test/recipes/70-test_sslmessages.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the OpenSSL license (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9 use strict;
  10 use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
  11 use OpenSSL::Test::Utils;
  12 use File::Temp qw(tempfile);
  13 use TLSProxy::Proxy;
  14
  15 my $test_name;
  16
  17 # This block needs to run before 'use lib srctop_dir' directives.
  18 BEGIN {
  19     $test_name = "test_sslmessages";
  20     OpenSSL::Test::setup($test_name);
  21 }
  22
  23 use lib srctop_dir("test", "recipes");
  24
  25 use recipes::checkhandshake qw(checkhandshake @handmessages @extensions);
  26
  27 plan skip_all => "TLSProxy isn't usable on $^O"
  28     if $^O =~ /^(VMS|MSWin32)$/;
  29
  30 plan skip_all => "$test_name needs the dynamic engine feature enabled"
  31     if disabled("engine") || disabled("dynamic-engine");
  32
  33 plan skip_all => "$test_name needs the sock feature enabled"
  34     if disabled("sock");
  35
  36 plan skip_all => "$test_name needs TLS enabled"
  37     if alldisabled(available_protocols("tls"));
  38
  39 $ENV{OPENSSL_ia32cap} = '~0x200000200000000';
  40 $ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
  41
  42 my $proxy = TLSProxy::Proxy->new(
  43     undef,
  44     cmdstr(app(["openssl"]), display => 1),
  45     srctop_file("apps", "server.pem"),
  46     (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
  47 );
  48
  49 @handmessages = (
  50     [TLSProxy::Message::MT_CLIENT_HELLO,
  51         recipes::checkhandshake::ALL_HANDSHAKES],
  52     [TLSProxy::Message::MT_SERVER_HELLO,
  53         recipes::checkhandshake::ALL_HANDSHAKES],
  54     [TLSProxy::Message::MT_CERTIFICATE,
  55         recipes::checkhandshake::ALL_HANDSHAKES
  56         & ~recipes::checkhandshake::RESUME_HANDSHAKE],
  57     [TLSProxy::Message::MT_CERTIFICATE_STATUS,
  58         recipes::checkhandshake::OCSP_HANDSHAKE],
  59     #ServerKeyExchange handshakes not currently supported by TLSProxy
  60     [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
  61         recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE],
  62     [TLSProxy::Message::MT_SERVER_HELLO_DONE,
  63         recipes::checkhandshake::ALL_HANDSHAKES
  64         & ~recipes::checkhandshake::RESUME_HANDSHAKE],
  65     [TLSProxy::Message::MT_CERTIFICATE,
  66         recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE],
  67     [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE,
  68         recipes::checkhandshake::ALL_HANDSHAKES
  69         & ~recipes::checkhandshake::RESUME_HANDSHAKE],
  70     [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
  71         recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE],
  72     [TLSProxy::Message::MT_NEXT_PROTO,
  73         recipes::checkhandshake::NPN_HANDSHAKE],
  74     [TLSProxy::Message::MT_FINISHED,
  75         recipes::checkhandshake::ALL_HANDSHAKES],
  76     [TLSProxy::Message::MT_NEW_SESSION_TICKET,
  77         recipes::checkhandshake::ALL_HANDSHAKES
  78         & ~recipes::checkhandshake::RESUME_HANDSHAKE],
  79     [TLSProxy::Message::MT_FINISHED,
  80         recipes::checkhandshake::ALL_HANDSHAKES],
  81     [TLSProxy::Message::MT_CLIENT_HELLO,
  82         recipes::checkhandshake::RENEG_HANDSHAKE],
  83     [TLSProxy::Message::MT_SERVER_HELLO,
  84         recipes::checkhandshake::RENEG_HANDSHAKE],
  85     [TLSProxy::Message::MT_CERTIFICATE,
  86         recipes::checkhandshake::RENEG_HANDSHAKE],
  87     [TLSProxy::Message::MT_SERVER_HELLO_DONE,
  88         recipes::checkhandshake::RENEG_HANDSHAKE],
  89     [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE,
  90         recipes::checkhandshake::RENEG_HANDSHAKE],
  91     [TLSProxy::Message::MT_FINISHED,
  92         recipes::checkhandshake::RENEG_HANDSHAKE],
  93     [TLSProxy::Message::MT_NEW_SESSION_TICKET,
  94         recipes::checkhandshake::RENEG_HANDSHAKE],
  95     [TLSProxy::Message::MT_FINISHED,
  96         recipes::checkhandshake::RENEG_HANDSHAKE],
  97     [0, 0]
  98 );
  99
 100 @extensions = (
 101     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
