test/recipes/70-test_sslmessages.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the OpenSSL license (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9 use strict;
  10 use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
  11 use OpenSSL::Test::Utils;
  12 use File::Temp qw(tempfile);
  13 use TLSProxy::Proxy;
  14 use checkhandshake qw(checkhandshake @handmessages @extensions);
  15
  16 my $test_name = "test_sslmessages";
  17 setup($test_name);
  18
  19 plan skip_all => "TLSProxy isn't usable on $^O"
  20     if $^O =~ /^(VMS|MSWin32)$/;
  21
  22 plan skip_all => "$test_name needs the dynamic engine feature enabled"
  23     if disabled("engine") || disabled("dynamic-engine");
  24
  25 plan skip_all => "$test_name needs the sock feature enabled"
  26     if disabled("sock");
  27
  28 plan skip_all => "$test_name needs TLS enabled"
  29     if alldisabled(available_protocols("tls"));
  30
  31 $ENV{OPENSSL_ia32cap} = '~0x200000200000000';
  32 $ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
  33
  34 my $proxy = TLSProxy::Proxy->new(
  35     undef,
  36     cmdstr(app(["openssl"]), display => 1),
  37     srctop_file("apps", "server.pem"),
  38     (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
  39 );
  40
  41 @handmessages = (
  42     [TLSProxy::Message::MT_CLIENT_HELLO,
  43         checkhandshake::ALL_HANDSHAKES],
  44     [TLSProxy::Message::MT_SERVER_HELLO,
  45         checkhandshake::ALL_HANDSHAKES],
  46     [TLSProxy::Message::MT_CERTIFICATE,
  47         checkhandshake::ALL_HANDSHAKES
  48         & ~checkhandshake::RESUME_HANDSHAKE],
  49     [TLSProxy::Message::MT_CERTIFICATE_STATUS,
  50         checkhandshake::OCSP_HANDSHAKE],
  51     #ServerKeyExchange handshakes not currently supported by TLSProxy
  52     [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
  53         checkhandshake::CLIENT_AUTH_HANDSHAKE],
  54     [TLSProxy::Message::MT_SERVER_HELLO_DONE,
  55         checkhandshake::ALL_HANDSHAKES
  56         & ~checkhandshake::RESUME_HANDSHAKE],
  57     [TLSProxy::Message::MT_CERTIFICATE,
  58         checkhandshake::CLIENT_AUTH_HANDSHAKE],
  59     [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE,
  60         checkhandshake::ALL_HANDSHAKES
  61         & ~checkhandshake::RESUME_HANDSHAKE],
  62     [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
  63         checkhandshake::CLIENT_AUTH_HANDSHAKE],
  64     [TLSProxy::Message::MT_NEXT_PROTO,
  65         checkhandshake::NPN_HANDSHAKE],
  66     [TLSProxy::Message::MT_FINISHED,
  67         checkhandshake::ALL_HANDSHAKES],
  68     [TLSProxy::Message::MT_NEW_SESSION_TICKET,
  69         checkhandshake::ALL_HANDSHAKES
  70         & ~checkhandshake::RESUME_HANDSHAKE],
  71     [TLSProxy::Message::MT_FINISHED,
  72         checkhandshake::ALL_HANDSHAKES],
  73     [TLSProxy::Message::MT_CLIENT_HELLO,
  74         checkhandshake::RENEG_HANDSHAKE],
  75     [TLSProxy::Message::MT_SERVER_HELLO,
  76         checkhandshake::RENEG_HANDSHAKE],
  77     [TLSProxy::Message::MT_CERTIFICATE,
  78         checkhandshake::RENEG_HANDSHAKE],
  79     [TLSProxy::Message::MT_SERVER_HELLO_DONE,
  80         checkhandshake::RENEG_HANDSHAKE],
  81     [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE,
  82         checkhandshake::RENEG_HANDSHAKE],
  83     [TLSProxy::Message::MT_FINISHED,
  84         checkhandshake::RENEG_HANDSHAKE],
  85     [TLSProxy::Message::MT_NEW_SESSION_TICKET,
  86         checkhandshake::RENEG_HANDSHAKE],
  87     [TLSProxy::Message::MT_FINISHED,
  88         checkhandshake::RENEG_HANDSHAKE],
  89     [0, 0]
  90 );
  91
  92 @extensions = (
  93     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
  94         checkhandshake::SERVER_NAME_CLI_EXTENSION],
  95     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
  96         checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
  97     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
  98         checkhandshake::DEFAULT_EXTENSIONS],
