70-test_tls13messages.t 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336
  1. #! /usr/bin/env perl
  2. # Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the OpenSSL license (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. use strict;
  9. use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
  10. use OpenSSL::Test::Utils;
  11. use File::Temp qw(tempfile);
  12. use TLSProxy::Proxy;
  13. use checkhandshake qw(checkhandshake @handmessages @extensions);
  14. my $test_name = "test_tls13messages";
  15. setup($test_name);
  16. plan skip_all => "TLSProxy isn't usable on $^O"
  17. if $^O =~ /^(VMS)$/;
  18. plan skip_all => "$test_name needs the dynamic engine feature enabled"
  19. if disabled("engine") || disabled("dynamic-engine");
  20. plan skip_all => "$test_name needs the sock feature enabled"
  21. if disabled("sock");
  22. plan skip_all => "$test_name needs TLSv1.3 enabled"
  23. if disabled("tls1_3");
  24. $ENV{OPENSSL_ia32cap} = '~0x200000200000000';
  25. $ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
  26. @handmessages = (
  27. [TLSProxy::Message::MT_CLIENT_HELLO,
  28. checkhandshake::ALL_HANDSHAKES],
  29. [TLSProxy::Message::MT_SERVER_HELLO,
  30. checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
  31. [TLSProxy::Message::MT_CLIENT_HELLO,
  32. checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
  33. [TLSProxy::Message::MT_SERVER_HELLO,
  34. checkhandshake::ALL_HANDSHAKES],
  35. [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
  36. checkhandshake::ALL_HANDSHAKES],
  37. [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
  38. checkhandshake::CLIENT_AUTH_HANDSHAKE],
  39. [TLSProxy::Message::MT_CERTIFICATE,
  40. checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
  41. [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
  42. checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
  43. [TLSProxy::Message::MT_FINISHED,
  44. checkhandshake::ALL_HANDSHAKES],
  45. [TLSProxy::Message::MT_CERTIFICATE,
  46. checkhandshake::CLIENT_AUTH_HANDSHAKE],
  47. [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
  48. checkhandshake::CLIENT_AUTH_HANDSHAKE],
  49. [TLSProxy::Message::MT_FINISHED,
  50. checkhandshake::ALL_HANDSHAKES],
  51. [0, 0]
  52. );
  53. @extensions = (
  54. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
  55. checkhandshake::SERVER_NAME_CLI_EXTENSION],
  56. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
  57. checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
  58. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
  59. checkhandshake::DEFAULT_EXTENSIONS],
  60. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
  61. checkhandshake::DEFAULT_EXTENSIONS],
  62. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
  63. checkhandshake::DEFAULT_EXTENSIONS],
  64. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
  65. checkhandshake::ALPN_CLI_EXTENSION],
  66. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
  67. checkhandshake::SCT_CLI_EXTENSION],
  68. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
  69. checkhandshake::DEFAULT_EXTENSIONS],
  70. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
  71. checkhandshake::DEFAULT_EXTENSIONS],
  72. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
  73. checkhandshake::DEFAULT_EXTENSIONS],
  74. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
  75. checkhandshake::DEFAULT_EXTENSIONS],
  76. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
  77. checkhandshake::DEFAULT_EXTENSIONS],
  78. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
  79. checkhandshake::DEFAULT_EXTENSIONS],
  80. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
  81. checkhandshake::PSK_CLI_EXTENSION],
  82. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
  83. checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],
  84. [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
  85. checkhandshake::DEFAULT_EXTENSIONS],
  86. [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
  87. checkhandshake::KEY_SHARE_HRR_EXTENSION],
  88. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
  89. checkhandshake::SERVER_NAME_CLI_EXTENSION],
  90. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
  91. checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
  92. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
  93. checkhandshake::DEFAULT_EXTENSIONS],
  94. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
  95. checkhandshake::DEFAULT_EXTENSIONS],
  96. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
