aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_connection_test.c

@@ -253,8 +253,10 @@ int main(int argc, char **argv)
         };
 
         for (size_t i = S2N_TLS_HASH_NONE; i <= UINT16_MAX; i++) {
-            conn->handshake_params.client_cert_sig_scheme.hash_alg = i;
-            conn->handshake_params.conn_sig_scheme.hash_alg = i;
+            struct s2n_signature_scheme test_scheme = *conn->handshake_params.client_cert_sig_scheme;
+            test_scheme.hash_alg = i;
+            conn->handshake_params.client_cert_sig_scheme = &test_scheme;
+            conn->handshake_params.server_cert_sig_scheme = &test_scheme;
             if (i <= S2N_HASH_SENTINEL) {
                 EXPECT_SUCCESS(s2n_connection_get_selected_client_cert_digest_algorithm(conn, &output));
                 EXPECT_EQUAL(expected_output[i], output);
@@ -300,8 +302,10 @@ int main(int argc, char **argv)
         };
 
         for (size_t i = 0; i <= UINT16_MAX; i++) {
-            conn->handshake_params.client_cert_sig_scheme.sig_alg = i;
-            conn->handshake_params.conn_sig_scheme.sig_alg = i;
+            struct s2n_signature_scheme test_scheme = *conn->handshake_params.client_cert_sig_scheme;
+            test_scheme.sig_alg = i;
+            conn->handshake_params.client_cert_sig_scheme = &test_scheme;
+            conn->handshake_params.server_cert_sig_scheme = &test_scheme;
 
             if (i < s2n_array_len(expected_output)) {
                 EXPECT_SUCCESS(s2n_connection_get_selected_client_cert_signature_algorithm(conn, &output));

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_handshake_test.c

@@ -187,7 +187,8 @@ int test_cipher_preferences(struct s2n_config *server_config, struct s2n_config
             EXPECT_STRING_EQUAL(s2n_connection_get_cipher(server_conn), expected_cipher->name);
 
             EXPECT_EQUAL(server_conn->handshake_params.our_chain_and_key, expected_cert_chain);
-            EXPECT_EQUAL(server_conn->handshake_params.conn_sig_scheme.sig_alg, expected_sig_alg);
+            EXPECT_NOT_NULL(server_conn->handshake_params.server_cert_sig_scheme);
+            EXPECT_EQUAL(server_conn->handshake_params.server_cert_sig_scheme->sig_alg, expected_sig_alg);
 
             EXPECT_TRUE(IS_NEGOTIATED(server_conn));
             EXPECT_TRUE(IS_NEGOTIATED(client_conn));

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_quic_support_io_test.c

@@ -24,10 +24,23 @@
 /* We need access to some io logic */
 #include "tls/s2n_handshake_io.c"
 
+#define TEST_TICKET_AGE_ADD 0x01, 0x02, 0x03, 0x04
+#define TEST_LIFETIME       0x00, 0x01, 0x01, 0x01
+#define TEST_TICKET         0x01, 0xFF, 0x23
+
 static const uint8_t TEST_DATA[] = "test";
 static const size_t TEST_DATA_SIZE = sizeof(TEST_DATA);
 
 struct s2n_stuffer input_stuffer, output_stuffer;
+
+static int s2n_test_session_ticket_cb(struct s2n_connection *conn, void *ctx, struct s2n_session_ticket *ticket)
+{
+    uint8_t *count = (uint8_t *) ctx;
+    (*count)++;
+
+    return S2N_SUCCESS;
+}
+
 static S2N_RESULT s2n_setup_conn(struct s2n_connection *conn)
 {
     conn->actual_protocol_version = S2N_TLS13;
@@ -416,5 +429,98 @@ int main(int argc, char **argv)
         EXPECT_SUCCESS(s2n_config_free(config));
     };
 
