1 #! /usr/bin/env perl 2 # Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved. 3 # 4 # Licensed under the Apache License 2.0 (the "License"). You may not use 5 # this file except in compliance with the License. You can obtain a copy 6 # in the file LICENSE in the source distribution or at 7 # https://www.openssl.org/source/license.html 8 9 use strict; 10 use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/; 11 use OpenSSL::Test::Utils; 12 use File::Temp qw(tempfile); 13 use TLSProxy::Proxy; 14 use checkhandshake qw(checkhandshake @handmessages @extensions); 15 16 my $test_name = "test_tls13messages"; 17 setup($test_name); 18 19 plan skip_all => "TLSProxy isn't usable on $^O" 20 if $^O =~ /^(VMS)$/; 21 22 plan skip_all => "$test_name needs the dynamic engine feature enabled" 23 if disabled("engine") || disabled("dynamic-engine"); 24 25 plan skip_all => "$test_name needs the sock feature enabled" 26 if disabled("sock"); 27 28 plan skip_all => "$test_name needs TLSv1.3 enabled" 29 if disabled("tls1_3"); 30 31 plan skip_all => "$test_name needs EC enabled" 32 if disabled("ec"); 33 34 $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; 35 36 @handmessages = ( 37 [TLSProxy::Message::MT_CLIENT_HELLO, 38 checkhandshake::ALL_HANDSHAKES], 39 [TLSProxy::Message::MT_SERVER_HELLO, 40 checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE], 41 [TLSProxy::Message::MT_CLIENT_HELLO, 42 checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE], 43 [TLSProxy::Message::MT_SERVER_HELLO, 44 checkhandshake::ALL_HANDSHAKES], 45 [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, 46 checkhandshake::ALL_HANDSHAKES], 47 [TLSProxy::Message::MT_CERTIFICATE_REQUEST, 48 checkhandshake::CLIENT_AUTH_HANDSHAKE], 49 [TLSProxy::Message::MT_CERTIFICATE, 50 checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)], 51 [TLSProxy::Message::MT_CERTIFICATE_VERIFY, 52 checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)], 53 [TLSProxy::Message::MT_FINISHED, 54 checkhandshake::ALL_HANDSHAKES], 55 [TLSProxy::Message::MT_CERTIFICATE, 56 checkhandshake::CLIENT_AUTH_HANDSHAKE], 57 [TLSProxy::Message::MT_CERTIFICATE_VERIFY, 58 checkhandshake::CLIENT_AUTH_HANDSHAKE], 59 [TLSProxy::Message::MT_FINISHED, 60 checkhandshake::ALL_HANDSHAKES], 61 [0, 0] 62 ); 63 64 @extensions = ( 65 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME, 66 TLSProxy::Message::CLIENT, 67 checkhandshake::SERVER_NAME_CLI_EXTENSION], 68 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST, 69 TLSProxy::Message::CLIENT, 70 checkhandshake::STATUS_REQUEST_CLI_EXTENSION], 71 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS, 72 TLSProxy::Message::CLIENT, 73 checkhandshake::DEFAULT_EXTENSIONS], 74 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS, 75 TLSProxy::Message::CLIENT, 76 checkhandshake::DEFAULT_EXTENSIONS], 77 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS, 78 TLSProxy::Message::CLIENT, 79 checkhandshake::DEFAULT_EXTENSIONS], 80 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN, 81 TLSProxy::Message::CLIENT, 82 checkhandshake::ALPN_CLI_EXTENSION], 83 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT, 84 TLSProxy::Message::CLIENT, 85 checkhandshake::SCT_CLI_EXTENSION], 86 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC, 87 TLSProxy::Message::CLIENT, 88 checkhandshake::DEFAULT_EXTENSIONS], 89 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET, 90 TLSProxy::Message::CLIENT, 91 checkhandshake::DEFAULT_EXTENSIONS], 92 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET, 93 TLSProxy::Message::CLIENT, 94 checkhandshake::DEFAULT_EXTENSIONS], 95 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE, 96 TLSProxy::Message::CLIENT, 97 checkhandshake::DEFAULT_EXTENSIONS], 98 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS, 99 TLSProxy::Message::CLIENT, 