70-test_key_share.t 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388
  1. #! /usr/bin/env perl
  2. # Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the OpenSSL license (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. use strict;
  9. use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/;
  10. use OpenSSL::Test::Utils;
  11. use TLSProxy::Proxy;
  12. use File::Temp qw(tempfile);
  13. use constant {
  14. LOOK_ONLY => 0,
  15. EMPTY_EXTENSION => 1,
  16. MISSING_EXTENSION => 2,
  17. NO_ACCEPTABLE_KEY_SHARES => 3,
  18. NON_PREFERRED_KEY_SHARE => 4,
  19. ACCEPTABLE_AT_END => 5,
  20. NOT_IN_SUPPORTED_GROUPS => 6,
  21. GROUP_ID_TOO_SHORT => 7,
  22. KEX_LEN_MISMATCH => 8,
  23. ZERO_LEN_KEX_DATA => 9,
  24. TRAILING_DATA => 10,
  25. SELECT_X25519 => 11,
  26. NO_KEY_SHARES_IN_HRR => 12
  27. };
  28. use constant {
  29. CLIENT_TO_SERVER => 1,
  30. SERVER_TO_CLIENT => 2
  31. };
  32. use constant {
  33. X25519 => 0x1d,
  34. P_256 => 0x17
  35. };
  36. my $testtype;
  37. my $direction;
  38. my $selectedgroupid;
  39. my $test_name = "test_key_share";
  40. setup($test_name);
  41. plan skip_all => "TLSProxy isn't usable on $^O"
  42. if $^O =~ /^(VMS)$/;
  43. plan skip_all => "$test_name needs the dynamic engine feature enabled"
  44. if disabled("engine") || disabled("dynamic-engine");
  45. plan skip_all => "$test_name needs the sock feature enabled"
  46. if disabled("sock");
  47. plan skip_all => "$test_name needs TLS1.3 enabled"
  48. if disabled("tls1_3");
  49. $ENV{OPENSSL_ia32cap} = '~0x200000200000000';
  50. my $proxy = TLSProxy::Proxy->new(
  51. undef,
  52. cmdstr(app(["openssl"]), display => 1),
  53. srctop_file("apps", "server.pem"),
  54. (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
  55. );
  56. #We assume that test_ssl_new and friends will test the happy path for this,
  57. #so we concentrate on the less common scenarios
  58. #Test 1: An empty key_shares extension should succeed after a HelloRetryRequest
  59. $testtype = EMPTY_EXTENSION;
  60. $direction = CLIENT_TO_SERVER;
  61. $proxy->filter(\&modify_key_shares_filter);
  62. $proxy->serverflags("-curves P-256");
  63. $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
  64. plan tests => 22;
  65. ok(TLSProxy::Message->success(), "Success after HRR");
  66. #Test 2: The server sending an HRR requesting a group the client already sent
  67. # should fail
  68. $proxy->clear();
  69. $proxy->start();
  70. ok(TLSProxy::Message->fail(), "Server asks for group already provided");
  71. #Test 3: A missing key_shares extension should not succeed
  72. $proxy->clear();
  73. $testtype = MISSING_EXTENSION;
  74. $proxy->start();
  75. ok(TLSProxy::Message->fail(), "Missing key_shares extension");
  76. #Test 4: No initial acceptable key_shares should succeed after a
  77. # HelloRetryRequest
  78. $proxy->clear();
  79. $proxy->filter(undef);
  80. $proxy->serverflags("-curves P-256");
  81. $proxy->start();
  82. ok(TLSProxy::Message->success(), "No initial acceptable key_shares");
  83. #Test 5: No acceptable key_shares and no shared groups should fail
  84. $proxy->clear();
  85. $proxy->filter(undef);
  86. $proxy->serverflags("-curves P-256");
  87. $proxy->clientflags("-curves P-384");
  88. $proxy->start();
  89. ok(TLSProxy::Message->fail(), "No acceptable key_shares");
  90. #Test 6: A non preferred but acceptable key_share should succeed
  91. $proxy->clear();
  92. $proxy->clientflags("-curves P-256");
  93. $proxy->start();
  94. ok(TLSProxy::Message->success(), "Non preferred key_share");