+    /* Test: s2n_recv_quic_post_handshake_message */
+    {
+        /* Safety checks */
+        s2n_blocked_status blocked = 0;
+        EXPECT_FAILURE(s2n_recv_quic_post_handshake_message(NULL, &blocked));
+
+        /* Parsable session ticket message */
+        uint8_t ticket_message[] = {
+            TLS_SERVER_NEW_SESSION_TICKET,
+            0x00, 0x00, 0x12,    /* message size */
+            TEST_LIFETIME,       /* ticket lifetime */
+            TEST_TICKET_AGE_ADD, /* ticket age add */
+            0x02,                /* nonce len */
+            0x00, 0x00,          /* nonce */
+            0x00, 0x03,          /* ticket len */
+            TEST_TICKET,         /* ticket */
+            0x00, 0x00,          /* extensions len */
+        };
+
+        /* Test: fails to read post-handshake message that is not a ST */
+        {
+            DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_CLIENT),
+                    s2n_connection_ptr_free);
+
+            DEFER_CLEANUP(struct s2n_stuffer stuffer = { 0 }, s2n_stuffer_free);
+            EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&stuffer, 0));
+            EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&stuffer, &stuffer, conn));
+
+            /* Create a post-handshake message that isn't supported by quic */
+            EXPECT_SUCCESS(s2n_stuffer_write_uint8(&stuffer, TLS_KEY_UPDATE));
+            EXPECT_SUCCESS(s2n_stuffer_write_uint24(&stuffer, TEST_DATA_SIZE));
+            EXPECT_SUCCESS(s2n_stuffer_write_bytes(&stuffer, TEST_DATA, TEST_DATA_SIZE));
+
+            EXPECT_FAILURE_WITH_ERRNO(s2n_recv_quic_post_handshake_message(conn, &blocked), S2N_ERR_UNSUPPORTED_WITH_QUIC);
+        };
+
+        /* Test: successfully reads and processes post-handshake message */
+        {
+            DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_CLIENT),
+                    s2n_connection_ptr_free);
+            DEFER_CLEANUP(struct s2n_config *config = s2n_config_new(), s2n_config_ptr_free);
+            EXPECT_SUCCESS(s2n_config_set_session_tickets_onoff(config, 1));
+            uint8_t session_ticket_cb_count = 0;
+            EXPECT_SUCCESS(s2n_config_set_session_ticket_cb(config, s2n_test_session_ticket_cb, &session_ticket_cb_count));
+            EXPECT_SUCCESS(s2n_connection_set_config(conn, config));
+            conn->secure->cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
+
+            DEFER_CLEANUP(struct s2n_stuffer stuffer = { 0 }, s2n_stuffer_free);
+            EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&stuffer, 0));
+            EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&stuffer, &stuffer, conn));
+
+            /* Construct ST handshake message */
+            EXPECT_SUCCESS(s2n_stuffer_write_bytes(&stuffer, ticket_message, sizeof(ticket_message)));
+
+            EXPECT_SUCCESS(s2n_recv_quic_post_handshake_message(conn, &blocked));
+
+            /* Callback was triggered */
+            EXPECT_EQUAL(session_ticket_cb_count, 1);
+        };
+
+        /* Test: successfully reads and processes fragmented post-handshake message */
+        for (size_t i = 1; i < sizeof(ticket_message); i++) {
+            DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_CLIENT), s2n_connection_ptr_free);
+            DEFER_CLEANUP(struct s2n_config *config = s2n_config_new(), s2n_config_ptr_free);
+            EXPECT_SUCCESS(s2n_config_set_session_tickets_onoff(config, 1));
+            uint8_t session_ticket_cb_count = 0;
+            EXPECT_SUCCESS(s2n_config_set_session_ticket_cb(config, s2n_test_session_ticket_cb, &session_ticket_cb_count));
+            EXPECT_SUCCESS(s2n_connection_set_config(conn, config));
+            conn->secure->cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
+
+            DEFER_CLEANUP(struct s2n_stuffer stuffer = { 0 }, s2n_stuffer_free);
+            EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&stuffer, 0));
+            EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&stuffer, &stuffer, conn));
+
+            /* Mock receiving a fragmented handshake message */
+            EXPECT_SUCCESS(s2n_stuffer_write_bytes(&stuffer, ticket_message, i));
+
+            EXPECT_FAILURE_WITH_ERRNO(s2n_recv_quic_post_handshake_message(conn, &blocked), S2N_ERR_IO_BLOCKED);
+            EXPECT_EQUAL(blocked, S2N_BLOCKED_ON_READ);
+
+            /* Callback was not triggered */
+            EXPECT_EQUAL(session_ticket_cb_count, 0);
+
+            /* "Write" the rest of the message */
+            EXPECT_SUCCESS(s2n_stuffer_write_bytes(&stuffer, ticket_message + i, sizeof(ticket_message) - i));
+
+            EXPECT_SUCCESS(s2n_recv_quic_post_handshake_message(conn, &blocked));
+
+            /* Callback was triggered */
+            EXPECT_EQUAL(session_ticket_cb_count, 1);
+        };
+    }
+
     END_TEST();
 }

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_security_policies_test.c

@@ -151,7 +151,7 @@ int main(int argc, char **argv)
                     client_conn->secure->cipher_suite = &tls_13_ciphers[i];
                     server_conn->secure->cipher_suite = &tls_13_ciphers[i];
 
