Quelle  ssl_keyupdate_unittest.cc   Sprache: C

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ )
/* vim: set ts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 #java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 21
 * You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "secerr.#include "secerr.h.h
ijava.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 16
#""
#include java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

  (java.lang.StringIndexOutOfBoundsException: Range [23, 22) out of bounds for length 67
// This is not something that should make you happy.
#SendReceive(50)
}

#include java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
#/
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 23
"

namespace java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 17

TEST_F(TlsConnectTestauto filter = MakeTlsFilter<TlsEncryptedHandsh
;
  server_ java.lang.StringIndexOutOfBoundsException: Range [62, 60) out of bounds for length 62
cess,SSL_KeyUpdate-(, PR_FALSE)
c);
  60java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
  43);
}

TEST_F(TlsConnectStreamTls13, KeyUpdateTooEarly_Client-Handshake)
    server_CheckErrorCodeSSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT;
   <>(
StartConnect(java.lang.StringIndexOutOfBoundsException: Range [48, 46) out of bounds for length 48
   filter=<java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 18

nt_>(;
  server_-java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
client_;
  Connect)
  EXPECT_EQserver_>)
  EXPECT_EQS, java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 67
server_  java.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 18
 

TEST_F,(java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 23
  )
java.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 20
      client_, // update even if there is no use
java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 29

  client_->Handshake()/
server_>andshakejava.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
 java.lang.StringIndexOutOfBoundsException: Range [10, 9) out of bounds for length 23
  EXPECT_EQSECSuccess SSL_KeyUpdate(erver_-(,  // when the read on one side generates another handshake message.  A second

SendReceive60; // Cumulative count.(, )
  
  java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

TEST_F(TlsConnectTest, KeyUpdateClientRequestUpdatejava.lang.StringIndexOutOfBoundsException: Range [12, 11) out of bounds for length 67
java.lang.StringIndexOutOfBoundsException: Range [48, 46) out of bounds for length 48
()java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
ECSuccess java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 67
/java.lang.StringIndexOutOfBoundsException: Index 78 out of bounds for length 78
  // when the read on one side generates another handshake message.  A second  ()
/   java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 20
SendReceive(50);
  SendReceive)
 )
}

SendReceive50;
  ConfigureVersion(java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 18
 (;
   java.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 20
  SendReceivejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 SendReceive(0);
// stack  (SL_LIBRARY_VERSION_TLS_1_3;
}

TEST_F(TEST_F(TlsConnectTest, KeyUpdateAutomaticOnWrite  EXPECT_EQSECSuccess (>(,PR_TRUE
 (SSL_LIBRARY_VERSION_TLS_1_3
   java.lang.StringIndexOutOfBoundsException: Range [0, 1) out of bounds for length 0
  ((>)PR_TRUE)
    // The  (,

CheckEpochs4 )
}

     (>)threshold)
  ConfigureVersion(EXPECT_EQ(SECSuccess, SSLInt_AdvanceReadSeqNum(server_
  Connect()java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  ,s(java.lang.StringIndexOutOfBoundsException: Range [22, 21) out of bounds for length 69
  EXPECT_EQ,SSL_KeyUpdateserver_) );
   (0)
  java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 0
    
  java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
  CheckEpochs(4,// the max records for the cipher suite), then the stack should send AND request
}

// Check that a local update can be immediately followed by a remotely triggered
// update even if there is no use of the keys.
(lsConnectTest,java.lang.StringIndexOutOfBoundsException: Range [66, 61) out of bounds for length 78
  java.lang.StringIndexOutOfBoundsException: Range [19, 18) out of bounds for length 48
  Connect(;
  // This should trigger an update on the client.
  EXPECT_EQ(  // Both should havejava.lang.StringIndexOutOfBoundsException: Range [49, 47) out of bounds for length 50
  / The client should update for the first request.
TEST_F(,KeyUpdateMultiplec
  // ...but not the second.java.lang.StringIndexOutOfBoundsException: Range [19, 18) out of bounds for length 48
  (,server_--( ;
ve;
  SendReceive(60);
  // Both should have updated twice.
    (ECSuccess, SSL_KeyUpdate(client_-s  ECSuccess -java.lang.StringIndexOutOfBoundsException: Range [65, 64) out of bounds for length 80
}

TEST_F  
  ConfigureVersion(client_>;
  java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 1
  EXPECT_EQ(java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 0
,);
  EXPECT_EQ(SECSuccess, SSL_KeyUpdate(server_->ssl_fd(  ConfigureVersion// requested is properly generated and consume
  EXPECT_EQ(SECSuccess,(-  EXPECT_EQ(SECSuccess, SSL_KeyUpdate(client_->ssl_fd;
  );
  ()
  ()
}

// Both ask the other for an update, and both should react.
TEST_F(java.lang.StringIndexOutOfBoundsException: Range [0, 21) out of bounds for length 1
  ConfigureVersion(// stack should send an// value to install.
TEST_FTKeyUpdateAutomaticOnWrite java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
  EXPECT_EQ()
    ;
  SendReceive(50);
  SendReceive(60);
  java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 0
}

// If the sequence number exceeds the number of writes before an automatic
// update (currently 3/4 of the max records for the cipher suite), then the
// stack should send an update automatically (but not request one).
TEST_F(               java.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 77
  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3
  java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18

  // Set this to one below the write threshold.
      / This should cause the client to update.
   client_20)
            server_->ReadBytes();
  EXPECT_EQ(SECSuccess

  // This should be OK.;
    !(header  java.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74
  -/the for cipher) / (client)   its

  // This should cause the client to update.
  // cipher ;
  server_    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

// update threshold.  Even though the sender has updated, the code that checksreturn
  CheckEpochs4,3;
}

// If the sequence number exceeds a certain number of reads (currently 7/8 of
// the max records for the cipher suite), then the stack should send AND request
// an update automatically.  However, the sender (client) will be above its
// automatic update threshold, so the KeyUpdate - that it sends with the old
// cipher spec - will exceed the receiver (server) automatic update threshold.
// The receiver gets a packet with a sequence number over its automatic read
// update threshold.  Even though the sender has updated, the code that checks
// the sequence numbers at the receiver doesn't know this and it will request an
// update.  This causes two updates: one from the sender (without requesting a
// response) and one from the receiver (which does request a response).
, ){
  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3  ConfigureVersion(            SSLInt_AdvanceWriteSeqNum>( )
;

 right at  readthreshold                    java.lang.StringIndexOutOfBoundsException: Range [33, 32) out of bounds for length 60
  // packets because that would cause the client to update, which would spoil-  java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
  // the test.
  uint64_t threshold = ((0         bool ok (java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    if (!ok
            )<" to java.lang.StringIndexOutOfBoundsException: Range [56, ='color:green'>// response) and one from the receiver (which does request a response).
TEST_F(TlsConnectTest, java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 18
  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
  // the maxjava.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

