9319e8492d0e33d5d8f2cc47fb69e99412df8d8f
[openssl.git] / test / recipes / 70-test_tls13messages.t
1 #! /usr/bin/env perl
2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
3 #
4 # Licensed under the OpenSSL license (the "License").  You may not use
5 # this file except in compliance with the License.  You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
8
9 use strict;
10 use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
11 use OpenSSL::Test::Utils;
12 use File::Temp qw(tempfile);
13 use TLSProxy::Proxy;
14 use checkhandshake qw(checkhandshake @handmessages @extensions);
15
16 my $test_name = "test_tls13messages";
17 setup($test_name);
18
19 plan skip_all => "TLSProxy isn't usable on $^O"
20     if $^O =~ /^(VMS|MSWin32)$/;
21
22 plan skip_all => "$test_name needs the dynamic engine feature enabled"
23     if disabled("engine") || disabled("dynamic-engine");
24
25 plan skip_all => "$test_name needs the sock feature enabled"
26     if disabled("sock");
27
28 plan skip_all => "$test_name needs TLSv1.3 enabled"
29     if disabled("tls1_3");
30
31 $ENV{OPENSSL_ia32cap} = '~0x200000200000000';
32 $ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
33
34
35 @handmessages = (
36     [TLSProxy::Message::MT_CLIENT_HELLO,
37         checkhandshake::ALL_HANDSHAKES],
38     [TLSProxy::Message::MT_HELLO_RETRY_REQUEST,
39         checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
40     [TLSProxy::Message::MT_CLIENT_HELLO,
41         checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
42     [TLSProxy::Message::MT_SERVER_HELLO,
43         checkhandshake::ALL_HANDSHAKES],
44     [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
45         checkhandshake::ALL_HANDSHAKES],
46     [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
47         checkhandshake::CLIENT_AUTH_HANDSHAKE],
48     [TLSProxy::Message::MT_CERTIFICATE,
49         checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
50     [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
51         checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
52     [TLSProxy::Message::MT_FINISHED,
53         checkhandshake::ALL_HANDSHAKES],
54     [TLSProxy::Message::MT_CERTIFICATE,
55         checkhandshake::CLIENT_AUTH_HANDSHAKE],
56     [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
57         checkhandshake::CLIENT_AUTH_HANDSHAKE],
58     [TLSProxy::Message::MT_FINISHED,
59         checkhandshake::ALL_HANDSHAKES],
60     [0, 0]
61 );
62
63 @extensions = (
64     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
65         checkhandshake::SERVER_NAME_CLI_EXTENSION],
66     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
67         checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
68     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
69         checkhandshake::DEFAULT_EXTENSIONS],
70     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
71         checkhandshake::DEFAULT_EXTENSIONS],
72     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
73         checkhandshake::DEFAULT_EXTENSIONS],
74     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
75         checkhandshake::ALPN_CLI_EXTENSION],
76     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
77         checkhandshake::SCT_CLI_EXTENSION],
78     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
79         checkhandshake::DEFAULT_EXTENSIONS],
80     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
81         checkhandshake::DEFAULT_EXTENSIONS],
82     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
83         checkhandshake::DEFAULT_EXTENSIONS],
84     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
85         checkhandshake::DEFAULT_EXTENSIONS],
86     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
87         checkhandshake::DEFAULT_EXTENSIONS],
88     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
89         checkhandshake::DEFAULT_EXTENSIONS],
90     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
91         checkhandshake::PSK_CLI_EXTENSION],
92
93     [TLSProxy::Message::MT_HELLO_RETRY_REQUEST, TLSProxy::Message::EXT_KEY_SHARE,
94         checkhandshake::KEY_SHARE_HRR_EXTENSION],
95
96     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
97         checkhandshake::SERVER_NAME_CLI_EXTENSION],
98     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
99         checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
100     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
101         checkhandshake::DEFAULT_EXTENSIONS],
102     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
103         checkhandshake::DEFAULT_EXTENSIONS],
104     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
105         checkhandshake::DEFAULT_EXTENSIONS],
106     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