  99     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
 100         checkhandshake::DEFAULT_EXTENSIONS],
 101     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
 102         checkhandshake::DEFAULT_EXTENSIONS],
 103     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
 104         checkhandshake::ALPN_CLI_EXTENSION],
 105     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
 106         checkhandshake::SCT_CLI_EXTENSION],
 107     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
 108         checkhandshake::DEFAULT_EXTENSIONS],
 109     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
 110         checkhandshake::DEFAULT_EXTENSIONS],
 111     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
 112         checkhandshake::DEFAULT_EXTENSIONS],
 113     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_RENEGOTIATE,
 114         checkhandshake::RENEGOTIATE_CLI_EXTENSION],
 115     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_NPN,
 116         checkhandshake::NPN_CLI_EXTENSION],
 117     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SRP,
 118         checkhandshake::SRP_CLI_EXTENSION],
 119
 120     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_RENEGOTIATE,
 121         checkhandshake::DEFAULT_EXTENSIONS],
 122     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
 123         checkhandshake::DEFAULT_EXTENSIONS],
 124     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
 125         checkhandshake::DEFAULT_EXTENSIONS],
 126     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
 127         checkhandshake::SESSION_TICKET_SRV_EXTENSION],
 128     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
 129         checkhandshake::SERVER_NAME_SRV_EXTENSION],
 130     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
 131         checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
 132     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ALPN,
 133         checkhandshake::ALPN_SRV_EXTENSION],
 134     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SCT,
 135         checkhandshake::SCT_SRV_EXTENSION],
 136     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_NPN,
 137         checkhandshake::NPN_SRV_EXTENSION],
 138     [0,0,0]
 139 );
 140
 141 #Test 1: Check we get all the right messages for a default handshake
 142 (undef, my $session) = tempfile();
 143 $proxy->serverconnects(2);
 144 $proxy->clientflags("-no_tls1_3 -sess_out ".$session);
 145 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
 146 plan tests => 20;
 147 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 148                checkhandshake::DEFAULT_EXTENSIONS,
 149                "Default handshake test");
 150
 151 #Test 2: Resumption handshake
 152 $proxy->clearClient();
 153 $proxy->clientflags("-no_tls1_3 -sess_in ".$session);
 154 $proxy->clientstart();
 155 checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
 156                checkhandshake::DEFAULT_EXTENSIONS
 157                & ~checkhandshake::SESSION_TICKET_SRV_EXTENSION,
 158                "Resumption handshake test");
 159 unlink $session;
 160
 161 #Test 3: A status_request handshake (client request only)
 162 $proxy->clear();
 163 $proxy->clientflags("-no_tls1_3 -status");
 164 $proxy->start();
 165 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 166                checkhandshake::DEFAULT_EXTENSIONS
 167                | checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
 168                "status_request handshake test (client)");
 169
 170 #Test 4: A status_request handshake (server support only)
 171 $proxy->clear();
 172 $proxy->clientflags("-no_tls1_3");
 173 $proxy->serverflags("-status_file "
 174                     .srctop_file("test", "recipes", "ocsp-response.der"));
 175 $proxy->start();
 176 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 177                checkhandshake::DEFAULT_EXTENSIONS,
 178                "status_request handshake test (server)");