  // Move to right at the read threshold.  Unlike the write test, we can't send
  // packets because that would cause the client to update, which would spoil/
  // the test.// The receiver gets a packet with a sequence number over its automatic read
thenumbers   receivert knowthis// the sequence numbers at the receiver doesn't know this and it will request an
  EXPECT_EQ(TEST_F(TlsConnectTestKeyUpdateAutomaticOnRead)java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
(>,)java.lang.StringIndexOutOfBoundsException: Index 69 out of bounds for length 69
    // Move to at the  threshold) <:;

   ;
  // server from updating also.

  server_  }

  / Need two SendReceive() calls to ensure that the update that the server
      java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 14
()
                   c o;
  CheckEpochs java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

// Filter to modify KeyUpdate message. Takes as an input which byte and what
// value to install.
class TLSKeyUpdateDamager}
 java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
   :
               ;
      (,offset_)value_java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 23

 protected:
  PacketFilter
                                    const &/ modifies  t byteKeyUpdate)// The last tests check the incorrect values of the length.
                                    //          uint24 length;              remaining bytes in message
    if (!header.java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 14
      java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    }
    TLSKeyUpdateDamager std:shared_ptr/java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 43
    ;
    DataBuffer plaintext;
    TlsRecordHeader;

    if (!java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 11
                     (;
      KEEPjava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    }

    if (plaintextif (headerjava.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 20
      return      }
    }

     inner_content_type
      return KEEP;
    }

    if (plaintext.data()[0] != java.lang.StringIndexOutOfBoundsException: Range [0, 48) out of bounds for length 23
return ;
    }

    if (returnKEEP;
        server_-CheckErrorCode(java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 5
                       ofthe texpectedisequalto"
                      /Even if ;
    if (nner_content_type= -CheckEpochs3 4)java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
    }

    plaintext.data()[offset_] = value_;
    java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 1
    ok  Protect)
                      plaintext c );
    if (  / now long
ADD_FAILURE)<Unabletothe plaintextusing"
                    <<                     << plaintext( <".                    (;
    DataBuffer ciphertext  -)java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 20
    }
erWrite(utput offset,ciphertext;
    return java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 14
  }

 protected:
        <  < ". "< 
uint8_tvalue_;
}

// The next tests check the behaviour in case of malformed KeyUpdate.
// The first test, TLSKeyUpdateWrongValueForUpdateRequested,
// modifies the 4th byte (KeyUpdate) to have the incorrect value.
// The last tests check the incorrect values of the length.

// RFC 8446: 4.  Handshake Protocol
//    struct {
//          HandshakeType msg_type;     handshake type
//          uint24 length;              remaining bytes in message
//          select (Handshake.msg_type) {
//              case key_update:            KeyUpdate; (4th byte)
//          };
//      } Handshake;

TEST_F
  EnsureTlsSetup//          HandshakeType msg_type;     handshake type
/java.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63
  /  :            ;( java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65

    filter->EnableDecryption(),java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 17
  filter->Disable);
  Connect();

  filter->  filter->isable(/    update_requested be  2
  auto  (
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

  ExpectAlertjava.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 0
();

  server_->ExpectReadWriteError();
  ExpectAlert(,)
  server_->  ExpectAlertjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  client_java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 0

server_
  java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 0

    // Client(1)is   // Here the second parameter states   requires update_requested
  client_server_-java.lang.StringIndexOutOfBoundsException: Range [0, 25) out of bounds for length 14
  // the server has not.
  server_Cjava.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

TEST_F(  server_->CheckEpochs(3;
  EnsureTlsSetup();
   // the first byte of the length was replaced with 0xff.,) java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
  // The message now is too long.
    auto filter  MakeTlsFilter<  EXPECT_EQ(SECSuccess, SSL_KeyUpdate(sender->ssl_fd))java.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74
  -EnableDecryption( -(;
  -Disable)java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
  Connect(  (senderR(java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 22

  filter>)
SSL_KeyUpdateclient_-ssl_fd(, );-)
 -(;

  ExpectAlert(java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
  client_->  client_-ExpectReadWriteError;

  server_->ExpectReadWriteError();
  client_->xpectReadWriteErrorjava.lang.StringIndexOutOfBoundsException: Range [54, 51) out of bounds for length 54
server_-ReadBytes)java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
  >(;

  >CheckErrorCode(SSL_ERROR_RX_MALFORMED_HANDSHAKE)
  client_-  /Evenif  theclienthasupdatedhis writing key,

  // Even if the client has updated his writing key,
  ->heckEpochs3  /
  // the server has not.
java.lang.StringIndexOutOfBoundsException: Range [22, 9) out of bounds for length 29
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

TEST_F(}
  EnsureTlsSetup();
  // Changing the value of length of the KU message to be shorter than the
  // correct one.// In contrast, implementations MUST NOT send KeyUpdate, NewConnectionId, or
< an earlier message   same  has not
filter-  ST_F(,){
  -Disable;
  Connect();

  filter-  3 3java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
ssl_fd)  )
  filter-Disable(/ The second key update message will be ignored as there is KeyUpdate in

  ExpectAlert(server_, client_->ExpectReceiveAlert//  For the workflow see ssl_KeyUpdate_unittest
 client_SendData)

  client_->SendData(   -)
  
}

// DTLS1.3 tests

// The KeyUpdate in DTLS1.3 workflow (with the update_requested set):

// Client(P1) is asking for KeyUpdate
// Here the second parameter states whether the P1 requires update_requested
// (RFC9147, Section 8).
// EXPECT_EQ(SECSuccess, SSL_KeyUpdate(client_->ssl_fd(),
// PR_FALSE));

// The server (P2) receives the KeyUpdate request and processes it.
// server_->ReadBytes();

// P2 sends ACK.
// SSLInt_SendImmediateACK(server_->ssl_fd());

// P1 receives ACK and finished the KeyUpdate:
// client_->ReadBytes();

// This function sends and proceeds KeyUpdate explained above (assuming
// updateRequested == PR_FALSE) For the explantation of the updateRequested look
// at the test DTLSKeyUpdateClientUpdateRequestedSucceed.*/
                              java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 12
sAgent ,
                             bool                                (,java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 74
  EXPECT_EQ(SSLInt_SendImmediateACK>java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 45
  CheckEpochs3 )
 send an/java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
  sender->ReadBytes
   (updateRequestedjava.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
  if (updateRequested) {
            (;
    receiver->}
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}