-                    struct s2n_signature_scheme chosen_scheme = { 0 };
+                    const struct s2n_signature_scheme *chosen_scheme = NULL;
 
                     if (s2n_is_rsa_pss_signing_supported()) {
                         /* If RSA PSS signing is supported, then we should always be able to select a default Signature
@@ -214,7 +214,7 @@ int main(int argc, char **argv)
                     client_conn->secure->cipher_suite = &tls_13_ciphers[i];
                     server_conn->secure->cipher_suite = &tls_13_ciphers[i];
 
-                    struct s2n_signature_scheme chosen_scheme = { 0 };
+                    const struct s2n_signature_scheme *chosen_scheme = NULL;
 
                     /* If an ECDSA Certificate is configured, then we should always be able to pick a default Signature
                      * Scheme (even if RSA PSS is not supported by the libcrypto) */
@@ -610,6 +610,10 @@ int main(int argc, char **argv)
             "PQ-TLS-1-2-2023-04-09",
             "PQ-TLS-1-2-2023-04-10",
             "PQ-TLS-1-3-2023-06-01",
+            "PQ-TLS-1-2-2023-10-07",
+            "PQ-TLS-1-2-2023-10-08",
+            "PQ-TLS-1-2-2023-10-09",
+            "PQ-TLS-1-2-2023-10-10",
         };
         for (size_t i = 0; i < s2n_array_len(tls13_security_policy_strings); i++) {
             security_policy = NULL;

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_self_talk_offload_signing_test.c

@@ -55,13 +55,13 @@ static S2N_RESULT s2n_async_pkey_sign(struct s2n_cert_chain_and_key *complete_ch
 
     /* Get signature algorithm */
     s2n_tls_signature_algorithm sig_alg = 0;
-    struct s2n_signature_scheme *sig_scheme = NULL;
+    const struct s2n_signature_scheme *sig_scheme = NULL;
     if (pkey_op_conn->mode == S2N_CLIENT) {
         RESULT_GUARD_POSIX(s2n_connection_get_selected_client_cert_signature_algorithm(pkey_op_conn, &sig_alg));
-        sig_scheme = &pkey_op_conn->handshake_params.client_cert_sig_scheme;
+        sig_scheme = pkey_op_conn->handshake_params.client_cert_sig_scheme;
     } else {
         RESULT_GUARD_POSIX(s2n_connection_get_selected_signature_algorithm(pkey_op_conn, &sig_alg));
-        sig_scheme = &pkey_op_conn->handshake_params.conn_sig_scheme;
+        sig_scheme = pkey_op_conn->handshake_params.server_cert_sig_scheme;
     }
 
     /* These are our "external" / "offloaded" operations.

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_self_talk_session_resumption_test.c

@@ -176,6 +176,36 @@ static S2N_RESULT s2n_test_negotiate(struct s2n_connection *server_conn, struct
     return S2N_RESULT_OK;
 }
 
+static int s2n_wipe_psk_ke_ext(struct s2n_connection *conn, void *ctx)
+{
+    struct s2n_client_hello *client_hello = s2n_connection_get_client_hello(conn);
+    POSIX_ENSURE_REF(client_hello);
+    s2n_parsed_extension *parsed_extension = NULL;
+    POSIX_GUARD(s2n_client_hello_get_parsed_extension(TLS_EXTENSION_PSK_KEY_EXCHANGE_MODES, &client_hello->extensions, &parsed_extension));
+    POSIX_ENSURE_REF(parsed_extension);
+    POSIX_GUARD(s2n_blob_zero(&parsed_extension->extension));
+
+    return S2N_SUCCESS;
+}
+
+static int s2n_alter_psk_ke_ext(struct s2n_connection *conn, void *ctx)
+{
+    struct s2n_client_hello *client_hello = s2n_connection_get_client_hello(conn);
+    POSIX_ENSURE_REF(client_hello);
+    s2n_parsed_extension *parsed_extension = NULL;
+    POSIX_GUARD(s2n_client_hello_get_parsed_extension(TLS_EXTENSION_PSK_KEY_EXCHANGE_MODES, &client_hello->extensions, &parsed_extension));
+    POSIX_ENSURE_REF(parsed_extension);
+
+    /* Overwrite the extension so it only supports PSK_KE mode */
+    struct s2n_stuffer psk_ke_extension = { 0 };
+    POSIX_GUARD(s2n_stuffer_init(&psk_ke_extension, &parsed_extension->extension));
+    POSIX_GUARD(s2n_stuffer_skip_write(&psk_ke_extension, 1));
+    uint8_t mode = TLS_PSK_KE_MODE;
+    POSIX_GUARD(s2n_stuffer_write_bytes(&psk_ke_extension, &mode, 1));
+
+    return S2N_SUCCESS;
+}
+
 int main(int argc, char **argv)
 {
     BEGIN_TEST();
@@ -1099,6 +1129,111 @@ int main(int argc, char **argv)
         EXPECT_SUCCESS(s2n_stuffer_rewrite(&cb_session_data));
     }
 
