secmemtest.c (1.1.1.3) | secmemtest.c (1.1.1.1) |
---|---|
1/* | 1/* |
2 * Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved. | 2 * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. |
3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 | 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 |
10#include <stdio.h> |
|
10#include <openssl/crypto.h> 11 | 11#include <openssl/crypto.h> 12 |
12#include "testutil.h" 13#include "../e_os.h" | 13#define perror_line() perror_line1(__LINE__) 14#define perror_line1(l) perror_line2(l) 15#define perror_line2(l) perror("failed " #l) |
14 | 16 |
15static int test_sec_mem(void) | 17int main(int argc, char **argv) |
16{ | 18{ |
17#ifdef OPENSSL_SECURE_MEMORY 18 int testresult = 0; | 19#if defined(OPENSSL_SYS_LINUX) || defined(OPENSSL_SYS_UNIX) |
19 char *p = NULL, *q = NULL, *r = NULL, *s = NULL; 20 | 20 char *p = NULL, *q = NULL, *r = NULL, *s = NULL; 21 |
21 TEST_info("Secure memory is implemented."); 22 | |
23 s = OPENSSL_secure_malloc(20); 24 /* s = non-secure 20 */ | 22 s = OPENSSL_secure_malloc(20); 23 /* s = non-secure 20 */ |
25 if (!TEST_ptr(s) 26 || !TEST_false(CRYPTO_secure_allocated(s))) 27 goto end; | 24 if (s == NULL) { 25 perror_line(); 26 return 1; 27 } 28 if (CRYPTO_secure_allocated(s)) { 29 perror_line(); 30 return 1; 31 } |
28 r = OPENSSL_secure_malloc(20); 29 /* r = non-secure 20, s = non-secure 20 */ | 32 r = OPENSSL_secure_malloc(20); 33 /* r = non-secure 20, s = non-secure 20 */ |
30 if (!TEST_ptr(r) 31 || !TEST_true(CRYPTO_secure_malloc_init(4096, 32)) 32 || !TEST_false(CRYPTO_secure_allocated(r))) 33 goto end; | 34 if (r == NULL) { 35 perror_line(); 36 return 1; 37 } 38 if (!CRYPTO_secure_malloc_init(4096, 32)) { 39 perror_line(); 40 return 1; 41 } 42 if (CRYPTO_secure_allocated(r)) { 43 perror_line(); 44 return 1; 45 } |
34 p = OPENSSL_secure_malloc(20); | 46 p = OPENSSL_secure_malloc(20); |
35 if (!TEST_ptr(p) 36 /* r = non-secure 20, p = secure 20, s = non-secure 20 */ 37 || !TEST_true(CRYPTO_secure_allocated(p)) 38 /* 20 secure -> 32-byte minimum allocation unit */ 39 || !TEST_size_t_eq(CRYPTO_secure_used(), 32)) 40 goto end; | 47 /* r = non-secure 20, p = secure 20, s = non-secure 20 */ 48 if (!CRYPTO_secure_allocated(p)) { 49 perror_line(); 50 return 1; 51 } 52 /* 20 secure -> 32-byte minimum allocaton unit */ 53 if (CRYPTO_secure_used() != 32) { 54 perror_line(); 55 return 1; 56 } |
41 q = OPENSSL_malloc(20); | 57 q = OPENSSL_malloc(20); |
42 if (!TEST_ptr(q)) 43 goto end; | |
44 /* r = non-secure 20, p = secure 20, q = non-secure 20, s = non-secure 20 */ | 58 /* r = non-secure 20, p = secure 20, q = non-secure 20, s = non-secure 20 */ |
45 if (!TEST_false(CRYPTO_secure_allocated(q))) 46 goto end; | 59 if (CRYPTO_secure_allocated(q)) { 60 perror_line(); 61 return 1; 62 } |
47 OPENSSL_secure_clear_free(s, 20); 48 s = OPENSSL_secure_malloc(20); | 63 OPENSSL_secure_clear_free(s, 20); 64 s = OPENSSL_secure_malloc(20); |
49 if (!TEST_ptr(s) 50 /* r = non-secure 20, p = secure 20, q = non-secure 20, s = secure 20 */ 51 || !TEST_true(CRYPTO_secure_allocated(s)) 52 /* 2 * 20 secure -> 64 bytes allocated */ 53 || !TEST_size_t_eq(CRYPTO_secure_used(), 64)) 54 goto end; | 65 /* r = non-secure 20, p = secure 20, q = non-secure 20, s = secure 20 */ 66 if (!CRYPTO_secure_allocated(s)) { 67 perror_line(); 68 return 1; 69 } 70 /* 2 * 20 secure -> 64 bytes allocated */ 71 if (CRYPTO_secure_used() != 64) { 72 perror_line(); 73 return 1; 74 } |