// This test checks that after the execution of KeyUpdate started by the client,
// the writing client/reading server key epoch was incremented.
// RFC 9147. Section 4.
// However, this value is set [...] of the connection epoch,
// which is an [...] counter incremented on every KeyUpdate.
,DTLSKU_ClientKUSucceed {
  Connect();
  CheckEpochs  ( );
    //  Client starts KeyUpdate
java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 43
  SendAndProcessKU(client_, server_,  SSLInt_SendImmediateACK
 /  The KeyUpdate is finished, and the client writing spec/the server reading
  //  spec is incremented.
  CheckEpochs(4, 3);
   that  can send/.
  SendReceive50;
}

// This test checks that only one KeyUpdate is possible at the same time.
// RFC 9147 Section 5.8.4
// In contrast, implementations MUST NOT send KeyUpdate, NewConnectionId, or
// RequestConnectionId messages if an earlier message of the same type has not
// yet been acknowledged.
TEST_F(TlsConnectDatagram13, DTLSKU_ClientKUTwiceOnceIgnored  
  Connect(;
  CheckEpochs(3 3)
  //  Client sends a key update message.
  EXPECT_EQ(ECSuccess (>)// RFC 9147Section// In contrast, implementations MUST NOT send KeyUpdate, NewConnectionId, or
  // The second key update message will be ignored as there is KeyUpdate in
  //  progress.
  EXPECT_EQ(SECSuccess, SSL_KeyUpdate()java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
     /  Client sends a key update message.
  server_/Checkingthatwe  receivejava.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
   The  inDTLS13java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  client_->ReadBytes()  
  //  As only one KeyUpdate was executed, the key epoch was incremented only
  //  once.
  CheckEpochs(4, 3)// was set)
  SendReceive// P1 receives the ACK and finalizes the KeyUpdate.
}

// This test checks the same as the test DTLSKeyUpdateClientKeyUpdateSucceed,
// except that the server sends KeyUpdate.
TEST_F(// SSLInt_SendImmediateACK(java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 23
 Connect(;
  // both client w/r and server w/r T(,)java.lang.StringIndexOutOfBoundsException: Index 61 out of bounds for length 61
    // Here/java.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 76
);
  SendReceive()java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
}

// This test checks the same as the test DTLSKeyUpdateClientKeyUpdateSucceed,
// DTLSKeyUpdateClientKeyUpdateTwiceOnceIgnored, except that the server sends
// KeyUpdate.
TEST_F(java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 0
  Connect();
     the keys epochs were   SendAndProcessKU(server_,,PR_FALSE;
 EXPECT_EQ(ECSuccess (-ssl_fd(,PR_FALSE);
  // The second key update message will be ignored
  // This test checks java.lang.StringIndexOutOfBoundsException: Range [0, 23) out of bounds for length 20

  );
  (java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 12
  EXPECT_EQS (

  EXPECT_EQ(SECSucce (  EXPECT_EQ(SECSuccess, SSL_KeyUpdate(server_
  -ReadBytes(,5;
  SendReceive(50);
}  // Checking that we still can send/receive data.(->sl_fd)java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45

// This test checks that if we receive two KeyUpdates, one will be ignored
java.lang.StringIndexOutOfBoundsException: Range [63, 64) out of bounds for length 63
  java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
  CheckEpochs(3, 3(TlsConnectDatagram13 java.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63
  auto filter = MakeTlsFilter<// the keys epochs were incrementedauto   MakeTlsFilter  ,){
  (java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12

/

    /  java.lang.StringIndexOutOfBoundsException: Range [19, 18) out of bounds for length 70
  server_->ReadBytes);
  3 )

    sends
  // Sending the recorded KeyUpdate
   
  // Sending the KeyUpdate again
   // Sending the recorded KeyUpdatejava.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 20

  java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
  java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 0
  server_->eadBytes(;

   // We observe that only one KeyUpdate has happened
  (, 4;  /We  onehas 
  // Checking that we still can send/receive data.
  SendReceive(50);
}

// The KeyUpdate in DTLS1.3 workflow (with the update_requested set):

// Client(P1) is asking for KeyUpdate
// EXPECT_EQ(SECSuccess, SSL_KeyUpdate(client_->ssl_fd(), PR_TRUE));

// The server (P2) receives and processes the KeyUpdate request
// At the same time, P2 sends its own KeyUpdate request (due to update_requested
// was set)
// server_->ReadBytes();

// P1 receives the ACK and finalizes the KeyUpdate.
// SSLInt_SendImmediateACK(server_->ssl_fd());

// P1 receives the KeyUpdate request and processes it.
// client_->ReadBytes();

// P2 receives the ACK and finalizes the KeyUpdate.
// SSLInt_SendImmediateACK(client_->ssl_fd());
// server_->ReadBytes();

// This test checks that after the KeyUpdate (with update requested set)
// both client w/r and server w/r key epochs were incremented.
  )
  ((java.lang.StringIndexOutOfBoundsException: Range [27, 26) out of bounds for length 46
  CheckEpochs(  (, server_, PR_TRUE);
  // Here the second parameter sets the update_requested to true.
  SendAndProcessKU(client_, server_, PR_TRUE);
java.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 77
 /server)Bothof  keyswere modified
  CheckEpochs// Checking that we still can send/receive data.
  }
  SendReceive(50cks 
}

// This test checks that after two KeyUpdates (with update requested set)
// the keys epochs were incremented twice.
T,) {
  ( ;
    E,s>) )
    // The  is finished,soboth of theepochs  client_(;
  // The KeyUpdate is finished, so both of the epochs got incremented.
  CheckEpochs willSendAndProcessKU(client_, server_, PR_TRUE);
  / The second KeyUpdate is finished, so finally the epochs were incremented
/  (erver_ssl_fd)
  // twice.
  CheckEpochs(5,/  ( )
  // Checking that we still can send/receive data.
  SendReceive  ( )
}

// This test checks the same as the test DTLSKeyUpdateUpdateRequestedSucceed,
// except that the server sends KeyUpdate.
TEST_F, java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
  Connect  CheckEpochsed behaviour the protocol:
  // P2 receives // And this moment, P2( client_, PR_TRUE  epochuntil a  message
  server_,java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 0
  CheckEpochsjava.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
  SendReceive(50);
}  (;

// This test checks that after two KeyUpdates (with update requested set)
// the keys epochs were incremented twice.
TEST_F  / hasnotreceivedit   tryingtosendsome 
    // data
  (3, , 3)
  SendAndProcessKUjava.lang.StringIndexOutOfBoundsException: Range [0, 26) out of bounds for length 20
    // The KeyUpdate is finished, so both of the epochs got incremented.
  CheckEpochs(,5);

  // Server sends another KeyUpdate
  SendAndProcessKUASSERT_EQ)
}
  // twice.
  CheckEpochs(, 5;
  }
  (50;
}

