1 #! /usr/bin/env perl 2 # Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. 3 # 4 # Licensed under the Apache License 2.0 (the "License"). You may not use 5 # this file except in compliance with the License. You can obtain a copy 6 # in the file LICENSE in the source distribution or at 7 # https://www.openssl.org/source/license.html 8 9 use strict; 10 use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/; 11 use OpenSSL::Test::Utils; 12 use TLSProxy::Proxy; 13 use File::Temp qw(tempfile); 14 15 my $test_name = "test_sslsessiontick"; 16 setup($test_name); 17 18 plan skip_all => "TLSProxy isn't usable on $^O" 19 if $^O =~ /^(VMS)$/; 20 21 plan skip_all => "$test_name needs the dynamic engine feature enabled" 22 if disabled("engine") || disabled("dynamic-engine"); 23 24 plan skip_all => "$test_name needs the sock feature enabled" 25 if disabled("sock"); 26 27 plan skip_all => "$test_name needs SSLv3, TLSv1, TLSv1.1 or TLSv1.2 enabled" 28 if alldisabled(("ssl3", "tls1", "tls1_1", "tls1_2")); 29 30 sub checkmessages($$$$$$); 31 sub clearclient(); 32 sub clearall(); 33 34 my $chellotickext = 0; 35 my $shellotickext = 0; 36 my $fullhand = 0; 37 my $ticketseen = 0; 38 39 my $proxy = TLSProxy::Proxy->new( 40 undef, 41 cmdstr(app(["openssl"]), display => 1), 42 srctop_file("apps", "server.pem"), 43 (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) 44 ); 45 46 #Test 1: By default with no existing session we should get a session ticket 47 #Expected result: ClientHello extension seen; ServerHello extension seen 48 # NewSessionTicket message seen; Full handshake 49 $proxy->clientflags("-no_tls1_3"); 50 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; 51 plan tests => 10; 52 checkmessages(1, "Default session ticket test", 1, 1, 1, 1); 53 54 #Test 2: If the server does not accept tickets we should get a normal handshake 55 #with no session tickets 56 #Expected result: ClientHello extension seen; ServerHello extension not seen 57 # NewSessionTicket message not seen; Full handshake 58 clearall(); 59 $proxy->clientflags("-no_tls1_3"); 60 $proxy->serverflags("-no_ticket"); 61 $proxy->start(); 62 checkmessages(2, "No server support session ticket test", 1, 0, 0, 1); 63 64 #Test 3: If the client does not accept tickets we should get a normal handshake 65 #with no session tickets 66 #Expected result: ClientHello extension not seen; ServerHello extension not seen 67 # NewSessionTicket message not seen; Full handshake 68 clearall(); 69 $proxy->clientflags("-no_tls1_3 -no_ticket"); 70 $proxy->start(); 71 checkmessages(3, "No client support session ticket test", 0, 0, 0, 1); 72 73 #Test 4: Test session resumption with session ticket 74 #Expected result: ClientHello extension seen; ServerHello extension not seen 75 # NewSessionTicket message not seen; Abbreviated handshake 76 clearall(); 77 (undef, my $session) = tempfile(); 78 $proxy->serverconnects(2); 79 $proxy->clientflags("-no_tls1_3 -sess_out ".$session); 80 $proxy->start(); 81 $proxy->clearClient(); 82 $proxy->clientflags("-no_tls1_3 -sess_in ".$session); 83 $proxy->clientstart(); 84 checkmessages(4, "Session resumption session ticket test", 1, 0, 0, 0); 85 unlink $session; 86 87 #Test 5: Test session resumption with ticket capable client without a ticket 88 #Expected result: ClientHello extension seen; ServerHello extension seen 89 # NewSessionTicket message seen; Abbreviated handshake 90 clearall(); 91 (undef, $session) = tempfile(); 92 $proxy->serverconnects(2); 93 $proxy->clientflags("-no_tls1_3 -sess_out ".$session." -no_ticket"); 94 $proxy->start(); 95 $proxy->clearClient(); 96 $proxy->clientflags("-no_tls1_3 -sess_in ".$session); 97 $proxy->clientstart(); 98 checkmessages(5, "Session resumption with ticket capable client without a " 99 ."ticket", 1, 1, 1, 0); 100 unlink $session; 101 102 #Test 6: Client accepts empty ticket. 103 #Expected result: ClientHello extension seen; ServerHello extension seen; 104 # NewSessionTicket message seen; Full handshake. 105 clearall(); 106 $proxy->filter(\&ticket_filter); 107 $proxy->clientflags("-no_tls1_3"); 108 $proxy->start(); 109 checkmessages(6, "Empty ticket test", 1, 1, 1, 1); 110 111 #Test 7-8: Client keeps existing ticket on empty ticket. 112 clearall(); 113 (undef, $session) = tempfile(); 114 $proxy->serverconnects(3); 115 $proxy->filter(undef); 116 $proxy->clientflags("-no_tls1_3 -sess_out ".$session); 117 $proxy->start(); 118 $proxy->clearClient(); 119 $proxy->clientflags("-no_tls1_3 -sess_in ".$session." -sess_out ".$session); 120 $proxy->filter(\&inject_empty_ticket_filter); 121 $proxy->clientstart(); 122 #Expected result: ClientHello extension seen; ServerHello extension seen; 123 # NewSessionTicket message seen; Abbreviated handshake. 