Skip to content

Commit 0082fc8

Browse files
committed
test/psk: add compat vector for OpenSSL < 3.2
OpenSSL versions earlier than 3.2 have a bug where EVP_PKEY_CTX_add1_hkdf_info() will always overwrite the existing 'info' value, and thus calculate a different identity hash. This issue has been uncovered by the PSK testcases, and has always been present. We have fixed this with eff0ffe ("linux: fix HKDF TLS key derivation back to OpenSSL 3.0.8"), but the PSK testcases will still fail. So add the resulting hash values for the 'compat' test, and select the correct test vector based on the OpenSSL version. Signed-off-by: Hannes Reinecke <[email protected]>
1 parent 0bf294e commit 0082fc8

1 file changed

Lines changed: 39 additions & 0 deletions

File tree

test/psk.c

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99
#include <stdlib.h>
1010
#include <errno.h>
1111

12+
#include <openssl/opensslv.h>
13+
1214
#include <ccan/array_size/array_size.h>
1315

1416
#include <libnvme.h>
@@ -99,6 +101,42 @@ static struct test_data_identity test_data_identity[] = {
99101
"NVMe1R02 nqn.psk-test-host nqn.psk-test-subsys QhW2+Rp6RzHlNtCslyRxMnwJ11tKKhz8JCAQpQ+XUD8f9td1VeH5h53yz2wKJG1a" },
100102
};
101103

104+
/*
105+
* OpenSSL prior to 3.2 has a bug where
106+
* EVP_PKEY_CTX_add1_hkdf_info() will always overwrite
107+
* existing 'info' string. So add the resulting 'compat'
108+
* identity hash vector here to make the tests succeed.
109+
*/
110+
#ifdef OPENSSL_VERSION_MINOR <= 1
111+
static struct test_data_identity test_data_identity_compat[] = {
112+
{ { 0x55, 0x12, 0xDB, 0xB6,
113+
0x73, 0x7D, 0x01, 0x06,
114+
0xF6, 0x59, 0x75, 0xB7,
115+
0x73, 0xDF, 0xB0, 0x11,
116+
0xFF, 0xC3, 0x44, 0xBC,
117+
0xF4, 0x42, 0xE2, 0xDD,
118+
0x6D, 0x8B, 0xC4, 0x87,
119+
0x0B, 0x5D, 0x5B, 0x03},
120+
32, 1, NVME_HMAC_ALG_SHA2_256,
121+
"nqn.psk-test-host", "nqn.psk-test-subsys",
122+
"NVMe1R01 nqn.psk-test-host nqn.psk-test-subsys mJUDthe4jhFVFSnaBaydV/EHJK6OvIuw8xap5IkTnG0=" },
123+
{ { 0x55, 0x12, 0xDB, 0xB6,
124+
0x73, 0x7D, 0x01, 0x06,
125+
0xF6, 0x59, 0x75, 0xB7,
126+
0x73, 0xDF, 0xB0, 0x11,
127+
0xFF, 0xC3, 0x44, 0xBC,
128+
0xF4, 0x42, 0xE2, 0xDD,
129+
0x6D, 0x8B, 0xC4, 0x87,
130+
0x0B, 0x5D, 0x5B, 0x03,
131+
0xFF, 0xC3, 0x44, 0xBC,
132+
0xF4, 0x42, 0xE2, 0xDD,
133+
0x6D, 0x8B, 0xC4, 0x87,
134+
0x0B, 0x5D, 0x5B, 0x03},
135+
48, 1, NVME_HMAC_ALG_SHA2_384,
136+
"nqn.psk-test-host", "nqn.psk-test-subsys",
137+
"NVMe1R02 nqn.psk-test-host nqn.psk-test-subsys J6B5sIVRCNLtZutDfmNnfPeqOFbnewwc8KEkhcOcO0dAWfdJYe/DrMyIC7znu00M" },
138+
};
139+
#else
102140
static struct test_data_identity test_data_identity_compat[] = {
103141
{ { 0x55, 0x12, 0xDB, 0xB6,
104142
0x73, 0x7D, 0x01, 0x06,
@@ -127,6 +165,7 @@ static struct test_data_identity test_data_identity_compat[] = {
127165
"nqn.psk-test-host", "nqn.psk-test-subsys",
128166
"NVMe1R02 nqn.psk-test-host nqn.psk-test-subsys RsKmYJ3nAn1ApjjMloJFbAkLPivONDAX/xW327YBUsn2eGShXSjCZvBaOxscLqmz" },
129167
};
168+
#endif
130169

131170
static void check_str(const char *exp, const char *res)
132171
{

0 commit comments

Comments
 (0)