 179
 180 #Test 5: A status_request handshake (client and server)
 181 $proxy->clear();
 182 $proxy->clientflags("-no_tls1_3 -status");
 183 $proxy->serverflags("-status_file "
 184                     .srctop_file("test", "recipes", "ocsp-response.der"));
 185 $proxy->start();
 186 checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE,
 187                checkhandshake::DEFAULT_EXTENSIONS
 188                | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 189                | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
 190                "status_request handshake test");
 191
 192 #Test 6: A client auth handshake
 193 $proxy->clear();
 194 $proxy->clientflags("-no_tls1_3 -cert ".srctop_file("apps", "server.pem"));
 195 $proxy->serverflags("-Verify 5");
 196 $proxy->start();
 197 checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
 198                checkhandshake::DEFAULT_EXTENSIONS,
 199                "Client auth handshake test");
 200
 201 #Test 7: A handshake with a renegotiation
 202 $proxy->clear();
 203 $proxy->clientflags("-no_tls1_3");
 204 $proxy->reneg(1);
 205 $proxy->start();
 206 checkhandshake($proxy, checkhandshake::RENEG_HANDSHAKE,
 207                checkhandshake::DEFAULT_EXTENSIONS,
 208                "Rengotiation handshake test");
 209
 210 #Test 8: Server name handshake (client request only)
 211 $proxy->clear();
 212 $proxy->clientflags("-no_tls1_3 -servername testhost");
 213 $proxy->start();
 214 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 215                checkhandshake::DEFAULT_EXTENSIONS
 216                | checkhandshake::SERVER_NAME_CLI_EXTENSION,
 217                "Server name handshake test (client)");
 218
 219 #Test 9: Server name handshake (server support only)
 220 $proxy->clear();
 221 $proxy->clientflags("-no_tls1_3");
 222 $proxy->serverflags("-servername testhost");
 223 $proxy->start();
 224 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 225                checkhandshake::DEFAULT_EXTENSIONS,
 226                "Server name handshake test (server)");
 227
 228 #Test 10: Server name handshake (client and server)
 229 $proxy->clear();
 230 $proxy->clientflags("-no_tls1_3 -servername testhost");
 231 $proxy->serverflags("-servername testhost");
 232 $proxy->start();
 233 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 234                checkhandshake::DEFAULT_EXTENSIONS
 235                | checkhandshake::SERVER_NAME_CLI_EXTENSION
 236                | checkhandshake::SERVER_NAME_SRV_EXTENSION,
 237                "Server name handshake test");
 238
 239 #Test 11: ALPN handshake (client request only)
 240 $proxy->clear();
 241 $proxy->clientflags("-no_tls1_3 -alpn test");
 242 $proxy->start();
 243 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 244                checkhandshake::DEFAULT_EXTENSIONS
 245                | checkhandshake::ALPN_CLI_EXTENSION,
 246                "ALPN handshake test (client)");
 247
 248 #Test 12: ALPN handshake (server support only)
 249 $proxy->clear();
 250 $proxy->clientflags("-no_tls1_3");
 251 $proxy->serverflags("-alpn test");
 252 $proxy->start();
 253 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 254                checkhandshake::DEFAULT_EXTENSIONS,
 255                "ALPN handshake test (server)");
 256
 257 #Test 13: ALPN handshake (client and server)
 258 $proxy->clear();
 259 $proxy->clientflags("-no_tls1_3 -alpn test");
 260 $proxy->serverflags("-alpn test");
 261 $proxy->start();
 262 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 263                checkhandshake::DEFAULT_EXTENSIONS
 264                | checkhandshake::ALPN_CLI_EXTENSION
 265                | checkhandshake::ALPN_SRV_EXTENSION,
 266                "ALPN handshake test");
 267
 268 SKIP: {
 269     skip "No CT support in this OpenSSL build", 1 if disabled("ct");
 270
 271     #Test 14: SCT handshake (client request only)
 272     $proxy->clear();
 273     #Note: -ct also sends status_request