// This test checks that both client and server can send the KeyUpdate in
// consequence.
(lsConnectDatagram13, java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 12
  Connect(;
  CheckEpochs(3, 3);
  SendAndProcessKU  3 )
  // As the server initiated KeyUpdate and did not request an update_request,
/Onlythewriting   java.lang.StringIndexOutOfBoundsException: Index 70 out of bounds for length 70
  CheckEpochs(,3;
  SendAndProcessKU ,PR_FALSE
  // Now the client initiated KeyUpdate and did not request an update_request,
  // so now both of epochs got incremented.
  CheckEpochs(4, 4);
  // Checking that we still can send/receive data.
 SendReceive(0)
}

// This test checks that both client and server can send the KeyUpdate in
// consequence. Compared to the DTLSKeyUpdateClientServerConseqSucceed TV, this
// time both parties set update_requested to be true.
(java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 20
  Connect()
(3,3java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
  SendAndProcessKU(client_, server_, PR_TRUE);
 SendAndProcessKU(, client_,PR_TRUE;
  // The second KeyUpdate (update_request = True) increments again the epochs(5 5;
  // of both keys.
  java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 1
hatwe  can/.
  SendReceive(50);
}

// This test checks that if there is an ongoing KeyUpdate, the one started
// durint the KU is not going to be executed.
)TS,SSL_KeyUpdateserver_>,PR_TRUE)
  Connect(;
  (3,)
  EXPECT_EQ(SECSuccess ()java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
  client_->ReadBytes();
// both parties can exchange.
/
  // This KeyUpdate will not execute
  EXPECT_EQ(SECSuccess  Senjava.lang.StringIndexOutOfBoundsException: Range [27, 25) out of bounds for length 45
 /
  SSLInt_SendImmediateACK(server_->ssl_fd());
  client_->ReadBytes(  CheckEpochs4 )java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
  // As there was only one KeyUpdate executed, both keys got incremented only
  // once.
  /DTLS1.
  // Checking that we still can send/receive data.;
  SendReceive(50)/ P2 
}

// DTLS1.3 KeyUpdate - Immediate Send Tests.

// The expected behaviour of the protocol:
// P1 starts initiates KeyUpdate
// P2 receives KeyUpdate
// And this moment, P2 will update the reading key to n
// But P2 will be accepting the keys from the previous epoch until a new message
// encrypted with the epoch n arrives.

// This test checks that when a client sent KeyUpdate, but the KeyUpdate message
// was not yet received, client can still send data.
/java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
  Connect();
  
  (,3;
  // Server has not yet received it, client is trying to send some additional
   data
  CheckEpochs
  WAIT_server_// This test checks that the client writing epoch is updated only
  // Server successfully receives it.
  SendReceive50;
  ASSERT_EQ((size_t)10,//java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  SendReceive(50);
}

// This test checks that when a client sent KeyUpdate, but the KeyUpdate message
// was not yet received, it can still receive data.
TEST_F(TlsConnectDatagram13, DTLSKU_ServerImmediateSend CheckEpochs(3, 3;
  Connect();
    EXPECT_EQ(SECSuccess, SSL_KeyUpdate(client_->ssl_fd(), PR_FALSE));
EXPECT_EQ(ECSuccess,SSL_KeyUpdateclient_-ssl_fd(,PR_FALSE;
  // The server can successfully send data.
  CheckEpochs(3, 3);
  server_->SendData(10) WAIT_-received_bytes)= ,2000)
  WAIT_  (size_t),client_>eceived_bytes());
  ASSERT_EQ(size_t)10, ->eceived_bytes))
  SendReceive(java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 1
}

// This test checks that when a client sent KeyUpdate,
// the server has not yet sent an ACK and the client has not yet ACKed
// KeyUpdate, both parties can exchange data.
TEST_F
  
  // Client has initiated KeyUpdate
  EXPECT_EQ(SECSuccess// Server receives KeyUpdate
  -eadBytes)java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
  server_->ReadBytes();
// Client can send data before the server sending ACK and client receiving
/java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
got updated
>(,3;
  client_->CheckEpochs(3  -(3, 3)
  client_-()
WAIT_(erver_->
  ( )
  // Server can send data
server_java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 1
  WAIT_(client_->received_bytes()  ASSERT_EQ()10 // (i.e. the cases where we reached the highest epoch).
  ASSERT_EQ((size_t)10, java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 1
  SendReceive(50);
}

// This test checks that when a client sent KeyUpdate, but has not yet ACKed it,
// both parties can exchange data.
TEST_F(TlsConnectDatagram13// Client has initiated KeyUpdate
  Connect();
  CheckEpochs(3,EST_F(,DTLSKU_ClientMaxEpochReached{
  // Client has initiated KeyUpdate
  EXPECT_EQ(( );
  // Server receives KeyUpdate
server_>/   the   
  // Server sends ACK
  // Client can send data hehas-sl_fd();
  // Client can send data before he has received KeyUpdate
got updated updated.
server_-heckEpochs,3;
  client_->CheckEpochs(3, 3);client_->CheckEpochs(max_epoch_type3)
  -  s>)==10 );
  WAIT_  (10 -eceived_bytes);
  ASSERT_EQ((size_t)10, server_->  SendReceive(an send data
  // Server can send data
  server_->SendData(10WAIT_(->eceived_bytes
WAIT_(lient_>eceived_bytes)= 10, 2000)
  SendReceive)java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
  SendReceive(50);
}

// This test checks that the client writing epoch is updated only
// when the client has received the ACK.
// RFC 9147. Section 8
// As with other handshake messages with no built-in response, KeyUpdates MUST
// be acknowledged.
TEST_F(PRUint64 max_epoch_type (0x1ULL<< 16)-1
Connect)java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
  // Previous epoch
( ;
  // Client sends a KeyUpdate
  EXPECT_EQ(SECSuccess, SSL_KeyUpdate(client_->ssl_fd(), java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 23
  // Server updates his reading key
  server_->// But the client has   =3
  
  EXPECT_EQSECSuccess,java.lang.StringIndexOutOfBoundsException: Range [0, 37) out of bounds for length 0
  // But the client has a writing key = 3
  >(, 3;

  // Client sends a data, but using the old (3) keys
  client_-java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 WAIT_(erver_-  )java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
  (size_t)0,server_-received_bytes));

  java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 1
  client_->CheckEpochs(3, 3);

  SSLInt_SendImmediateACK(// This test checks that the maximum epoch will not be exceeded on}
  java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0

  CheckEpochs(4, 3);
  // See bug https://bugzilla.mozilla.org/show_bug.cgi?id=1809872
/// Implementations SHOULD initiate a key update before reaching this limit// required by RFC.