100 checkhandshake::DEFAULT_EXTENSIONS], 101 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES, 102 TLSProxy::Message::CLIENT, 103 checkhandshake::DEFAULT_EXTENSIONS], 104 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK, 105 TLSProxy::Message::CLIENT, 106 checkhandshake::PSK_CLI_EXTENSION], 107 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH, 108 TLSProxy::Message::CLIENT, 109 checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION], 110 111 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS, 112 TLSProxy::Message::SERVER, 113 checkhandshake::DEFAULT_EXTENSIONS], 114 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE, 115 TLSProxy::Message::SERVER, 116 checkhandshake::KEY_SHARE_HRR_EXTENSION], 117 118 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME, 119 TLSProxy::Message::CLIENT, 120 checkhandshake::SERVER_NAME_CLI_EXTENSION], 121 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST, 122 TLSProxy::Message::CLIENT, 123 checkhandshake::STATUS_REQUEST_CLI_EXTENSION], 124 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS, 125 TLSProxy::Message::CLIENT, 126 checkhandshake::DEFAULT_EXTENSIONS], 127 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS, 128 TLSProxy::Message::CLIENT, 129 checkhandshake::DEFAULT_EXTENSIONS], 130 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS, 131 TLSProxy::Message::CLIENT, 132 checkhandshake::DEFAULT_EXTENSIONS], 133 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN, 134 TLSProxy::Message::CLIENT, 135 checkhandshake::ALPN_CLI_EXTENSION], 136 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT, 137 TLSProxy::Message::CLIENT, 138 checkhandshake::SCT_CLI_EXTENSION], 139 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC, 140 TLSProxy::Message::CLIENT, 141 checkhandshake::DEFAULT_EXTENSIONS], 142 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET, 143 TLSProxy::Message::CLIENT, 144 checkhandshake::DEFAULT_EXTENSIONS], 145 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET, 146 TLSProxy::Message::CLIENT, 147 checkhandshake::DEFAULT_EXTENSIONS], 148 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE, 149 TLSProxy::Message::CLIENT, 150 checkhandshake::DEFAULT_EXTENSIONS], 151 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS, 152 TLSProxy::Message::CLIENT, 153 checkhandshake::DEFAULT_EXTENSIONS], 154 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES, 155 TLSProxy::Message::CLIENT, 156 checkhandshake::DEFAULT_EXTENSIONS], 157 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK, 158 TLSProxy::Message::CLIENT, 159 checkhandshake::PSK_CLI_EXTENSION], 160 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH, 161 TLSProxy::Message::CLIENT, 162 checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION], 163 164 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS, 165 TLSProxy::Message::SERVER, 166 checkhandshake::DEFAULT_EXTENSIONS], 167 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE, 168 TLSProxy::Message::SERVER, 169 checkhandshake::DEFAULT_EXTENSIONS], 170 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK, 171 TLSProxy::Message::SERVER, 172 checkhandshake::PSK_SRV_EXTENSION], 173 174 [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME, 175 TLSProxy::Message::SERVER, 176 checkhandshake::SERVER_NAME_SRV_EXTENSION], 177 [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN, 178 TLSProxy::Message::SERVER, 179 checkhandshake::ALPN_SRV_EXTENSION], 180 [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS, 181 TLSProxy::Message::SERVER, 182 checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION], 183 184 [TLSProxy::Message::MT_CERTIFICATE_REQUEST, TLSProxy::Message::EXT_SIG_ALGS, 185 TLSProxy::Message::SERVER, 186 checkhandshake::DEFAULT_EXTENSIONS], 187 188 [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST, 