55 OPENSSL_secure_clear_free(p, 20); | 75 OPENSSL_secure_clear_free(p, 20); |
56 p = NULL; | |
57 /* 20 secure -> 32 bytes allocated */ | 76 /* 20 secure -> 32 bytes allocated */ |
58 if (!TEST_size_t_eq(CRYPTO_secure_used(), 32)) 59 goto end; | 77 if (CRYPTO_secure_used() != 32) { 78 perror_line(); 79 return 1; 80 } |
60 OPENSSL_free(q); | 81 OPENSSL_free(q); |
61 q = NULL; | |
62 /* should not complete, as secure memory is still allocated */ | 82 /* should not complete, as secure memory is still allocated */ |
63 if (!TEST_false(CRYPTO_secure_malloc_done()) 64 || !TEST_true(CRYPTO_secure_malloc_initialized())) 65 goto end; | 83 if (CRYPTO_secure_malloc_done()) { 84 perror_line(); 85 return 1; 86 } 87 if (!CRYPTO_secure_malloc_initialized()) { 88 perror_line(); 89 return 1; 90 } |
66 OPENSSL_secure_free(s); | 91 OPENSSL_secure_free(s); |
67 s = NULL; | |
68 /* secure memory should now be 0, so done should complete */ | 92 /* secure memory should now be 0, so done should complete */ |
69 if (!TEST_size_t_eq(CRYPTO_secure_used(), 0) 70 || !TEST_true(CRYPTO_secure_malloc_done()) 71 || !TEST_false(CRYPTO_secure_malloc_initialized())) 72 goto end; | 93 if (CRYPTO_secure_used() != 0) { 94 perror_line(); 95 return 1; 96 } 97 if (!CRYPTO_secure_malloc_done()) { 98 perror_line(); 99 return 1; 100 } 101 if (CRYPTO_secure_malloc_initialized()) { 102 perror_line(); 103 return 1; 104 } |
73 | 105 |
74 TEST_info("Possible infinite loop: allocate more than available"); 75 if (!TEST_true(CRYPTO_secure_malloc_init(32768, 16))) 76 goto end; 77 TEST_ptr_null(OPENSSL_secure_malloc((size_t)-1)); 78 TEST_true(CRYPTO_secure_malloc_done()); | 106 fprintf(stderr, "Possible infinite loop: allocate more than available\n"); 107 if (!CRYPTO_secure_malloc_init(32768, 16)) { 108 perror_line(); 109 return 1; 110 } 111 if (OPENSSL_secure_malloc((size_t)-1) != NULL) { 112 perror_line(); 113 return 1; 114 } 115 if (!CRYPTO_secure_malloc_done()) { 116 perror_line(); 117 return 1; 118 } |
79 80 /* 81 * If init fails, then initialized should be false, if not, this 82 * could cause an infinite loop secure_malloc, but we don't test it 83 */ | 119 120 /* 121 * If init fails, then initialized should be false, if not, this 122 * could cause an infinite loop secure_malloc, but we don't test it 123 */ |
84 if (TEST_false(CRYPTO_secure_malloc_init(16, 16)) && 85 !TEST_false(CRYPTO_secure_malloc_initialized())) { 86 TEST_true(CRYPTO_secure_malloc_done()); 87 goto end; | 124 if (!CRYPTO_secure_malloc_init(16, 16) && 125 CRYPTO_secure_malloc_initialized()) { 126 CRYPTO_secure_malloc_done(); 127 perror_line(); 128 return 1; |