124 checkmessages(7, "Empty ticket resumption test", 1, 1, 1, 0); 125 clearclient(); 126 $proxy->clientflags("-no_tls1_3 -sess_in ".$session); 127 $proxy->filter(undef); 128 $proxy->clientstart(); 129 #Expected result: ClientHello extension seen; ServerHello extension not seen; 130 # NewSessionTicket message not seen; Abbreviated handshake. 131 checkmessages(8, "Empty ticket resumption test", 1, 0, 0, 0); 132 unlink $session; 133 134 #Test 9: Bad server sends the ServerHello extension but does not send a 135 #NewSessionTicket 136 #Expected result: Connection failure 137 clearall(); 138 $proxy->clientflags("-no_tls1_3"); 139 $proxy->serverflags("-no_ticket"); 140 $proxy->filter(\&inject_ticket_extension_filter); 141 $proxy->start(); 142 ok(TLSProxy::Message->fail, "Server sends ticket extension but no ticket test"); 143 144 #Test10: Bad server does not send the ServerHello extension but does send a 145 #NewSessionTicket 146 #Expected result: Connection failure 147 clearall(); 148 $proxy->clientflags("-no_tls1_3"); 149 $proxy->serverflags("-no_ticket"); 150 $proxy->filter(\&inject_empty_ticket_filter); 151 $proxy->start(); 152 ok(TLSProxy::Message->fail, "No server ticket extension but ticket sent test"); 153 154 sub ticket_filter 155 { 156 my $proxy = shift; 157 158 foreach my $message (@{$proxy->message_list}) { 159 if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { 160 $message->ticket(""); 161 $message->repack(); 162 } 163 } 164 } 165 166 sub inject_empty_ticket_filter { 167 my $proxy = shift; 168 169 foreach my $message (@{$proxy->message_list}) { 170 if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { 171 # Only inject the message first time we're called. 172 return; 173 } 174 } 175 176 my @new_message_list = (); 177 foreach my $message (@{$proxy->message_list}) { 178 push @new_message_list, $message; 179 if ($message->mt == TLSProxy::Message::MT_SERVER_HELLO) { 180 $message->set_extension(TLSProxy::Message::EXT_SESSION_TICKET, ""); 181 $message->repack(); 182 # Tack NewSessionTicket onto the ServerHello record. 183 # This only works if the ServerHello is exactly one record. 184 my $record = ${$message->records}[0]; 185 186 my $offset = $message->startoffset + $message->encoded_length; 187 my $newsessionticket = TLSProxy::NewSessionTicket->new( 188 1, "", [$record], $offset, []); 189 $newsessionticket->repack(); 190 push @new_message_list, $newsessionticket; 191 } 192 } 193 $proxy->message_list([@new_message_list]); 194 } 195 196 sub inject_ticket_extension_filter 197 { 198 my $proxy = shift; 199 200 # We're only interested in the initial ServerHello 201 if ($proxy->flight != 1) { 202 return; 203 } 204 205 foreach my $message (@{$proxy->message_list}) { 206 if ($message->mt == TLSProxy::Message::MT_SERVER_HELLO) { 207 #Add the session ticket extension to the ServerHello even though 208 #we are not going to send a NewSessionTicket message 209 $message->set_extension(TLSProxy::Message::EXT_SESSION_TICKET, ""); 210 211 $message->repack(); 212 } 213 } 214 } 215 216 sub checkmessages($$$$$$) 217 { 218 my ($testno, $testname, $testch, $testsh, $testtickseen, $testhand) = @_; 219 220 subtest $testname => sub { 221 222 foreach my $message (@{$proxy->message_list}) { 223 if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO 224 || $message->mt == TLSProxy::Message::MT_SERVER_HELLO) { 225 #Get the extensions data 226 my %extensions = %{$message->extension_data}; 227 if (defined 228 $extensions{TLSProxy::Message::EXT_SESSION_TICKET}) { 229 if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) { 230 $chellotickext = 1; 231 } else { 232 $shellotickext = 1; 233 } 234 } 235 } elsif ($message->mt == TLSProxy::Message::MT_CERTIFICATE) { 236 #Must be doing a full handshake 237 $fullhand = 1; 238 } elsif ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { 239 $ticketseen = 1; 240 } 241 } 242 243 plan tests => 5; 244 245 ok(TLSProxy::Message->success, "Handshake"); 246 ok(($testch && $chellotickext) || (!$testch && !$chellotickext), 247 "ClientHello extension Session Ticket check"); 248 ok(($testsh && $shellotickext) || (!$testsh && !$shellotickext), 249 "ServerHello extension Session Ticket check"); 250 ok(($testtickseen && $ticketseen) || (!$testtickseen && !$ticketseen), 251 "Session Ticket message presence check"); 252 ok(($testhand && $fullhand) || (!$testhand && !$fullhand), 253 "Session Ticket full handshake check"); 254 } 255 } 256 257 258 sub clearclient() 259 { 260 $chellotickext = 0; 261 $shellotickext = 0; 262 $fullhand = 0; 263 $ticketseen = 0; 264 $proxy->clearClient(); 265 } 266 267 sub clearall() 268 { 269 clearclient(); 270 $proxy->clear(); 271 } 272
Indexes created Sat Feb 28 05:31:39 UTC 2026