  97. checkhandshake::DEFAULT_EXTENSIONS],
  98. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
  99. checkhandshake::ALPN_CLI_EXTENSION],
  100. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
  101. checkhandshake::SCT_CLI_EXTENSION],
  102. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
  103. checkhandshake::DEFAULT_EXTENSIONS],
  104. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
  105. checkhandshake::DEFAULT_EXTENSIONS],
  106. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
  107. checkhandshake::DEFAULT_EXTENSIONS],
  108. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
  109. checkhandshake::DEFAULT_EXTENSIONS],
  110. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
  111. checkhandshake::DEFAULT_EXTENSIONS],
  112. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
  113. checkhandshake::DEFAULT_EXTENSIONS],
  114. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
  115. checkhandshake::PSK_CLI_EXTENSION],
  116. [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
  117. checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],
  118. [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
  119. checkhandshake::DEFAULT_EXTENSIONS],
  120. [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
  121. checkhandshake::DEFAULT_EXTENSIONS],
  122. [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
  123. checkhandshake::PSK_SRV_EXTENSION],
  124. [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
  125. checkhandshake::SERVER_NAME_SRV_EXTENSION],
  126. [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
  127. checkhandshake::ALPN_SRV_EXTENSION],
  128. [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
  129. checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],
  130. [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
  131. checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
  132. [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
  133. checkhandshake::SCT_SRV_EXTENSION],
  134. [0,0,0]
  135. );
  136. my $proxy = TLSProxy::Proxy->new(
  137. undef,
  138. cmdstr(app(["openssl"]), display => 1),
  139. srctop_file("apps", "server.pem"),
  140. (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
  141. );
  142. #Test 1: Check we get all the right messages for a default handshake
  143. (undef, my $session) = tempfile();
  144. $proxy->serverconnects(2);
  145. $proxy->clientflags("-sess_out ".$session);
  146. $proxy->sessionfile($session);
  147. $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
  148. plan tests => 16;
  149. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  150. checkhandshake::DEFAULT_EXTENSIONS,
  151. "Default handshake test");
  152. #Test 2: Resumption handshake
  153. $proxy->clearClient();
  154. $proxy->clientflags("-sess_in ".$session);
  155. $proxy->clientstart();
  156. checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
  157. (checkhandshake::DEFAULT_EXTENSIONS
  158. | checkhandshake::PSK_CLI_EXTENSION
  159. | checkhandshake::PSK_SRV_EXTENSION),
  160. "Resumption handshake test");
  161. SKIP: {
  162. skip "No OCSP support in this OpenSSL build", 3
  163. if disabled("ct") || disabled("ec") || disabled("ocsp");
  164. #Test 3: A status_request handshake (client request only)
  165. $proxy->clear();
  166. $proxy->clientflags("-status");
  167. $proxy->start();
  168. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  169. checkhandshake::DEFAULT_EXTENSIONS
  170. | checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
  171. "status_request handshake test (client)");
  172. #Test 4: A status_request handshake (server support only)
  173. $proxy->clear();
  174. $proxy->serverflags("-status_file "
  175. .srctop_file("test", "recipes", "ocsp-response.der"));
  176. $proxy->start();
  177. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  178. checkhandshake::DEFAULT_EXTENSIONS,
  179. "status_request handshake test (server)");
  180. #Test 5: A status_request handshake (client and server)
  181. $proxy->clear();
  182. $proxy->clientflags("-status");
  183. $proxy->serverflags("-status_file "
  184. .srctop_file("test", "recipes", "ocsp-response.der"));
  185. $proxy->start();
  186. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  187. checkhandshake::DEFAULT_EXTENSIONS
  188. | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
  189. | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
  190. "status_request handshake test");
  191. }
  192. #Test 6: A client auth handshake
  193. $proxy->clear();