 102         recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION],
 103     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
 104         recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
 105     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
 106         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 107     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
 108         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 109     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
 110         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 111     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
 112         recipes::checkhandshake::ALPN_CLI_EXTENSION],
 113     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
 114         recipes::checkhandshake::SCT_CLI_EXTENSION],
 115     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
 116         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 117     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
 118         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 119     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
 120         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 121     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_RENEGOTIATE,
 122         recipes::checkhandshake::RENEGOTIATE_CLI_EXTENSION],
 123     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_NPN,
 124         recipes::checkhandshake::NPN_CLI_EXTENSION],
 125     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SRP,
 126         recipes::checkhandshake::SRP_CLI_EXTENSION],
 127
 128     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_RENEGOTIATE,
 129         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 130     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
 131         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 132     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
 133         recipes::checkhandshake::DEFAULT_EXTENSIONS],
 134     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
 135         recipes::checkhandshake::SESSION_TICKET_SRV_EXTENSION],
 136     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
 137         recipes::checkhandshake::SERVER_NAME_SRV_EXTENSION],
 138     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
 139         recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
 140     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ALPN,
 141         recipes::checkhandshake::ALPN_SRV_EXTENSION],
 142     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SCT,
 143         recipes::checkhandshake::SCT_SRV_EXTENSION],
 144     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_NPN,
 145         recipes::checkhandshake::NPN_SRV_EXTENSION],
 146     [0,0,0]
 147 );
 148
 149 #Test 1: Check we get all the right messages for a default handshake
 150 (undef, my $session) = tempfile();
 151 $proxy->serverconnects(2);
 152 $proxy->clientflags("-no_tls1_3 -sess_out ".$session);
 153 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
 154 plan tests => 20;
 155 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 156                recipes::checkhandshake::DEFAULT_EXTENSIONS,
 157                "Default handshake test");
 158
 159 #Test 2: Resumption handshake
 160 $proxy->clearClient();
 161 $proxy->clientflags("-no_tls1_3 -sess_in ".$session);
 162 $proxy->clientstart();
 163 checkhandshake($proxy, recipes::checkhandshake::RESUME_HANDSHAKE,
 164                recipes::checkhandshake::DEFAULT_EXTENSIONS
 165                & ~recipes::checkhandshake::SESSION_TICKET_SRV_EXTENSION,
 166                "Resumption handshake test");
 167 unlink $session;
 168
 169 #Test 3: A status_request handshake (client request only)
 170 $proxy->clear();
 171 $proxy->clientflags("-no_tls1_3 -status");
 172 $proxy->start();
 173 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 174               recipes::checkhandshake::DEFAULT_EXTENSIONS
 175               | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
 176               "status_request handshake test (client)");
 177
 178 #Test 4: A status_request handshake (server support only)