  95. $proxy->filter(\&modify_key_shares_filter);
  96. #Test 7: An acceptable key_share after a list of non-acceptable ones should
  97. #succeed
  98. $proxy->clear();
  99. $testtype = ACCEPTABLE_AT_END;
  100. $proxy->start();
  101. ok(TLSProxy::Message->success(), "Acceptable key_share at end of list");
  102. #Test 8: An acceptable key_share but for a group not in supported_groups should
  103. #fail
  104. $proxy->clear();
  105. $testtype = NOT_IN_SUPPORTED_GROUPS;
  106. $proxy->start();
  107. ok(TLSProxy::Message->fail(), "Acceptable key_share not in supported_groups");
  108. #Test 9: Too short group_id should fail
  109. $proxy->clear();
  110. $testtype = GROUP_ID_TOO_SHORT;
  111. $proxy->start();
  112. ok(TLSProxy::Message->fail(), "Group id too short");
  113. #Test 10: key_exchange length mismatch should fail
  114. $proxy->clear();
  115. $testtype = KEX_LEN_MISMATCH;
  116. $proxy->start();
  117. ok(TLSProxy::Message->fail(), "key_exchange length mismatch");
  118. #Test 11: Zero length key_exchange should fail
  119. $proxy->clear();
  120. $testtype = ZERO_LEN_KEX_DATA;
  121. $proxy->start();
  122. ok(TLSProxy::Message->fail(), "zero length key_exchange data");
  123. #Test 12: Trailing data on key_share list should fail
  124. $proxy->clear();
  125. $testtype = TRAILING_DATA;
  126. $proxy->start();
  127. ok(TLSProxy::Message->fail(), "key_share list trailing data");
  128. #Test 13: Multiple acceptable key_shares - we choose the first one
  129. $proxy->clear();
  130. $direction = SERVER_TO_CLIENT;
  131. $testtype = LOOK_ONLY;
  132. $proxy->clientflags("-curves P-256:X25519");
  133. $proxy->start();
  134. ok(TLSProxy::Message->success() && ($selectedgroupid == P_256),
  135. "Multiple acceptable key_shares");
  136. #Test 14: Multiple acceptable key_shares - we choose the first one (part 2)
  137. $proxy->clear();
  138. $proxy->clientflags("-curves X25519:P-256");
  139. $proxy->start();
  140. ok(TLSProxy::Message->success() && ($selectedgroupid == X25519),
  141. "Multiple acceptable key_shares (part 2)");
  142. #Test 15: Server sends key_share that wasn't offered should fail
  143. $proxy->clear();
  144. $testtype = SELECT_X25519;
  145. $proxy->clientflags("-curves P-256");
  146. $proxy->start();
  147. ok(TLSProxy::Message->fail(), "Non offered key_share");
  148. #Test 16: Too short group_id in ServerHello should fail
  149. $proxy->clear();
  150. $testtype = GROUP_ID_TOO_SHORT;
  151. $proxy->start();
  152. ok(TLSProxy::Message->fail(), "Group id too short in ServerHello");
  153. #Test 17: key_exchange length mismatch in ServerHello should fail
  154. $proxy->clear();
  155. $testtype = KEX_LEN_MISMATCH;
  156. $proxy->start();
  157. ok(TLSProxy::Message->fail(), "key_exchange length mismatch in ServerHello");
  158. #Test 18: Zero length key_exchange in ServerHello should fail
  159. $proxy->clear();
  160. $testtype = ZERO_LEN_KEX_DATA;
  161. $proxy->start();
  162. ok(TLSProxy::Message->fail(), "zero length key_exchange data in ServerHello");
  163. #Test 19: Trailing data on key_share in ServerHello should fail
  164. $proxy->clear();
  165. $testtype = TRAILING_DATA;
  166. $proxy->start();
  167. ok(TLSProxy::Message->fail(), "key_share trailing data in ServerHello");
  168. SKIP: {
  169. skip "No TLSv1.2 support in this OpenSSL build", 2 if disabled("tls1_2");
  170. #Test 20: key_share should not be sent if the client is not capable of
  171. # negotiating TLSv1.3
  172. $proxy->clear();
  173. $proxy->filter(undef);
  174. $proxy->clientflags("-no_tls1_3");
  175. $proxy->start();
