1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
// SPDX-FileCopyrightText: 2023 The Pion community <https://pion.ly>
// SPDX-License-Identifier: MIT
package dtls
import (
"context"
"math/rand"
"testing"
"time"
"github.com/pion/dtls/v3/pkg/crypto/elliptic"
dtlsnet "github.com/pion/dtls/v3/pkg/net"
"github.com/pion/dtls/v3/pkg/protocol/extension"
"github.com/pion/dtls/v3/pkg/protocol/handshake"
"github.com/pion/dtls/v3/pkg/protocol/recordlayer"
"github.com/pion/transport/v3/dpipe"
"github.com/pion/transport/v3/test"
"github.com/stretchr/testify/assert"
)
// Assert that SupportedEllipticCurves is only sent when a ECC CipherSuite is available.
func TestSupportedEllipticCurves(t *testing.T) {
// Limit runtime in case of deadlocks
lim := test.TimeOut(time.Second * 20)
defer lim.Stop()
// Check for leaking routines
report := test.CheckRoutines(t)
defer report()
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
expectedCurves := defaultCurves
var actualCurves []elliptic.Curve
rand.Shuffle(len(expectedCurves), func(i, j int) {
expectedCurves[i], expectedCurves[j] = expectedCurves[j], expectedCurves[i]
})
clientErr := make(chan error, 1)
ca, cb := dpipe.Pipe()
caAnalyzer := &connWithCallback{Conn: ca}
caAnalyzer.onWrite = func(in []byte) {
messages, err := recordlayer.UnpackDatagram(in)
assert.NoError(t, err)
for i := range messages {
h := &handshake.Handshake{}
_ = h.Unmarshal(messages[i][recordlayer.FixedHeaderSize:])
if h.Header.Type == handshake.TypeClientHello { //nolint:nestif
clientHello := &handshake.MessageClientHello{}
msg, err := h.Message.Marshal()
assert.NoError(t, err)
assert.NoError(t, clientHello.Unmarshal(msg))
for _, e := range clientHello.Extensions {
if e.TypeValue() == extension.SupportedEllipticCurvesTypeValue {
if c, ok := e.(*extension.SupportedEllipticCurves); ok {
actualCurves = c.EllipticCurves
}
}
}
}
}
}
go func() {
conf := &Config{
CipherSuites: []CipherSuiteID{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
EllipticCurves: expectedCurves,
}
if client, err := testClient(
ctx,
dtlsnet.PacketConnFromConn(caAnalyzer),
caAnalyzer.RemoteAddr(),
conf,
false,
); err != nil {
clientErr <- err
} else {
clientErr <- client.Close() // nolint:errcheck,contextcheck
}
}()
config := &Config{
CipherSuites: []CipherSuiteID{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
}
server, err := testServer(ctx, dtlsnet.PacketConnFromConn(cb), cb.RemoteAddr(), config, true)
assert.NoError(t, err)
assert.NoError(t, server.Close())
assert.NoError(t, <-clientErr)
for i := range expectedCurves {
assert.Equal(t, expectedCurves[i], actualCurves[i], "curves in SupportedEllipticCurves mismatch")
}
}
|