189 TLSProxy::Message::SERVER, 190 checkhandshake::STATUS_REQUEST_SRV_EXTENSION], 191 [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT, 192 TLSProxy::Message::SERVER, 193 checkhandshake::SCT_SRV_EXTENSION], 194 195 [0,0,0,0] 196 ); 197 198 my $proxy = TLSProxy::Proxy->new( 199 undef, 200 cmdstr(app(["openssl"]), display => 1), 201 srctop_file("apps", "server.pem"), 202 (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) 203 ); 204 205 #Test 1: Check we get all the right messages for a default handshake 206 (undef, my $session) = tempfile(); 207 $proxy->serverconnects(2); 208 $proxy->clientflags("-sess_out ".$session); 209 $proxy->sessionfile($session); 210 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; 211 plan tests => 17; 212 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 213 checkhandshake::DEFAULT_EXTENSIONS, 214 "Default handshake test"); 215 216 #Test 2: Resumption handshake 217 $proxy->clearClient(); 218 $proxy->clientflags("-sess_in ".$session); 219 $proxy->clientstart(); 220 checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE, 221 (checkhandshake::DEFAULT_EXTENSIONS 222 | checkhandshake::PSK_CLI_EXTENSION 223 | checkhandshake::PSK_SRV_EXTENSION), 224 "Resumption handshake test"); 225 226 SKIP: { 227 skip "No OCSP support in this OpenSSL build", 4 228 if disabled("ct") || disabled("ec") || disabled("ocsp"); 229 #Test 3: A status_request handshake (client request only) 230 $proxy->clear(); 231 $proxy->clientflags("-status"); 232 $proxy->start(); 233 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 234 checkhandshake::DEFAULT_EXTENSIONS 235 | checkhandshake::STATUS_REQUEST_CLI_EXTENSION, 236 "status_request handshake test (client)"); 237 238 #Test 4: A status_request handshake (server support only) 239 $proxy->clear(); 240 $proxy->serverflags("-status_file " 241 .srctop_file("test", "recipes", "ocsp-response.der")); 242 $proxy->start(); 243 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 244 checkhandshake::DEFAULT_EXTENSIONS, 245 "status_request handshake test (server)"); 246 247 #Test 5: A status_request handshake (client and server) 248 $proxy->clear(); 249 $proxy->clientflags("-status"); 250 $proxy->serverflags("-status_file " 251 .srctop_file("test", "recipes", "ocsp-response.der")); 252 $proxy->start(); 253 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 254 checkhandshake::DEFAULT_EXTENSIONS 255 | checkhandshake::STATUS_REQUEST_CLI_EXTENSION 256 | checkhandshake::STATUS_REQUEST_SRV_EXTENSION, 257 "status_request handshake test"); 258 259 #Test 6: A status_request handshake (client and server) with client auth 260 $proxy->clear(); 261 $proxy->clientflags("-status -enable_pha -cert " 262 .srctop_file("apps", "server.pem")); 263 $proxy->serverflags("-Verify 5 -status_file " 264 .srctop_file("test", "recipes", "ocsp-response.der")); 265 $proxy->start(); 266 checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE, 267 checkhandshake::DEFAULT_EXTENSIONS 268 | checkhandshake::STATUS_REQUEST_CLI_EXTENSION 269 | checkhandshake::STATUS_REQUEST_SRV_EXTENSION 270 | checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION, 271 "status_request handshake with client auth test"); 272 } 273 274 #Test 7: A client auth handshake 275 $proxy->clear(); 276 $proxy->clientflags("-enable_pha -cert ".srctop_file("apps", "server.pem")); 277 $proxy->serverflags("-Verify 5"); 278 $proxy->start(); 279 checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE, 280 checkhandshake::DEFAULT_EXTENSIONS | 281 checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION, 282 "Client auth handshake test"); 283 284 #Test 8: Server name handshake (no client request) 285 $proxy->clear(); 286 $proxy->clientflags("-noservername"); 287 $proxy->start(); 288 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 