutls_handshake_set_timeout(session, 20 * 1000);

		/* Perform TLS handshake and obtain session ticket */
		if (client_handshake(session, &session_data,
				     resume[i]) < 0)
			return;

		if (clientx509cred) {
			gnutls_certificate_free_credentials(clientx509cred);
			clientx509cred = NULL;
		}

		gnutls_deinit(session);
	}
}

typedef void (* gnutls_stek_rotation_callback_t) (const gnutls_datum_t *prev_key,
		const gnutls_datum_t *new_key,
		uint64_t t);
void _gnutls_set_session_ticket_key_rotation_callback(gnutls_session_t session,
		gnutls_stek_rotation_callback_t cb);

static void server(int fd, unsigned rounds, const char *prio)
{
	int retval;
	gnutls_session_t session;
	gnutls_datum_t session_ticket_key = { NULL, 0 };
	gnutls_certificate_credentials_t serverx509cred = NULL;

	virt_time_init();

	if (gnutls_session_ticket_key_generate(&session_ticket_key) < 0) {
		fail("server: Could not generate session ticket key\n");
	}

	for (unsigned i = 0; i < rounds; i++) {
		assert(gnutls_init(&session, GNUTLS_SERVER)>=0);

		assert(gnutls_certificate_allocate_credentials(&serverx509cred)>=0);
		retval = gnutls_certificate_set_x509_key_mem(serverx509cred,
						&server_cert, &server_key,
						GNUTLS_X509_FMT_PEM);
		if (retval < 0)
			fail("error setting key: %s\n", gnutls_strerror(retval));

		assert(gnutls_priority_set_direct(session, prio, NULL)>=0);
		gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, serverx509cred);

		gnutls_db_set_cache_expiration(session, TICKET_EXPIRATION);
		_gnutls_set_session_ticket_key_rotation_callback(session, stek_rotation_callback);

		retval = gnutls_session_ticket_enable_server(session,
							     &session_ticket_key);
		if (retval != GNUTLS_E_SUCCESS) {
			fail("server: Could not enable session tickets: %s\n", gnutls_strerror(retval));
		}

		gnutls_transport_set_int(session, fd);
		gnutls_handshake_set_timeout(session, 20 * 1000);

		virt_sec_sleep(TICKET_ROTATION_PERIOD-1);

		do {
			retval = gnutls_handshake(session);
		} while (retval == GNUTLS_E_AGAIN || retval == GNUTLS_E_INTERRUPTED);

		if (retval < 0) {
			fail("server: Handshake failed: %s\n", gnutls_strerror(retval));
		} else {
			success("server: Handshake was completed\n");
		}

		if (gnutls_session_is_resumed(session))
			fail("server: Session was resumed (but should not)\n");
		else
			success("server: Success: Session was NOT resumed\n");

		gnutls_bye(session, GNUTLS_SHUT_RDWR);
		gnutls_deinit(session);
		gnutls_certificate_free_credentials(serverx509cred);
		serverx509cred = NULL;
	}

	if (num_stek_rotations != 3)
		fail("STEK should be rotated exactly three times (%d)!\n", num_stek_rotations);

	if (serverx509cred)
		gnutls_certificate_free_credentials(serverx509cred);
	gnutls_free(session_ticket_key.data);
}

static void run(const char *name, const char *prio, int resume[], int rounds)
{
	pid_t child;
	int retval, sockets[2], status = 0;

	success("\ntesting %s\n\n", name);

	retval = socketpair(AF_UNIX, SOCK_STREAM, 0, sockets);
	if (retval == -1) {
		perror("socketpair");
		fail("socketpair failed");
		return;
	}

	child = fork();
	if (child < 0) {
		perror("fork");
		fail("fork failed");
		return;
	}

	if (child) {
		/* We are the parent */
		server(sockets[0], rounds, prio);
		waitpid(child, &status, 0);
		check_wait_status(status);
	} else {
		/* We are the child */
		client(sockets[1], resume, rounds, prio);
		exit(0);
	}
}

void doit(void)
{
	int resume[] = { 0, 1, 0 };

	signal(SIGCHLD, SIG_IGN);
	signal(SIGPIPE, SIG_IGN);

	num_stek_rotations = 0;
	run("tls1.2 resumption", "NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0", resume, 3);

	num_stek_rotations = 0;
	run("tls1.3 resumption", "NORMAL:-VERS-ALL:+VERS-TLS1.3", resume, 3);
}

#endif