107         checkhandshake::ALPN_CLI_EXTENSION],
108     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
109         checkhandshake::SCT_CLI_EXTENSION],
110     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
111         checkhandshake::DEFAULT_EXTENSIONS],
112     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
113         checkhandshake::DEFAULT_EXTENSIONS],
114     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
115         checkhandshake::DEFAULT_EXTENSIONS],
116     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
117         checkhandshake::DEFAULT_EXTENSIONS],
118     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
119         checkhandshake::DEFAULT_EXTENSIONS],
120     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
121         checkhandshake::DEFAULT_EXTENSIONS],
122     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
123         checkhandshake::PSK_CLI_EXTENSION],
124
125     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
126         checkhandshake::DEFAULT_EXTENSIONS],
127     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
128         checkhandshake::DEFAULT_EXTENSIONS],
129     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
130         checkhandshake::PSK_SRV_EXTENSION],
131
132     [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
133         checkhandshake::SERVER_NAME_SRV_EXTENSION],
134     [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
135         checkhandshake::ALPN_SRV_EXTENSION],
136     [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
137         checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],
138
139     [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
140         checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
141     [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
142         checkhandshake::SCT_SRV_EXTENSION],
143
144     [0,0,0]
145 );
146
147 my $proxy = TLSProxy::Proxy->new(
148     undef,
149     cmdstr(app(["openssl"]), display => 1),
150     srctop_file("apps", "server.pem"),
151     (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
152 );
153
154 #Test 1: Check we get all the right messages for a default handshake
155 (undef, my $session) = tempfile();
156 $proxy->serverconnects(2);
157 $proxy->clientflags("-sess_out ".$session);
158 $proxy->sessionfile($session);
159 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
160 plan tests => 16;
161 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
162                checkhandshake::DEFAULT_EXTENSIONS,
163                "Default handshake test");
164
165 #Test 2: Resumption handshake
166 $proxy->clearClient();
167 $proxy->clientflags("-sess_in ".$session);
168 $proxy->clientstart();
169 checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
170                (checkhandshake::DEFAULT_EXTENSIONS
171                 | checkhandshake::PSK_CLI_EXTENSION
172                 | checkhandshake::PSK_SRV_EXTENSION),
173                "Resumption handshake test");
174
175 SKIP: {
176     skip "No OCSP support in this OpenSSL build", 3
177         if disabled("ct") || disabled("ec") || disabled("ocsp");
178     #Test 3: A status_request handshake (client request only)
179     $proxy->clear();
180     $proxy->clientflags("-status");
181     $proxy->start();
182     checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
183                    checkhandshake::DEFAULT_EXTENSIONS
184                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
185                    "status_request handshake test (client)");
186
187     #Test 4: A status_request handshake (server support only)
188     $proxy->clear();
189     $proxy->serverflags("-status_file "
190                         .srctop_file("test", "recipes", "ocsp-response.der"));
191     $proxy->start();
192     checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
193                    checkhandshake::DEFAULT_EXTENSIONS,
194                    "status_request handshake test (server)");
195
196     #Test 5: A status_request handshake (client and server)
197     $proxy->clear();
198     $proxy->clientflags("-status");
199     $proxy->serverflags("-status_file "
200                         .srctop_file("test", "recipes", "ocsp-response.der"));
201     $proxy->start();
202     checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
203                    checkhandshake::DEFAULT_EXTENSIONS
204                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
205                    | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
206                    "status_request handshake test");
207 }
208
209 #Test 6: A client auth handshake
210 $proxy->clear();
211 $proxy->clientflags("-cert ".srctop_file("apps", "server.pem"));
212 $proxy->serverflags("-Verify 5");