+    /* Functional: Server in QUIC mode does not send a session ticket if psk_ke extension was not received */
+    {
+        DEFER_CLEANUP(struct s2n_connection *client_conn = s2n_connection_new(S2N_CLIENT), s2n_connection_ptr_free);
+        EXPECT_NOT_NULL(client_conn);
+
+        DEFER_CLEANUP(struct s2n_connection *server_conn = s2n_connection_new(S2N_SERVER), s2n_connection_ptr_free);
+        EXPECT_NOT_NULL(server_conn);
+
+        EXPECT_SUCCESS(s2n_connection_set_config(client_conn, tls13_client_config));
+        EXPECT_SUCCESS(s2n_connection_set_config(server_conn, server_config));
+
+        /* Enable QUIC mode */
+        EXPECT_SUCCESS(s2n_connection_enable_quic(client_conn));
+        EXPECT_SUCCESS(s2n_connection_enable_quic(server_conn));
+
+        /* Create nonblocking pipes */
+        DEFER_CLEANUP(struct s2n_stuffer input = { 0 }, s2n_stuffer_free);
+        DEFER_CLEANUP(struct s2n_stuffer output = { 0 }, s2n_stuffer_free);
+        EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&input, 0));
+        EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&output, 0));
+        EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&input, &output, server_conn));
+        EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&output, &input, client_conn));
+
+        /* Wipe psk_ke extension when it is received */
+        EXPECT_SUCCESS(s2n_config_set_client_hello_cb(server_config, s2n_wipe_psk_ke_ext, NULL));
+
+        /* Negotiate handshake */
+        EXPECT_SUCCESS(s2n_negotiate_test_server_and_client(server_conn, client_conn));
+
+        /* Server did not send a ticket since the client did not send the psk_ke extension */
+        uint16_t tickets_sent = 0;
+        EXPECT_SUCCESS(s2n_connection_get_tickets_sent(server_conn, &tickets_sent));
+        EXPECT_EQUAL(tickets_sent, 0);
+    };
+
+    /* Functional: Server in QUIC mode does not send a session ticket if psk_ke extension does not support psk_dhe_ke */
+    {
+        DEFER_CLEANUP(struct s2n_connection *client_conn = s2n_connection_new(S2N_CLIENT), s2n_connection_ptr_free);
+        EXPECT_NOT_NULL(client_conn);
+
+        DEFER_CLEANUP(struct s2n_connection *server_conn = s2n_connection_new(S2N_SERVER), s2n_connection_ptr_free);
+        EXPECT_NOT_NULL(server_conn);
+
+        EXPECT_SUCCESS(s2n_connection_set_config(client_conn, tls13_client_config));
+        EXPECT_SUCCESS(s2n_connection_set_config(server_conn, server_config));
+
+        /* Enable QUIC mode */
+        EXPECT_SUCCESS(s2n_connection_enable_quic(client_conn));
+        EXPECT_SUCCESS(s2n_connection_enable_quic(server_conn));
+
+        /* Create nonblocking pipes */
+        DEFER_CLEANUP(struct s2n_stuffer input = { 0 }, s2n_stuffer_free);
+        DEFER_CLEANUP(struct s2n_stuffer output = { 0 }, s2n_stuffer_free);
+        EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&input, 0));
+        EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&output, 0));
+        EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&input, &output, server_conn));
+        EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&output, &input, client_conn));
+
+        /* Alter psk_ke extension when it is received so that it only supports psk_ke mode */
+        EXPECT_SUCCESS(s2n_config_set_client_hello_cb(server_config, s2n_alter_psk_ke_ext, NULL));
+
+        /* Negotiate handshake */
+        EXPECT_SUCCESS(s2n_negotiate_test_server_and_client(server_conn, client_conn));
+
+        /* Server did not send a ticket since the client does not support psk_dhe_ke mode */
+        uint16_t tickets_sent = 0;
+        EXPECT_SUCCESS(s2n_connection_get_tickets_sent(server_conn, &tickets_sent));
+        EXPECT_EQUAL(tickets_sent, 0);
+    };
+
+    /* Functional: Server in QUIC mode sends a session ticket if the client indicates it supports psk_dhe_ke mode */
+    {
+        DEFER_CLEANUP(struct s2n_connection *client_conn = s2n_connection_new(S2N_CLIENT), s2n_connection_ptr_free);
+        EXPECT_NOT_NULL(client_conn);
+
+        DEFER_CLEANUP(struct s2n_connection *server_conn = s2n_connection_new(S2N_SERVER), s2n_connection_ptr_free);
+        EXPECT_NOT_NULL(server_conn);
+
+        EXPECT_SUCCESS(s2n_connection_set_config(client_conn, tls13_client_config));
+        EXPECT_SUCCESS(s2n_connection_set_config(server_conn, server_config));
+
+        /* Enable QUIC mode */
+        EXPECT_SUCCESS(s2n_connection_enable_quic(client_conn));
+        EXPECT_SUCCESS(s2n_connection_enable_quic(server_conn));
+
+        /* Create nonblocking pipes */
+        DEFER_CLEANUP(struct s2n_stuffer input = { 0 }, s2n_stuffer_free);
+        DEFER_CLEANUP(struct s2n_stuffer output = { 0 }, s2n_stuffer_free);
+        EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&input, 0));
+        EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&output, 0));
+        EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&input, &output, server_conn));
+        EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&output, &input, client_conn));
+
+        /* Disable any client hello cb changes */
+        EXPECT_SUCCESS(s2n_config_set_client_hello_cb(server_config, NULL, NULL));
+
+        /* Negotiate handshake */
+        EXPECT_SUCCESS(s2n_negotiate_test_server_and_client(server_conn, client_conn));
+
+        /* Server sent one ticket since the client by default indicates it supports psk_dhe_ke mode */
+        uint16_t tickets_sent = 0;
+        EXPECT_SUCCESS(s2n_connection_get_tickets_sent(server_conn, &tickets_sent));
+        EXPECT_EQUAL(tickets_sent, 1);
+    };
+
     /* Clean-up */
     EXPECT_SUCCESS(s2n_config_free(server_config));
     EXPECT_SUCCESS(s2n_config_free(tls12_server_config));