289 checkhandshake::DEFAULT_EXTENSIONS 290 & ~checkhandshake::SERVER_NAME_CLI_EXTENSION, 291 "Server name handshake test (client)"); 292 293 #Test 9: Server name handshake (server support only) 294 $proxy->clear(); 295 $proxy->clientflags("-noservername"); 296 $proxy->serverflags("-servername testhost"); 297 $proxy->start(); 298 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 299 checkhandshake::DEFAULT_EXTENSIONS 300 & ~checkhandshake::SERVER_NAME_CLI_EXTENSION, 301 "Server name handshake test (server)"); 302 303 #Test 10: Server name handshake (client and server) 304 $proxy->clear(); 305 $proxy->clientflags("-servername testhost"); 306 $proxy->serverflags("-servername testhost"); 307 $proxy->start(); 308 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 309 checkhandshake::DEFAULT_EXTENSIONS 310 | checkhandshake::SERVER_NAME_SRV_EXTENSION, 311 "Server name handshake test"); 312 313 #Test 11: ALPN handshake (client request only) 314 $proxy->clear(); 315 $proxy->clientflags("-alpn test"); 316 $proxy->start(); 317 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 318 checkhandshake::DEFAULT_EXTENSIONS 319 | checkhandshake::ALPN_CLI_EXTENSION, 320 "ALPN handshake test (client)"); 321 322 #Test 12: ALPN handshake (server support only) 323 $proxy->clear(); 324 $proxy->serverflags("-alpn test"); 325 $proxy->start(); 326 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 327 checkhandshake::DEFAULT_EXTENSIONS, 328 "ALPN handshake test (server)"); 329 330 #Test 13: ALPN handshake (client and server) 331 $proxy->clear(); 332 $proxy->clientflags("-alpn test"); 333 $proxy->serverflags("-alpn test"); 334 $proxy->start(); 335 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 336 checkhandshake::DEFAULT_EXTENSIONS 337 | checkhandshake::ALPN_CLI_EXTENSION 338 | checkhandshake::ALPN_SRV_EXTENSION, 339 "ALPN handshake test"); 340 341 SKIP: { 342 skip "No CT, EC or OCSP support in this OpenSSL build", 1 343 if disabled("ct") || disabled("ec") || disabled("ocsp"); 344 345 #Test 14: SCT handshake (client request only) 346 $proxy->clear(); 347 #Note: -ct also sends status_request 348 $proxy->clientflags("-ct"); 349 $proxy->serverflags("-status_file " 350 .srctop_file("test", "recipes", "ocsp-response.der") 351 ." -serverinfo ".srctop_file("test", "serverinfo2.pem")); 352 $proxy->start(); 353 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 354 checkhandshake::DEFAULT_EXTENSIONS 355 | checkhandshake::SCT_CLI_EXTENSION 356 | checkhandshake::SCT_SRV_EXTENSION 357 | checkhandshake::STATUS_REQUEST_CLI_EXTENSION 358 | checkhandshake::STATUS_REQUEST_SRV_EXTENSION, 359 "SCT handshake test"); 360 } 361 362 #Test 15: HRR Handshake 363 $proxy->clear(); 364 $proxy->serverflags("-curves P-256"); 365 $proxy->start(); 366 checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE, 367 checkhandshake::DEFAULT_EXTENSIONS 368 | checkhandshake::KEY_SHARE_HRR_EXTENSION, 369 "HRR handshake test"); 370 371 #Test 16: Resumption handshake with HRR 372 $proxy->clear(); 373 $proxy->clientflags("-sess_in ".$session); 374 $proxy->serverflags("-curves P-256"); 375 $proxy->start(); 376 checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE, 377 (checkhandshake::DEFAULT_EXTENSIONS 378 | checkhandshake::KEY_SHARE_HRR_EXTENSION 379 | checkhandshake::PSK_CLI_EXTENSION 380 | checkhandshake::PSK_SRV_EXTENSION), 381 "Resumption handshake with HRR test"); 382 383 #Test 17: Acceptable but non preferred key_share 384 $proxy->clear(); 385 $proxy->clientflags("-curves P-256"); 386 $proxy->start(); 387 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, 388 checkhandshake::DEFAULT_EXTENSIONS 389 | checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION, 390 "Acceptable but non preferred key_share"); 391 392 unlink $session; 393
Indexes created Sun Mar 01 05:31:48 UTC 2026