 179 $proxy->clear();
 180 $proxy->clientflags("-no_tls1_3");
 181 $proxy->serverflags("-status_file "
 182                     .srctop_file("test", "recipes", "ocsp-response.der"));
 183 $proxy->start();
 184 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 185                recipes::checkhandshake::DEFAULT_EXTENSIONS,
 186               "status_request handshake test (server)");
 187
 188 #Test 5: A status_request handshake (client and server)
 189 $proxy->clear();
 190 $proxy->clientflags("-no_tls1_3 -status");
 191 $proxy->serverflags("-status_file "
 192                     .srctop_file("test", "recipes", "ocsp-response.der"));
 193 $proxy->start();
 194 checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE,
 195               recipes::checkhandshake::DEFAULT_EXTENSIONS
 196               | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 197               | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
 198               "status_request handshake test");
 199
 200 #Test 6: A client auth handshake
 201 $proxy->clear();
 202 $proxy->clientflags("-no_tls1_3 -cert ".srctop_file("apps", "server.pem"));
 203 $proxy->serverflags("-Verify 5");
 204 $proxy->start();
 205 checkhandshake($proxy, recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE,
 206                recipes::checkhandshake::DEFAULT_EXTENSIONS,
 207                "Client auth handshake test");
 208
 209 #Test 7: A handshake with a renegotiation
 210 $proxy->clear();
 211 $proxy->clientflags("-no_tls1_3");
 212 $proxy->reneg(1);
 213 $proxy->start();
 214 checkhandshake($proxy, recipes::checkhandshake::RENEG_HANDSHAKE,
 215                recipes::checkhandshake::DEFAULT_EXTENSIONS,
 216                "Rengotiation handshake test");
 217
 218 #Test 8: Server name handshake (client request only)
 219 $proxy->clear();
 220 $proxy->clientflags("-no_tls1_3 -servername testhost");
 221 $proxy->start();
 222 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 223                recipes::checkhandshake::DEFAULT_EXTENSIONS
 224                | recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION,
 225               "Server name handshake test (client)");
 226
 227 #Test 9: Server name handshake (server support only)
 228 $proxy->clear();
 229 $proxy->clientflags("-no_tls1_3");
 230 $proxy->serverflags("-servername testhost");
 231 $proxy->start();
 232 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 233                recipes::checkhandshake::DEFAULT_EXTENSIONS,
 234               "Server name handshake test (server)");
 235
 236 #Test 10: Server name handshake (client and server)
 237 $proxy->clear();
 238 $proxy->clientflags("-no_tls1_3 -servername testhost");
 239 $proxy->serverflags("-servername testhost");
 240 $proxy->start();
 241 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 242               recipes::checkhandshake::DEFAULT_EXTENSIONS
 243               | recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION
 244               | recipes::checkhandshake::SERVER_NAME_SRV_EXTENSION,
 245               "Server name handshake test");
 246
 247 #Test 11: ALPN handshake (client request only)
 248 $proxy->clear();
 249 $proxy->clientflags("-no_tls1_3 -alpn test");
 250 $proxy->start();
 251 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 252                recipes::checkhandshake::DEFAULT_EXTENSIONS
 253                | recipes::checkhandshake::ALPN_CLI_EXTENSION,
 254               "ALPN handshake test (client)");
 255
 256 #Test 12: ALPN handshake (server support only)
 257 $proxy->clear();
 258 $proxy->clientflags("-no_tls1_3");
 259 $proxy->serverflags("-alpn test");
 260 $proxy->start();
 261 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 262                recipes::checkhandshake::DEFAULT_EXTENSIONS,
 263               "ALPN handshake test (server)");
 264
 265 #Test 13: ALPN handshake (client and server)
 266 $proxy->clear();
 267 $proxy->clientflags("-no_tls1_3 -alpn test");
 268 $proxy->serverflags("-alpn test");
 269 $proxy->start();
 270 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 271               recipes::checkhandshake::DEFAULT_EXTENSIONS