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_server_new_session_ticket_test.c

@@ -911,6 +911,38 @@ int main(int argc, char **argv)
             EXPECT_SUCCESS(s2n_config_free(config));
         };
 
+        /* QUIC mode is enabled */
+        {
+            DEFER_CLEANUP(struct s2n_config *config = s2n_config_new(),
+                    s2n_config_ptr_free);
+            EXPECT_NOT_NULL(config);
+            EXPECT_SUCCESS(s2n_setup_test_ticket_key(config));
+
+            DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_SERVER),
+                    s2n_connection_ptr_free);
+            EXPECT_NOT_NULL(conn);
+            EXPECT_SUCCESS(s2n_connection_set_config(conn, config));
+            conn->secure->cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
+            conn->tickets_to_send = 1;
+            conn->actual_protocol_version = S2N_TLS13;
+
+            DEFER_CLEANUP(struct s2n_stuffer stuffer = { 0 }, s2n_stuffer_free);
+            EXPECT_SUCCESS(s2n_stuffer_growable_alloc(&stuffer, 0));
+            EXPECT_SUCCESS(s2n_connection_set_io_stuffers(&stuffer, &stuffer, conn));
+
+            s2n_blocked_status blocked = 0;
+
+            conn->quic_enabled = true;
+            /* No mutually-supported psk mode agreed upon */
+            EXPECT_OK(s2n_tls13_server_nst_send(conn, &blocked));
+            EXPECT_TICKETS_SENT(conn, 0);
+
+            /* Client has indicated that it supports both resumption and psk_dhe_ke mode */
+            conn->psk_params.psk_ke_mode = S2N_PSK_DHE_KE;
+            EXPECT_OK(s2n_tls13_server_nst_send(conn, &blocked));
+            EXPECT_TICKETS_SENT(conn, 1);
+        };
+
         /* Sends one new session ticket */
         {
             struct s2n_config *config;

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_server_signature_algorithms_extension_test.c

@@ -44,7 +44,7 @@ int main(int argc, char **argv)
         EXPECT_SUCCESS(s2n_server_signature_algorithms_extension.recv(client_conn, &io));
         EXPECT_EQUAL(s2n_stuffer_data_available(&io), 0);
 
-        EXPECT_EQUAL(client_conn->handshake_params.server_sig_hash_algs.len, s2n_supported_sig_schemes_count(server_conn));
+        EXPECT_TRUE(client_conn->handshake_params.server_sig_hash_algs.len > 0);
 
         s2n_stuffer_free(&io);
         EXPECT_SUCCESS(s2n_connection_free(server_conn));