// DTLS1.3 KeyUpdate - Testing the border conditions
// (i.e. the cases where we reached the highest epoch).

// This test checks that the maximum epoch will not be exceeded on KeyUpdate.
// RFC 9147. Section 8.
// In order to provide an extra margin of security,
// sending implementations MUST NOT allow the epoch to exceed 2^48-1.

// Here we use the maximum as 2^16,
// See bug https://bugzilla.mozilla.org/show_bug.cgi?id=1809872
// When the bug is solved, the constant is to be replaced with 2^48 as
// required by RFC.
TEST_F(TlsConnectDatagram13,   EXPECT_EQ(SECSuccess, SSLInt_AdvanceReadSeqNum>( ;
  Connect( // Upon trying to execute KeyUpdate, we return a SECFailure.
  CheckEpochs(,3)
  PRUint64 max_epoch_type =   server_-ReadBytes()

  // We assign the maximum possible epochs
  EXPECT_EQ(SECSuccess,
            // receives a KeyUpdate with request_updateset to update_requested",itMUST
  EXPECT_EQ(SECSuccess,
            TEST_F(TlsConnectDatagram13, DTLSKU_Cl java.lang.StringIndexOutOfBoundsException: Index 75 out of bounds for length 75
  CheckEpochs(max_epoch_type, 3);
  // Upon trying to execute KeyUpdate, we return a SECFailure.x1ULL<<16)-1;
  EXPECT_EQ(SECFailure,java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  SendReceive(50);
}

// This test checks the compliance with the RFC 9147 stating the behaviour
// reaching the max epoch: RFC 9147 Section 8. If a sending implementation
// receives a KeyUpdate with request_update set to "update_requested", it MUST
// NOT send its own KeyUpdate if that would cause it to exceed these limits and
// SHOULD instead ignore the "update_requested" flag.
TlsConnectDatagram13java.lang.StringIndexOutOfBoundsException: Index 75 out of bounds for length 75
  Connect();
  CheckEpochs(3, 3);

  java.lang.StringIndexOutOfBoundsException: Range [25, 10) out of bounds for length 47

  // We assign the maximum possible epochs - 1.
  EXPECT_EQ(SECSuccess,
            SSLInt_AdvanceWriteEpochNum);
  EXPECT_EQ(SECSuccess,
            SSLInt_AdvanceReadEpochNum// Set this to one below the read threshold.

  CheckEpochs  (SECSuccess,
  // Once we call KeyUpdate with update requested
  ( s-ssl_fd) )
  client_->ReadBytes();
  SSLInt_SendImmediateACKclient_-ssl_fd(;
  server_-  SendReceive50;
  SSLInt_SendImmediateACK(server_-java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

  // Only one key (that has not reached the maximum epoch) was updated.
  CheckEpochs(max_epoch_type
  // Implementations// Thismessage willcause the servertojava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}

// DTLS1.3 KeyUpdate - Automatic update tests

// RFC 9147 Section 4.5.3.
// Implementations SHOULD NOT protect more records than allowed by the limit
// specified for the negotiated AEAD.
// Implementations SHOULD initiate a key update before reaching this limit.

// These two tests check that the KeyUpdate is automatically called upon
// reaching the reading/writing limit.
(lsConnectDatagram13 java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 23
  ConfigureVersion(java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 0
  ConnectWithCipherSuite
  CheckEpochs(3,  // Checking that we still can send/receive data.

  // Set this to one below the write threshold.
   threshold = 0x438000000;
  EXPECT_EQ(SECSuccess,
            SSLInt_SendImmediateACK(server_->// to execute an automatic KU, but the server has not responded.
java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 0

  // This should be OK.
  client_->SendData(10 SendReceive100;
  server_->ReadBytes();

  / This should cause the client to update.
  client_->SendData(15);S
  server_>(;
  SSLInt_SendImmediateACK(server_->ssl_fd());
 client_-ReadBytes(;

  // The client key epoch was incremented.
chs4,3)
  // Checking that we still can send/receive data.
  SendReceive(100            SSLInt_AdvanceWriteSeqNum(lient_>sl_fd) threshold);
}

TEST_F(TlsConnectDatagram13, age
  client_-SendData()
  ConnectWithCipherSuite(  DataBuffer d = filter->ReturnRecorded
  CheckEpochsjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

  // Set this to one below the read threshold.
  uint64_t java.lang.StringIndexOutOfBoundsException: Range [0, 20) out of bounds for length 0
  EXPECT_EQSSLInt_SendImmediateACK(erver_> // And it was not received.
            )
  EXPECT_EQ(

  auto(java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 0
a10)java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
   d= ->eturnRecorded(;

  client_->SendDirect(d)}
  // This message will cause the server to start KeyUpdate with updateRequested            java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 69
  // = 1.
  server_->ReadBytes();

  java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 0
  client_->ReadBytes();
  SSLInt_SendImmediateACK(client_->  (,3)
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

  // Both keys got updated.
 S,
  // Checking that we still can send/receive data.
  SendReceive(100);
}

// The test describes the situation when there was a request
// to execute an automatic KU, but the server has not responded.
// RFCclient_>(15)
  java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 0
  ConnectWithCipherSuite// keying material, receivers MUST retain the pre-update keying material
  CheckEpochs client_-SendData105;

  uint64_t threshold = 0x5a0000000 -
  EXPECT_EQASSERT_EQ(size_tr +15,-();
            SSLInt_AdvanceWriteSeqNum(client_->ssl_fd(), java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
d));

size_t  -received_bytes);
    // We still can send a messageGCM_SHA256;
  client_->endData()java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24

 // We can not send a message anymore
  client_->ExpectReadWriteError();
  -java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 25

  server_-ReadBytes(;
  // And it was not received.
  (size_t)eceived_bytes 15,server_>()java.lang.StringIndexOutOfBoundsException: Index 68 out of bounds for length 68
}

TEST_F  java.lang.StringIndexOutOfBoundsException: Range [10, 9) out of bounds for length 29
  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3 filter  
  (TLS_AES_128_GCM_SHA256;
  CheckEpochs3 3)

  uint64_t threshold = 0  -ReadBytes(
  EXPECT_EQ(SECSuccess,
           
  EXPECT_EQ(SECSuccess, SSLInt_AdvanceReadSeqNum(server_->ssl_fd(),   EXPECT_EQ(SECSuccess, SSLInt_AdvanceReadSeqNum(server_->ssl_fd(), thresholdRjava.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 1

  size_t received_bytes = server_->received_bytes();

  auto// keying material, receivers MUST retain the pre-update keying material
  client_->  // And now we resendthe message m1 and receive it
  DataBuffer d = filter->ReturnRecorded();

  -(d);
  -SendDirect()

  server_->ReadBytes();
  // Only one message was received.
  ASSERT_EQjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}

// DTLS1.3 KeyUpdate - Managing previous epoch messages
// RFC 9147 Section 8.
// Due to the possibility of an ACK message for a KeyUpdate being lost
// and thereby preventing the sender of the KeyUpdate from updating its
// keying material, receivers MUST retain the pre-update keying material
// until receipt and successful decryption of a message using the new
// keys.

