TESTS: quic: add HKDF unit tests using RFC 5869 vectors

Check HKDF-Extract, HKDF-Expand and their combined operation against
the SHA-256 test vectors from RFC 5869, appendix A, cases 1 and 3.

Cover both populated and empty salt/info inputs, repeating case 1
after case 3 to check that successive calls remain independent.

Register the test as "quic_hkdf" and add it to the QUIC unit test runner.

diff --git a/src/quic_tls.c b/src/quic_tls.c
index 47721ee47a388ca0f28a816ad76ed7d55866e4e2..0838ffa6bbd9f03f7aaf68c22a2d9935b421bf0b 100644 (file)
--- a/src/quic_tls.c
+++ b/src/quic_tls.c
@@ -1360,3 +1360,93 @@ int quic_tls_finalize(struct quic_conn *qc, int server)
        quic_tls_ctx_free(&qc->nictx);
        goto out;
 }
+
+#ifdef DEBUG_UNIT
+/* RFC 5869 cases 1 and 3, then case 1 again. Check extract, expand and
+ * combined operations with non-empty and empty salt/info.
+ */
+static int quic_hkdf_unittest(int argc, char **argv)
+{
+       enum {
+               HKDF_TEST_SALTED,
+               HKDF_TEST_EMPTY_SALT_AND_INFO,
+               HKDF_TEST_MAX,
+       };
+       const struct {
+               unsigned char prk[32];
+               unsigned char okm[42];
+       } vectors[HKDF_TEST_MAX] = {
+               [HKDF_TEST_SALTED] = {
+                       .prk = {
+                               0x07, 0x77, 0x09, 0x36, 0x2c, 0x2e, 0x32, 0xdf,
+                               0x0d, 0xdc, 0x3f, 0x0d, 0xc4, 0x7b, 0xba, 0x63,
+                               0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
+                               0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5,
+                       },
+                       .okm = {
+                               0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a,
+                               0x90, 0x43, 0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a,
+                               0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a, 0x5a, 0x4c,
+                               0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf,
+                               0x34, 0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18,
+                               0x58, 0x65,
+                       },
+               },
+               [HKDF_TEST_EMPTY_SALT_AND_INFO] = {
+                       .prk = {
+                               0x19, 0xef, 0x24, 0xa3, 0x2c, 0x71, 0x7b, 0x16,
+                               0x7f, 0x33, 0xa9, 0x1d, 0x6f, 0x64, 0x8b, 0xdf,
+                               0x96, 0x59, 0x67, 0x76, 0xaf, 0xdb, 0x63, 0x77,
+                               0xac, 0x43, 0x4c, 0x1c, 0x29, 0x3c, 0xcb, 0x04,
+                       },
+                       .okm = {
+                               0x8d, 0xa4, 0xe7, 0x75, 0xa5, 0x63, 0xc1, 0x8f,
+                               0x71, 0x5f, 0x80, 0x2a, 0x06, 0x3c, 0x5a, 0x31,
+                               0xb8, 0xa1, 0x1f, 0x5c, 0x5e, 0xe1, 0x87, 0x9e,
+                               0xc3, 0x45, 0x4e, 0x5f, 0x3c, 0x73, 0x8d, 0x2d,
+                               0x9d, 0x20, 0x13, 0x95, 0xfa, 0xa4, 0xb6, 0x1a,
+                               0x96, 0xc8,
+                       },
+               },
+       };
+       const unsigned int sequence[] = {
+               HKDF_TEST_SALTED, HKDF_TEST_EMPTY_SALT_AND_INFO, HKDF_TEST_SALTED,
+       };
+       unsigned char key[22], salt[13], info[10], out[42];
+       unsigned int i, test;
+       int empty;
+
+       memset(key, 0x0b, sizeof(key));
+       for (i = 0; i < sizeof(salt); i++)
+               salt[i] = i;
+       for (i = 0; i < sizeof(info); i++)
+               info[i] = 0xf0 + i;
+
+       for (i = 0; i < sizeof(sequence) / sizeof(sequence[0]); i++) {
+               test = sequence[i];
+               empty = test == HKDF_TEST_EMPTY_SALT_AND_INFO;
+
+               if (!quic_hkdf_extract(EVP_sha256(), out, sizeof(vectors[test].prk),
+                                      key, sizeof(key),
+                                      empty ? NULL : salt, empty ? 0 : sizeof(salt)) ||
+                   memcmp(out, vectors[test].prk, sizeof(vectors[test].prk)))
+                       return 1;
+
+               if (!quic_hkdf_expand(EVP_sha256(), out, sizeof(out),
+                                     vectors[test].prk, sizeof(vectors[test].prk),
+                                     empty ? NULL : info, empty ? 0 : sizeof(info)) ||
+                   memcmp(out, vectors[test].okm, sizeof(out)))
+                       return 1;
+
+               if (!quic_hkdf_extract_and_expand(EVP_sha256(), out, sizeof(out),
+                                                 key, sizeof(key),
+                                                 empty ? NULL : salt, empty ? 0 : sizeof(salt),
+                                                 empty ? NULL : info, empty ? 0 : sizeof(info)) ||
+                   memcmp(out, vectors[test].okm, sizeof(out)))
+                       return 1;
+       }
+
+       return 0;
+}
+REGISTER_UNITTEST("quic_hkdf", quic_hkdf_unittest);
+#endif

diff --git a/tests/unit/quic/quic.sh b/tests/unit/quic/quic.sh
index e9f05c6883e06cebe367bb52ad521a371e97dd98..cf502add3088201409cf9af4d8a2a59532c0eb62 100755 (executable)
--- a/tests/unit/quic/quic.sh
+++ b/tests/unit/quic/quic.sh
@@ -7,6 +7,7 @@ check() {
 run() {
        ${HAPROXY_PROGRAM} -U quic_enc
        ${HAPROXY_PROGRAM} -U quic_tx
+       ${HAPROXY_PROGRAM} -U quic_hkdf
 }
 
 case "$1" in