213 $proxy->start();
214 checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
215                checkhandshake::DEFAULT_EXTENSIONS,
216                "Client auth handshake test");
217
218 #Test 7: Server name handshake (no client request)
219 $proxy->clear();
220 $proxy->clientflags("-noservername");
221 $proxy->start();
222 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
223                checkhandshake::DEFAULT_EXTENSIONS
224                & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
225                "Server name handshake test (client)");
226
227 #Test 8: Server name handshake (server support only)
228 $proxy->clear();
229 $proxy->clientflags("-noservername");
230 $proxy->serverflags("-servername testhost");
231 $proxy->start();
232 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
233                checkhandshake::DEFAULT_EXTENSIONS
234                & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
235                "Server name handshake test (server)");
236
237 #Test 9: Server name handshake (client and server)
238 $proxy->clear();
239 $proxy->clientflags("-servername testhost");
240 $proxy->serverflags("-servername testhost");
241 $proxy->start();
242 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
243                checkhandshake::DEFAULT_EXTENSIONS
244                | checkhandshake::SERVER_NAME_SRV_EXTENSION,
245                "Server name handshake test");
246
247 #Test 10: ALPN handshake (client request only)
248 $proxy->clear();
249 $proxy->clientflags("-alpn test");
250 $proxy->start();
251 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
252                checkhandshake::DEFAULT_EXTENSIONS
253                | checkhandshake::ALPN_CLI_EXTENSION,
254                "ALPN handshake test (client)");
255
256 #Test 11: ALPN handshake (server support only)
257 $proxy->clear();
258 $proxy->serverflags("-alpn test");
259 $proxy->start();
260 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
261                checkhandshake::DEFAULT_EXTENSIONS,
262                "ALPN handshake test (server)");
263
264 #Test 12: ALPN handshake (client and server)
265 $proxy->clear();
266 $proxy->clientflags("-alpn test");
267 $proxy->serverflags("-alpn test");
268 $proxy->start();
269 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
270                checkhandshake::DEFAULT_EXTENSIONS
271                | checkhandshake::ALPN_CLI_EXTENSION
272                | checkhandshake::ALPN_SRV_EXTENSION,
273                "ALPN handshake test");
274
275 SKIP: {
276     skip "No CT, EC or OCSP support in this OpenSSL build", 1
277         if disabled("ct") || disabled("ec") || disabled("ocsp");
278
279     #Test 13: SCT handshake (client request only)
280     $proxy->clear();
281     #Note: -ct also sends status_request
282     $proxy->clientflags("-ct");
283     $proxy->serverflags("-status_file "
284                         .srctop_file("test", "recipes", "ocsp-response.der")
285                         ." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
286     $proxy->start();
287     checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
288                    checkhandshake::DEFAULT_EXTENSIONS
289                    | checkhandshake::SCT_CLI_EXTENSION
290                    | checkhandshake::SCT_SRV_EXTENSION
291                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
292                    | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
293                    "SCT handshake test");
294 }
295
296
297
298
299 #Test 14: HRR Handshake
300 $proxy->clear();
301 $proxy->serverflags("-curves P-256");
302 $proxy->start();
303 checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
304                checkhandshake::DEFAULT_EXTENSIONS
305                | checkhandshake::KEY_SHARE_HRR_EXTENSION,
306                "HRR handshake test");
307
308 #Test 15: Resumption handshake with HRR
309 $proxy->clear();
310 $proxy->clientflags("-sess_in ".$session);
311 $proxy->serverflags("-curves P-256");
312 $proxy->start();
313 checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
314                (checkhandshake::DEFAULT_EXTENSIONS
315                 | checkhandshake::KEY_SHARE_HRR_EXTENSION
316                 | checkhandshake::PSK_CLI_EXTENSION
317                 | checkhandshake::PSK_SRV_EXTENSION),
318                "Resumption handshake with HRR test");
319
320 #Test 16: Acceptable but non preferred key_share
321 $proxy->clear();
322 $proxy->clientflags("-curves P-256");
323 $proxy->start();
324 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
325                checkhandshake::DEFAULT_EXTENSIONS
326                | checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
327                "Default handshake test");
328
329 unlink $session;