88 } 89 90 /*- 91 * There was also a possible infinite loop when the number of 92 * elements was 1<<31, as |int i| was set to that, which is a 93 * negative number. However, it requires minimum input values: 94 * 95 * CRYPTO_secure_malloc_init((size_t)1<<34, (size_t)1<<4); --- 11 unchanged lines hidden (view full) --- 107 /*- 108 * On Linux and BSD this test has a chance to complete in minimal 109 * time and with minimum side effects, because mlock is likely to 110 * fail because of RLIMIT_MEMLOCK, which is customarily [much] 111 * smaller than 16GB. In other words Linux and BSD users can be 112 * limited by virtual space alone... 113 */ 114 if (sizeof(size_t) > 4) { | 129 } 130 131 /*- 132 * There was also a possible infinite loop when the number of 133 * elements was 1<<31, as |int i| was set to that, which is a 134 * negative number. However, it requires minimum input values: 135 * 136 * CRYPTO_secure_malloc_init((size_t)1<<34, (size_t)1<<4); --- 11 unchanged lines hidden (view full) --- 148 /*- 149 * On Linux and BSD this test has a chance to complete in minimal 150 * time and with minimum side effects, because mlock is likely to 151 * fail because of RLIMIT_MEMLOCK, which is customarily [much] 152 * smaller than 16GB. In other words Linux and BSD users can be 153 * limited by virtual space alone... 154 */ 155 if (sizeof(size_t) > 4) { |
115 TEST_info("Possible infinite loop: 1<<31 limit"); 116 if (TEST_true(CRYPTO_secure_malloc_init((size_t)1<<34, (size_t)1<<4) != 0)) 117 TEST_true(CRYPTO_secure_malloc_done()); | 156 fprintf(stderr, "Possible infinite loop: 1<<31 limit\n"); 157 if (CRYPTO_secure_malloc_init((size_t)1<<34, (size_t)1<<4) == 0) { 158 perror_line(); 159 } else if (!CRYPTO_secure_malloc_done()) { 160 perror_line(); 161 return 1; 162 } |
118 } 119# endif 120 121 /* this can complete - it was not really secure */ | 163 } 164# endif 165 166 /* this can complete - it was not really secure */ |
122 testresult = 1; 123 end: 124 OPENSSL_secure_free(p); 125 OPENSSL_free(q); | |
126 OPENSSL_secure_free(r); | 167 OPENSSL_secure_free(r); |
127 OPENSSL_secure_free(s); 128 return testresult; | |
129#else | 168#else |
130 TEST_info("Secure memory is *not* implemented."); | |
131 /* Should fail. */ | 169 /* Should fail. */ |
132 return TEST_false(CRYPTO_secure_malloc_init(4096, 32)); | 170 if (CRYPTO_secure_malloc_init(4096, 32)) { 171 perror_line(); 172 return 1; 173 } |
133#endif | 174#endif |
175 return 0; |
|
134} | 176} |
135 136static int test_sec_mem_clear(void) 137{ 138#ifdef OPENSSL_SECURE_MEMORY 139 const int size = 64; 140 unsigned char *p = NULL; 141 int i, res = 0; 142 143 if (!TEST_true(CRYPTO_secure_malloc_init(4096, 32)) 144 || !TEST_ptr(p = OPENSSL_secure_malloc(size))) 145 goto err; 146 147 for (i = 0; i < size; i++) 148 if (!TEST_uchar_eq(p[i], 0)) 149 goto err; 150 151 for (i = 0; i < size; i++) 152 p[i] = (unsigned char)(i + ' ' + 1); 153 154 OPENSSL_secure_free(p); 155 156 /* 157 * A deliberate use after free here to verify that the memory has been 158 * cleared properly. Since secure free doesn't return the memory to 159 * libc's memory pool, it technically isn't freed. However, the header 160 * bytes have to be skipped and these consist of two pointers in the 161 * current implementation. 162 */ 163 for (i = sizeof(void *) * 2; i < size; i++) 164 if (!TEST_uchar_eq(p[i], 0)) 165 return 0; 166 167 res = 1; 168 p = NULL; 169err: 170 OPENSSL_secure_free(p); 171 CRYPTO_secure_malloc_done(); 172 return res; 173#else 174 return 1; 175#endif 176} 177 178int setup_tests(void) 179{ 180 ADD_TEST(test_sec_mem); 181 ADD_TEST(test_sec_mem_clear); 182 return 1; 183} | |