  194. $proxy->clientflags("-enable_pha -cert ".srctop_file("apps", "server.pem"));
  195. $proxy->serverflags("-Verify 5");
  196. $proxy->start();
  197. checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
  198. checkhandshake::DEFAULT_EXTENSIONS |
  199. checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
  200. "Client auth handshake test");
  201. #Test 7: Server name handshake (no client request)
  202. $proxy->clear();
  203. $proxy->clientflags("-noservername");
  204. $proxy->start();
  205. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  206. checkhandshake::DEFAULT_EXTENSIONS
  207. & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
  208. "Server name handshake test (client)");
  209. #Test 8: Server name handshake (server support only)
  210. $proxy->clear();
  211. $proxy->clientflags("-noservername");
  212. $proxy->serverflags("-servername testhost");
  213. $proxy->start();
  214. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  215. checkhandshake::DEFAULT_EXTENSIONS
  216. & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
  217. "Server name handshake test (server)");
  218. #Test 9: Server name handshake (client and server)
  219. $proxy->clear();
  220. $proxy->clientflags("-servername testhost");
  221. $proxy->serverflags("-servername testhost");
  222. $proxy->start();
  223. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  224. checkhandshake::DEFAULT_EXTENSIONS
  225. | checkhandshake::SERVER_NAME_SRV_EXTENSION,
  226. "Server name handshake test");
  227. #Test 10: ALPN handshake (client request only)
  228. $proxy->clear();
  229. $proxy->clientflags("-alpn test");
  230. $proxy->start();
  231. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  232. checkhandshake::DEFAULT_EXTENSIONS
  233. | checkhandshake::ALPN_CLI_EXTENSION,
  234. "ALPN handshake test (client)");
  235. #Test 11: ALPN handshake (server support only)
  236. $proxy->clear();
  237. $proxy->serverflags("-alpn test");
  238. $proxy->start();
  239. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  240. checkhandshake::DEFAULT_EXTENSIONS,
  241. "ALPN handshake test (server)");
  242. #Test 12: ALPN handshake (client and server)
  243. $proxy->clear();
  244. $proxy->clientflags("-alpn test");
  245. $proxy->serverflags("-alpn test");
  246. $proxy->start();
  247. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  248. checkhandshake::DEFAULT_EXTENSIONS
  249. | checkhandshake::ALPN_CLI_EXTENSION
  250. | checkhandshake::ALPN_SRV_EXTENSION,
  251. "ALPN handshake test");
  252. SKIP: {
  253. skip "No CT, EC or OCSP support in this OpenSSL build", 1
  254. if disabled("ct") || disabled("ec") || disabled("ocsp");
  255. #Test 13: SCT handshake (client request only)
  256. $proxy->clear();
  257. #Note: -ct also sends status_request
  258. $proxy->clientflags("-ct");
  259. $proxy->serverflags("-status_file "
  260. .srctop_file("test", "recipes", "ocsp-response.der")
  261. ." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
  262. $proxy->start();
  263. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  264. checkhandshake::DEFAULT_EXTENSIONS
  265. | checkhandshake::SCT_CLI_EXTENSION
  266. | checkhandshake::SCT_SRV_EXTENSION
  267. | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
  268. | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
  269. "SCT handshake test");
  270. }
  271. #Test 14: HRR Handshake
  272. $proxy->clear();
  273. $proxy->serverflags("-curves P-256");
  274. $proxy->start();
  275. checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
  276. checkhandshake::DEFAULT_EXTENSIONS
  277. | checkhandshake::KEY_SHARE_HRR_EXTENSION,
  278. "HRR handshake test");
  279. #Test 15: Resumption handshake with HRR
  280. $proxy->clear();
  281. $proxy->clientflags("-sess_in ".$session);
  282. $proxy->serverflags("-curves P-256");
  283. $proxy->start();
  284. checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
  285. (checkhandshake::DEFAULT_EXTENSIONS
  286. | checkhandshake::KEY_SHARE_HRR_EXTENSION
  287. | checkhandshake::PSK_CLI_EXTENSION
  288. | checkhandshake::PSK_SRV_EXTENSION),
  289. "Resumption handshake with HRR test");
  290. #Test 16: Acceptable but non preferred key_share
  291. $proxy->clear();
  292. $proxy->clientflags("-curves P-256");
  293. $proxy->start();
  294. checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
  295. checkhandshake::DEFAULT_EXTENSIONS
  296. | checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
  297. "Acceptable but non preferred key_share");
  298. unlink $session;