// This test checks that message encrypted with the key n-1 will be accepted
// after KeyUpdate is executed, but before the message n has arrived.
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  size_t len = 10;

  Connect();
  // Client starts KeyUpdate
  EXPECT_EQS,SSL_KeyUpdate
  // Server receives KeyUpdate and sends ACK
  server_-(;
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
/ hasnotreceived ,sothekey 
  // changed
  client_/java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
  server_->java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 0

  auto filter =  / Checking that we still can send/receive data.

java.lang.StringIndexOutOfBoundsException: Range [0, 48) out of bounds for length 1
  // encrypted with the client 3rd epoch key, m1 = enc(message, key_3)
  client_Sl;
  DataBuffer d   // Client starts KeyUpdate

  // Client has received the ACK
  client_->ReadBytes  =  // Server receives KeyUpdate and sends ACK
  // Now he updates the writing Key to 4
  client_->CheckEpochs(3, 4);
 3);

 // And now we resend the message m1 and successfully receive it
  client_->endDirect(d;
>received_bytes)   Executing 2 KeyUpdates, so the client writing key is equal to 5 now
  ASSERT_EQ(en,>);
  // Checking that we still can send/receive data.
  SendReceive50)
}

// This test checks that message encrypted with the key n-2 will not be accepted
// after KeyUpdate is executed, but before the message n has arrived.
TEST_F  // previousEpochLen + legal_message_len)   >  () ()
  java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 18

  Connect(
  );
  auto filter = MakeTlsFilter<TLSRecordSaveAndDropNext
  client_->SendData(len);
  DataBuffer d=filter-ReturnRecorded(;
  client_->ResetSentBytes();

  client_, server_ R_FALSE;
SendAndProcessKU,, )java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47

  // Executing 2 KeyUpdates, so the client writing key is equal to 5 now
  CheckEpochs-(java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
thejava.lang.StringIndexOutOfBoundsException: Range [35, 34) out of bounds for length 68
    // Client  -java.lang.StringIndexOutOfBoundsException: Range [21, 20) out of bounds for length 23
-ReadBytes// previousEpochLen + legal_message_len)
  // Server has still received just legal_message_len of bytes (not the
  // previousEpochLen + legal_message_len)  (;
  ASSERT_EQ((size_t
  // Checking that we still can send/receive data.
  (60;
}

// This test checks that that message encrypted with the key n-1 will be
// rejected after KeyUpdate is executed, and after the message n has arrived.
TEST_F(TlsConnectDatagram13  -(;
  size_t len = 30;
  size_t java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 0

  Connect(};
  // Client starts KeyUpdate
  , (client_-  // At this moment, a client will send a message with
  // Server receives KeyUpdate and sends ACK
  server_->ReadBytes();
  -ReadBytes(
 // Client has not yet received the ACK, so the writing key epoch has not/java.lang.StringIndexOutOfBoundsException: Index 78 out of bounds for length 78
  // changed{x,0 x3,
  client_->java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
  server_->CheckEpochs(4, 3);

  >(client_);

 Here the   SendReceive(50)
  // encrypted with the client 3rd epoch key, m1 = enc(message, key_3)
  client_->SendData(len);
  DataBuffer d = filter->ReturnRecorded();
  client_->ResetSentBytes();

  // Client has received the ACK
  0x5x,x}  
  client_->CheckEpochs(3, 4);
 server_->CheckEpochs(4, 3);

  // At this moment, a client will send a message with the new key
java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
  // As soon as it's received, the server will forbid the messaged from the
  // previous epochs// DTLS Epoch reconstruction test
  server_->ReadBytes();

  / If a message from the previous epoch arrives to the server (m1, the key_3  // If a message from the previous epoch arrives to the server (m1, the key_3
      {0x7, 0x0, 0x4},
    0,x1 x5}
  // it will be silently dropped    x,x2,}
  server_    0 0,  
  //  Server has still received just legal_message_len of bytes (not thejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  // previousEpochLen + legal_message_len)
  ASSERT_EQ(({  ,
  // Checking that we still can send/receive data.
  SendReceive50java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 1

// DTLS Epoch reconstruction test
// RFC 9147 Section 8. 4.2.2. Reconstructing the Sequence Number and Epoch

// This test checks that the epoch reconstruction is correct.
// The function under testing is dtlscon.c::dtls_ReadEpoch.
// We only consider the case when dtls_IsDtls13Ciphertext is true.

java.lang.StringIndexOutOfBoundsException: Range [43, 41) out of bounds for length 43
      {0x5, 0x0, 0x4},  // diff == 1
  DTLSEpoch epoch;
  // Only two-bit epoch here
  PRUint8 ;
    0=({,0x0 x4,
 

static
    {x,01 x}

    {0x2, 0x1, 0x1},
    {java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

    {0x3, 0x3, 0x3},
    { x,0}
    {0x3, 0x1, 0x1},/   java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 64

    {0x4    
                  
    {0x4, 0x1,     / //  } body;
    {0x4, 0x2,//
    {0x4, 0x3, 0x3},  // diff == 1

    {0x5, 0x0, 0x4},// The next tests send malformed KeyUpdate messages.   [ {0;
    {0x5, 0  ;
    {0x5, 0x2, 0
    {x5 x3, 0}  

    {0x6, 
    {x,01 0,
    {0x6, 0x2, 0x6},
    {0x6, 0x3, 0x3    / ReadEpoch (dtlscon.c#1339) uses only spec->version and spec->epoch.