  176. my $clienthello = $proxy->message_list->[0];
  177. ok(TLSProxy::Message->success()
  178. && !defined $clienthello->extension_data->{TLSProxy::Message::EXT_KEY_SHARE},
  179. "No key_share for TLS<=1.2 client");
  180. $proxy->filter(\&modify_key_shares_filter);
  181. #Test 21: A server not capable of negotiating TLSv1.3 should not attempt to
  182. # process a key_share
  183. $proxy->clear();
  184. $direction = CLIENT_TO_SERVER;
  185. $testtype = NO_ACCEPTABLE_KEY_SHARES;
  186. $proxy->serverflags("-no_tls1_3");
  187. $proxy->start();
  188. ok(TLSProxy::Message->success(), "Ignore key_share for TLS<=1.2 server");
  189. }
  190. #Test 22: The server sending an HRR but not requesting a new key_share should
  191. # fail
  192. $proxy->clear();
  193. $direction = SERVER_TO_CLIENT;
  194. $testtype = NO_KEY_SHARES_IN_HRR;
  195. $proxy->serverflags("-curves X25519");
  196. $proxy->start();
  197. ok(TLSProxy::Message->fail(), "Server sends HRR with no key_shares");
  198. sub modify_key_shares_filter
  199. {
  200. my $proxy = shift;
  201. # We're only interested in the initial ClientHello
  202. if (($direction == CLIENT_TO_SERVER && $proxy->flight != 0
  203. && ($proxy->flight != 1 || $testtype != NO_KEY_SHARES_IN_HRR))
  204. || ($direction == SERVER_TO_CLIENT && $proxy->flight != 1)) {
  205. return;
  206. }
  207. foreach my $message (@{$proxy->message_list}) {
  208. if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO
  209. && $direction == CLIENT_TO_SERVER) {
  210. my $ext;
  211. my $suppgroups;
  212. #Setup supported groups to include some unrecognised groups
  213. $suppgroups = pack "C8",
  214. 0x00, 0x06, #List Length
  215. 0xff, 0xfe, #Non existing group 1
  216. 0xff, 0xff, #Non existing group 2
  217. 0x00, 0x1d; #x25519
  218. if ($testtype == EMPTY_EXTENSION) {
  219. $ext = pack "C2",
  220. 0x00, 0x00;
  221. } elsif ($testtype == NO_ACCEPTABLE_KEY_SHARES) {
  222. $ext = pack "C12",
  223. 0x00, 0x0a, #List Length
  224. 0xff, 0xfe, #Non existing group 1
  225. 0x00, 0x01, 0xff, #key_exchange data
  226. 0xff, 0xff, #Non existing group 2
  227. 0x00, 0x01, 0xff; #key_exchange data
  228. } elsif ($testtype == ACCEPTABLE_AT_END) {
  229. $ext = pack "C11H64",
  230. 0x00, 0x29, #List Length
  231. 0xff, 0xfe, #Non existing group 1
  232. 0x00, 0x01, 0xff, #key_exchange data
  233. 0x00, 0x1d, #x25519
  234. 0x00, 0x20, #key_exchange data length
  235. "155155B95269ED5C87EAA99C2EF5A593".
  236. "EDF83495E80380089F831B94D14B1421"; #key_exchange data
  237. } elsif ($testtype == NOT_IN_SUPPORTED_GROUPS) {
  238. $suppgroups = pack "C4",
  239. 0x00, 0x02, #List Length
  240. 0x00, 0xfe; #Non existing group 1
  241. } elsif ($testtype == GROUP_ID_TOO_SHORT) {
  242. $ext = pack "C6H64C1",
  243. 0x00, 0x25, #List Length
  244. 0x00, 0x1d, #x25519
  245. 0x00, 0x20, #key_exchange data length
  246. "155155B95269ED5C87EAA99C2EF5A593".
  247. "EDF83495E80380089F831B94D14B1421"; #key_exchange data
  248. 0x00; #Group id too short
  249. } elsif ($testtype == KEX_LEN_MISMATCH) {
  250. $ext = pack "C8",
  251. 0x00, 0x06, #List Length
  252. 0x00, 0x1d, #x25519
  253. 0x00, 0x20, #key_exchange data length
  254. 0x15, 0x51; #Only two bytes of data, but length should be 32
  255. } elsif ($testtype == ZERO_LEN_KEX_DATA) {
  256. $ext = pack "C10H64",
  257. 0x00, 0x28, #List Length
  258. 0xff, 0xfe, #Non existing group 1
  259. 0x00, 0x00, #zero length key_exchange data is invalid
  260. 0x00, 0x1d, #x25519
  261. 0x00, 0x20, #key_exchange data length
  262. "155155B95269ED5C87EAA99C2EF5A593".