 272               | recipes::checkhandshake::ALPN_CLI_EXTENSION
 273               | recipes::checkhandshake::ALPN_SRV_EXTENSION,
 274               "ALPN handshake test");
 275
 276 #Test 14: SCT handshake (client request only)
 277 $proxy->clear();
 278 #Note: -ct also sends status_request
 279 $proxy->clientflags("-no_tls1_3 -ct");
 280 $proxy->serverflags("-status_file "
 281                     .srctop_file("test", "recipes", "ocsp-response.der"));
 282 $proxy->start();
 283 checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE,
 284               recipes::checkhandshake::DEFAULT_EXTENSIONS
 285               | recipes::checkhandshake::SCT_CLI_EXTENSION
 286               | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 287               | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
 288               "SCT handshake test (client)");
 289
 290 #Test 15: SCT handshake (server support only)
 291 $proxy->clear();
 292 #Note: -ct also sends status_request
 293 $proxy->clientflags("-no_tls1_3");
 294 $proxy->serverflags("-status_file "
 295                     .srctop_file("test", "recipes", "ocsp-response.der"));
 296 $proxy->start();
 297 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 298               recipes::checkhandshake::DEFAULT_EXTENSIONS,
 299               "SCT handshake test (server)");
 300
 301 #Test 16: SCT handshake (client and server)
 302 #There is no built-in server side support for this so we are actually also
 303 #testing custom extensions here
 304 $proxy->clear();
 305 #Note: -ct also sends status_request
 306 $proxy->clientflags("-no_tls1_3 -ct");
 307 $proxy->serverflags("-status_file "
 308                     .srctop_file("test", "recipes", "ocsp-response.der")
 309                     ." -serverinfo ".srctop_file("test", "serverinfo.pem"));
 310 $proxy->start();
 311 checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE,
 312               recipes::checkhandshake::DEFAULT_EXTENSIONS
 313               | recipes::checkhandshake::SCT_CLI_EXTENSION
 314               | recipes::checkhandshake::SCT_SRV_EXTENSION
 315               | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 316               | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
 317               "SCT handshake test");
 318
 319
 320 #Test 17: NPN handshake (client request only)
 321 $proxy->clear();
 322 $proxy->clientflags("-no_tls1_3 -nextprotoneg test");
 323 $proxy->start();
 324 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 325                recipes::checkhandshake::DEFAULT_EXTENSIONS
 326                | recipes::checkhandshake::NPN_CLI_EXTENSION,
 327               "NPN handshake test (client)");
 328
 329 #Test 18: NPN handshake (server support only)
 330 $proxy->clear();
 331 $proxy->clientflags("-no_tls1_3");
 332 $proxy->serverflags("-nextprotoneg test");
 333 $proxy->start();
 334 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 335                recipes::checkhandshake::DEFAULT_EXTENSIONS,
 336               "NPN handshake test (server)");
 337
 338 #Test 19: NPN handshake (client and server)
 339 $proxy->clear();
 340 $proxy->clientflags("-no_tls1_3 -nextprotoneg test");
 341 $proxy->serverflags("-nextprotoneg test");
 342 $proxy->start();
 343 checkhandshake($proxy, recipes::checkhandshake::NPN_HANDSHAKE,
 344               recipes::checkhandshake::DEFAULT_EXTENSIONS
 345               | recipes::checkhandshake::NPN_CLI_EXTENSION
 346               | recipes::checkhandshake::NPN_SRV_EXTENSION,
 347               "NPN handshake test");
 348
 349 #Test 20: SRP extension
 350 #Note: We are not actually going to perform an SRP handshake (TLSProxy does not
 351 #support it). However it is sufficient for us to check that the SRP extension
 352 #gets added on the client side. There is no SRP extension generated on the
 353 #server side anyway.
 354 $proxy->clear();
 355 $proxy->clientflags("-no_tls1_3 -srpuser user -srppass pass:pass");
 356 $proxy->start();
 357 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
 358               recipes::checkhandshake::DEFAULT_EXTENSIONS
 359               | recipes::checkhandshake::SRP_CLI_EXTENSION,
 360               "SRP extension test");