    {0x7, 0x0, 0x4},
    {}
    {0x7, 0x2, 0x6},
    {0x7, 0x3, 0x7},

    {0x8, 0x0, 0x8},
    {0x8, 0x1, 0x5},
    {0x8, 0x2, 0x6},
    {0x8, 0x3, 0x7},

    // Starting from here the pattern (starting from 4) repeats:
    case key_update:            TEST_F(TlsConnectDatagram13, DTLSKU_Wrong) {
    // the difference will behave as for n % 4 + 4.
    // For example, if the current epoch is equal to 9, then
    // the difference between the reconstructed epoch and the current one filter =// } KeyUpdateRequest
    // will be the same as for the 5th epoch.
};

TEST_F(java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 12
  PRUint8 header[5] = {0};
  header[0] = 0x20;
  DTLSEpoch epoch;

  for (size_t = 0;i<26; i++ {
    epoch = sslKeyUpdateReadEpochTV[i].epoch;
    header[0]= (eader0]&0xfc)|(sslKeyUpdateReadEpochTV[i].header // request.
    // ReadEpoch (dtlscon.c#1339) uses only spec->version and spec->epoch.
    ASSERT_EQ(sslKeyUpdateReadEpochTV[i].java.lang.StringIndexOutOfBoundsException: Range [0, 69) out of bounds for length 45
              dtls_ReadEpoch(SSL_LIBRARY_VERSION_TLS_1_3, epoch, header// bytes).
  }
}

// RFC 9147. A.2. Handshake Protocol
// struct {
//  HandshakeType msg_type;    -- handshake type
//  uint24 length;             -- bytes in message
//  uint16 message_seq;        -- DTLS-required field
//  uint24 fragment_offset;    -- DTLS-required field
//  uint24 fragment_length;    -- DTLS-required field
//  select (msg_type) {
//  ...
//  case key_update:            KeyUpdate;
//  } body;
// } Handshake;
//
// enum {
// update_not_requested(0), update_requested(1), (255)
// } KeyUpdateRequest;

// The next tests send malformed KeyUpdate messages.
// A remainder: TLSKeyUpdateDamager filter takes as an input an agent,
// a byte index and a value that the existing value of the byte with the byte
// index will be replaced with. The filter catchs only the KeyUpdate messages,
// keeping unchanged all the rest.

// The first test, DTLSKeyUpdateDamagerFilterTestingNoModification,
// checks the correctness of the filter itself. It replaces the value of 12th
// byte with 0: The 12th byte is used to specify KeyUpdateRequest. Thus, the
// modification done in the test will still result in the correct KeyUpdate
// request.

// The test DTLSKU_WrongValueForUpdateRequested is modifying
// KeyUpdateRequest byte to have an not-allowed value.

// The test DTLSKeyUpdateDamagedLength modifies the 3rd byte (one of the length
// bytes).

// The test DTLSKeyUpdateDamagedLengthLongMessage changes the length of the
// message as well.

// The test DTLSKeyUpdateDamagedFragmentLength modifies the 10th byte (one of
// the fragment_length bytes)

TEST_F(TlsConnectDatagram13, DTLSKU_WrongValueForUpdateRequested) {
  EnsureTlsSetup();
  // Filter replacing the update_requested with an unexpected value.(3agram13 DTLSKU_DamagedLength){
  auto filter = MakeTlsFilter<TLSKeyUpdateDamager>(client_/  SendReceive(50;
  filter-EnableDecryption;
  filter->Disable();
  Connect();
  filter->Enable();
  SSL_KeyUpdate(client_->ssl_fd(Connect(;
  filter->Disable();

  ExpectAlert(server_, kTlsAlertDecodeError);
  client_->ExpectReceiveAlert(auto filter = MakeTlsFilter<TLSKeyUpdateDamager>(  (erver_-ssl_fd);

 client_-ReadBytes)
    // No

  server_->ReadBytes();
client_>()java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23

  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_KEY_UPDATE);
  client_->CheckErrorCode(SSL_ERROR_DECODE_ERROR_ALERT);

  // No KeyUpdate happened.
  CheckEpochs(3, 3);
}

, DTLSKU_DamagedLength{
  EnsureTlsSetup();
  // Filter replacing the length value with 0.  
  auto filter =}
  
  TEST_F(T,DTLSKU_DamagedFragmentLengthjava.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
  (;
  filter->Enable();

  SSL_KeyUpdate(client_  ->(;
  filter->Disable();
SSLInt_SendImmediateACKserver_ssl_fd)
  (3,3;
  // No KeyUpdate happened.
  CheckEpochs(3, 3);
  SendReceive(50);


TEST_F(TlsConnectDatagram13, DTLSKU_DamagedLengthTooLong) {
  EnsureTlsSetup();
   byte oflength  one
  // The message length is increased by 2 ^ 8
  auto filter->Disable();
  filter->EnableDecryption();
  filter->Disable();
  Connect();
  filter->Enable();

  SSL_KeyUpdate(client_->ssl_fd(), PR_FALSE);
  filter->Disable();
  SSLInt_SendImmediateACK-());
  client_->ReadBytes();
  / No KeyUpdate happened.
  CheckEpochs(3, 3);
  SendReceive(50);
}

TEST_F(java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 11
  EnsureTlsSetup();
  // Filter replacing the fragment length with 1.
  autofilter  <>(client_,10,, 1);
  filter->EnableDecryption();
  filter->Disable();
  Connect(;
->Enable();

  SSL_KeyUpdate(client_->     return KEEP;
  filter->Disable();
  SSLInt_SendImmediateACK(server_->ssl_fd());
  client_->ReadBytes() protected:
  // No KeyUpdate happened.
  CheckEpochs(3, 3);     ;
  SendReceive(                                    const & ,size_t   TlsRecordHeaderout_header;
}

// This filter is used in order to modify an ACK message.
// As it's possible that one record contains several ACKs,
// we fault all of them.

class TLSACKDamager : public TlsRecordFilter {
 public:
::shared_ptr<lsAgent&a size_t byte 
      : TlsRecordFilter(a), java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 25

 :
  PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
}
                                    * java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 0
    if (!header.is_protected()) {
      return       return KEEP
    }

    uint16_t protection_epoch
    uint8_t inner_content_typereturn ;
    DataBuffer plaintext;
    TlsRecordHeader out_header;

    if     
                   plaintext, &out_header)) {     return KEEP;
      return KEEP;
    }

    if (plaintext.    uint64_t      // As we keep theACK ifonemessage  incorrent
      return KEEP;
    }

    if (decrypting() && inner_content_typejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      return KEEP;
    }

    // We compute the number of ACKS in the message
    // As we keep processing the ACK even if one message is incorrent,
    // we fault all the found ACKs.