  263. "EDF83495E80380089F831B94D14B1421"; #key_exchange data
  264. } elsif ($testtype == TRAILING_DATA) {
  265. $ext = pack "C6H64C1",
  266. 0x00, 0x24, #List Length
  267. 0x00, 0x1d, #x25519
  268. 0x00, 0x20, #key_exchange data length
  269. "155155B95269ED5C87EAA99C2EF5A593".
  270. "EDF83495E80380089F831B94D14B1421", #key_exchange data
  271. 0x00; #Trailing garbage
  272. } elsif ($testtype == NO_KEY_SHARES_IN_HRR) {
  273. #We trick the server into thinking we sent a P-256 key_share -
  274. #but the client actually sent X25519
  275. $ext = pack "C7",
  276. 0x00, 0x05, #List Length
  277. 0x00, 0x17, #P-256
  278. 0x00, 0x01, #key_exchange data length
  279. 0xff; #Dummy key_share data
  280. }
  281. if ($testtype != EMPTY_EXTENSION
  282. && $testtype != NO_KEY_SHARES_IN_HRR) {
  283. $message->set_extension(
  284. TLSProxy::Message::EXT_SUPPORTED_GROUPS, $suppgroups);
  285. }
  286. if ($testtype == MISSING_EXTENSION) {
  287. $message->delete_extension(
  288. TLSProxy::Message::EXT_KEY_SHARE);
  289. } elsif ($testtype != NOT_IN_SUPPORTED_GROUPS) {
  290. $message->set_extension(
  291. TLSProxy::Message::EXT_KEY_SHARE, $ext);
  292. }
  293. $message->repack();
  294. } elsif ($message->mt == TLSProxy::Message::MT_SERVER_HELLO
  295. && $direction == SERVER_TO_CLIENT) {
  296. my $ext;
  297. my $key_share =
  298. $message->extension_data->{TLSProxy::Message::EXT_KEY_SHARE};
  299. $selectedgroupid = unpack("n", $key_share);
  300. if ($testtype == LOOK_ONLY) {
  301. return;
  302. }
  303. if ($testtype == NO_KEY_SHARES_IN_HRR) {
  304. $message->delete_extension(TLSProxy::Message::EXT_KEY_SHARE);
  305. $message->set_extension(TLSProxy::Message::EXT_UNKNOWN, "");
  306. $message->repack();
  307. return;
  308. }
  309. if ($testtype == SELECT_X25519) {
  310. $ext = pack "C4H64",
  311. 0x00, 0x1d, #x25519
  312. 0x00, 0x20, #key_exchange data length
  313. "155155B95269ED5C87EAA99C2EF5A593".
  314. "EDF83495E80380089F831B94D14B1421"; #key_exchange data
  315. } elsif ($testtype == GROUP_ID_TOO_SHORT) {
  316. $ext = pack "C1",
  317. 0x00;
  318. } elsif ($testtype == KEX_LEN_MISMATCH) {
  319. $ext = pack "C6",
  320. 0x00, 0x1d, #x25519
  321. 0x00, 0x20, #key_exchange data length
  322. 0x15, 0x51; #Only two bytes of data, but length should be 32
  323. } elsif ($testtype == ZERO_LEN_KEX_DATA) {
  324. $ext = pack "C4",
  325. 0x00, 0x1d, #x25519
  326. 0x00, 0x00, #zero length key_exchange data is invalid
  327. } elsif ($testtype == TRAILING_DATA) {
  328. $ext = pack "C4H64C1",
  329. 0x00, 0x1d, #x25519
  330. 0x00, 0x20, #key_exchange data length
  331. "155155B95269ED5C87EAA99C2EF5A593".
  332. "EDF83495E80380089F831B94D14B1421", #key_exchange data
  333. 0x00; #Trailing garbage
  334. }
  335. $message->set_extension(TLSProxy::Message::EXT_KEY_SHARE, $ext);
  336. $message->repack();
  337. }
  338. }
  339. }