 274     $proxy->clientflags("-no_tls1_3 -ct");
 275     $proxy->serverflags("-status_file "
 276                         .srctop_file("test", "recipes", "ocsp-response.der"));
 277     $proxy->start();
 278     checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE,
 279                    checkhandshake::DEFAULT_EXTENSIONS
 280                    | checkhandshake::SCT_CLI_EXTENSION
 281                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 282                    | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
 283                    "SCT handshake test (client)");
 284 }
 285
 286 #Test 15: SCT handshake (server support only)
 287 $proxy->clear();
 288 #Note: -ct also sends status_request
 289 $proxy->clientflags("-no_tls1_3");
 290 $proxy->serverflags("-status_file "
 291                     .srctop_file("test", "recipes", "ocsp-response.der"));
 292 $proxy->start();
 293 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 294                checkhandshake::DEFAULT_EXTENSIONS,
 295                "SCT handshake test (server)");
 296
 297 SKIP: {
 298     skip "No CT support in this OpenSSL build", 1 if disabled("ct");
 299
 300     #Test 16: SCT handshake (client and server)
 301     #There is no built-in server side support for this so we are actually also
 302     #testing custom extensions here
 303     $proxy->clear();
 304     #Note: -ct also sends status_request
 305     $proxy->clientflags("-no_tls1_3 -ct");
 306     $proxy->serverflags("-status_file "
 307                         .srctop_file("test", "recipes", "ocsp-response.der")
 308                         ." -serverinfo ".srctop_file("test", "serverinfo.pem"));
 309     $proxy->start();
 310     checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE,
 311                    checkhandshake::DEFAULT_EXTENSIONS
 312                    | checkhandshake::SCT_CLI_EXTENSION
 313                    | checkhandshake::SCT_SRV_EXTENSION
 314                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 315                    | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
 316                    "SCT handshake test");
 317 }
 318
 319
 320 #Test 17: NPN handshake (client request only)
 321 $proxy->clear();
 322 $proxy->clientflags("-no_tls1_3 -nextprotoneg test");
 323 $proxy->start();
 324 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 325                checkhandshake::DEFAULT_EXTENSIONS
 326                | checkhandshake::NPN_CLI_EXTENSION,
 327               "NPN handshake test (client)");
 328
 329 #Test 18: NPN handshake (server support only)
 330 $proxy->clear();
 331 $proxy->clientflags("-no_tls1_3");
 332 $proxy->serverflags("-nextprotoneg test");
 333 $proxy->start();
 334 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 335                checkhandshake::DEFAULT_EXTENSIONS,
 336               "NPN handshake test (server)");
 337
 338 #Test 19: NPN handshake (client and server)
 339 $proxy->clear();
 340 $proxy->clientflags("-no_tls1_3 -nextprotoneg test");
 341 $proxy->serverflags("-nextprotoneg test");
 342 $proxy->start();
 343 checkhandshake($proxy, checkhandshake::NPN_HANDSHAKE,
 344                checkhandshake::DEFAULT_EXTENSIONS
 345                | checkhandshake::NPN_CLI_EXTENSION
 346                | checkhandshake::NPN_SRV_EXTENSION,
 347                "NPN handshake test");
 348
 349 #Test 20: SRP extension
 350 #Note: We are not actually going to perform an SRP handshake (TLSProxy does not
 351 #support it). However it is sufficient for us to check that the SRP extension
 352 #gets added on the client side. There is no SRP extension generated on the
 353 #server side anyway.
 354 $proxy->clear();
 355 $proxy->clientflags("-no_tls1_3 -srpuser user -srppass pass:pass");
 356 $proxy->start();
 357 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 358                checkhandshake::DEFAULT_EXTENSIONS
 359                | checkhandshake::SRP_CLI_EXTENSION,
 360                "SRP extension test");