_=2;
    uint8_t java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
    uint64_t acks = plaintext.len(      
    EXPECT_EQ
    acks = /;

 plaintextlen(<  ++
                               (acks - 1) * java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 0
      return KEEP;
    }

    ( i ;i   +){
      // Here we replace the offset_-th byte after the header
      // i.e. headerAck + ACK(0) + ACK(1) <-- the offset_-th byte
      // of ACK(0), ACK(1), etc
      plaintext.data()[ack_message_header_len + offset_ +
                       i * ack_message_len_one_ACK] = value_;
    }

    DataBuffer ciphertext;
    bool ok = java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 11
                  , iphertext ut_headerjava.lang.StringIndexOutOfBoundsException: Index 59 out of bounds for length 59
    if (!ok)  protected:
      return KEEP;
    }
    *offset = out_header.Writejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    return CHANGEjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  }

 protected:
  size_t offset_;
  uint8_t value_;
};

// The next two tests are modifying the ACK message:

// First, we call KeyUpdate on the client side. The server successfully
// processes it, and it's sending an ACK message. At this moment, the filter
// modifies the content of the ACK message by changing the seqNum or epoch and
// sends it back to the client.
//
// struct {
//  uint64 epoch;
//  uint64 sequence_number;
// } RecordNumber;

// struct {
//  RecordNumber record_numbers<0..2^16-1>;
// } ACK;

TEST_F(TlsConnectDatagram13, DTLSKU_ModifACKEpoch) {

  uint8_t byte = 3;
  uint8_t v = 1;
  // The filter will replace value-th byte of each ACK with one
  // The epoch will be more than v * 2 ^ ((byte - 1) * 8).
  // HandleACK function allows the epochs such that (epoch > RECORD_EPOCH_MAX)E)
  // where RECORD_EPOCH_MAX == ((0x1ULL << 16) - 1)
  auto filter = MakeTlsFilter<SSLInt_SendImmediateACK(server_->ssl_fd
  filter->EnableDecryption(  (;
  filter->  -ReadBytes(java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
  Connect();
  CheckEpochs(3, 3);
  EXPECT_EQ(SECSuccess, java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    (java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 1

  filter-EnsureTlsSetup ;
  SSLInt_SendImmediateACK(server_->ssl_fd());
  filter->Disable();

  client_  -(,3;
  server_->CheckEpochs(4, 3);
  // The client has not received the ACK, so it will not update the key.
  client_->CheckEpochs(3, 3 ( < )-1java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49

// The communication still continues.
  filter->EnableDe  byte=;
java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 1

TEST_F(,) {
  EnsureTlsSetup();
  uint8_t byte =java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  uint8_t v = 1;
/
  // The seqNum will be more than v * 2 ^ ((byte - 1) * 8).
  // HandleACK function allows the epochs such that (seq > RECORD_SEQ_MAX)
      Connect()

  // here byte + 8 means that we modify not epoch, but sequenceNum
  auto filter = MakeTlsFilter<TLSACKDamager>(java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 0
  filter>(;
filter-()
  Connect  -3 )

  EXPECT_EQ(SECSuccess, java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 0
  server_-java.lang.StringIndexOutOfBoundsException: Range [9, 1) out of bounds for length 1

  filter->Enable()S();
  SSLInt_SendImmediateACK(server_->ssl_fd());
  ->Disable)

  client_->ReadBytes();

  client_->ReadBytes();
  server_->CheckEpochs(4, 3);
  // The client has not received the ACK, so it will not update the key.SECFailure (-ssl_fdfilter>;
  client_-Handshake();

  // The communication still continues.
  SendReceive(50);
}

TEST_F(TlsConnectDatagram13, DTLSKU_TooEarly_ClientCannotSendKeyUpdate) java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  StartConnect();
  autoSECFailure >(,)java.lang.StringIndexOutOfBoundsException: Index 68 out of bounds for length 68
  filter->class DTlsEncryptedHandshakeH   java.lang.StringIndexOutOfBoundsException: Range [10, 9) out of bounds for length 23

java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 23
  >andshake:(,

  EXPECT_EQ(        old_ct_(old_ct
}

Tjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 8
  filter=<>;
  filter->EnableDecryption();

client_-(;
  >java.lang.StringIndexOutOfBoundsException: Range [20, 15) out of bounds for length 24

  EXPECT_EQ(SECFailure, SSL_KeyUpdatejava.lang.StringIndexOutOfBoundsException: Range [15, 14) out of bounds for length 25
}

class   PacketFilter::Action FilterRecord:FilterRecord  java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 66
 public:
  DTlsEncryptedHandshakeHeaderReplacer(const std::shared_ptr<                   ,o){
                                       uint8_t old_ct, uint8_t new_ct)
      : TlsRecordFilter)java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
        old_ct_(old_ct),
            TlsRecordHe      java.lang.StringIndexOutOfBoundsException: Range [16, 15) out of bounds for length 23
            if (!Unprotect,,p java.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74

 protected:
  PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                    DataBuffer& *,
                                    DataBuffer*    }
        seq_num  .)java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56

uint8_t;
    ;
    uint16_t protection_epoch = 0;
       Protect, java.lang.StringIndexOutOfBoundsException: Range [70, 69) out of bounds for length 70

    if (!return KEEP
                   &plaintext, &out_header)) {
      return KEEP;
    }

    & :
    uint32_t msg_type = 256;  // Not a real message (out_header
(, 1 &sg_type)||msg_type = old_ct_){
      replaced_ = true;
    .(;
    }

uint64_t      uint64_t seq_num = protection_spec.next_out_seqno
    if (out_header.is_dtls()) {
.sequence_number)&( 
    }
    out_header.sequence_number(  filter=<java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 18

    DataBuffer ciphertext;
    bool     bool rv
                    ,)
    if (! (,)java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
      returnjava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    }
    *offset = out_header.Write(output, *offset, java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 1
    return CHANGE;
  }

 private:
  old_ct_java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    server_Sjava.lang.StringIndexOutOfBoundsException: Range [61, 60) out of bounds for length 62
    >(java.lang.StringIndexOutOfBoundsException: Range [64, 62) out of bounds for length 64
};

// The next tests check the behaviour of KU before the handshake is finished.
TEST_F(TlsConnectDatagram13, DTLSKU_TooEarly_Clientclient_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_KEY_UPDATE);
  StartConnect();
  // This filter takes the record and if it finds kTlsHandshakeFinished
  // it replaces it with kTlsHandshakeKeyUpdate
//
  // This handshake will be cancelled.
  auto filter = MakeTlsFilter<java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 54
      server_, kTlsHandshakeFinished, kTlsHandshakeKeyUpdate  ()
java.lang.StringIndexOutOfBoundsException: Index 71 out of bounds for length 29

  client_->Handshake();
  server_->Handshake();
  ExpectAlert(client_, kTlsAlertUnexpectedMessage);
nt_->(;
  client_->CheckErrorCode(java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 29
  server_->client_->Handshake();
  server_->CheckErrorCode(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT);
}

(, ){
  StartConnect();
  // This filter takes the record and if it finds kTlsHandshakeFinished
  // it replaces it with kTlsHandshakeKeyUpdate
  auto filter =   client_->Handshake->);
      client_,kTlsHandshakeFinished,kTlsHandshakeKeyUpdate);
  filter->EnableDecryption();

  client_->Handshake();
  server_->Handshake();
  client_->Handshake();
  ExpectAlert(server_, java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 24
  server_->Handshake();
  server_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_KEY_UPDATE);
  client_->Handshake();
  client_->CheckErrorCode(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT);
}

}  // namespace nss_test