test/recipes/70-test_tls13messages.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2023 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9 use strict;
  10 use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
  11 use OpenSSL::Test::Utils;
  12 use File::Temp qw(tempfile);
  13 use TLSProxy::Proxy;
  14 use checkhandshake qw(checkhandshake @handmessages @extensions);
  15
  16 my $test_name = "test_tls13messages";
  17 setup($test_name);
  18
  19 plan skip_all => "TLSProxy isn't usable on $^O"
  20     if $^O =~ /^(VMS)$/;
  21
  22 plan skip_all => "$test_name needs the dynamic engine feature enabled"
  23     if disabled("engine") || disabled("dynamic-engine");
  24
  25 plan skip_all => "$test_name needs the sock feature enabled"
  26     if disabled("sock");
  27
  28 plan skip_all => "$test_name needs TLSv1.3 enabled"
  29     if disabled("tls1_3");
  30
  31 plan skip_all => "$test_name needs EC enabled"
  32     if disabled("ec");
  33
  34 @handmessages = (
  35     [TLSProxy::Message::MT_CLIENT_HELLO,
  36         checkhandshake::ALL_HANDSHAKES],
  37     [TLSProxy::Message::MT_SERVER_HELLO,
  38         checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
  39     [TLSProxy::Message::MT_CLIENT_HELLO,
  40         checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
  41     [TLSProxy::Message::MT_SERVER_HELLO,
  42         checkhandshake::ALL_HANDSHAKES],
  43     [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
  44         checkhandshake::ALL_HANDSHAKES],
  45     [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
  46         checkhandshake::CLIENT_AUTH_HANDSHAKE],
  47     [TLSProxy::Message::MT_CERTIFICATE,
  48         checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
  49     [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
  50         checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
  51     [TLSProxy::Message::MT_FINISHED,
  52         checkhandshake::ALL_HANDSHAKES],
  53     [TLSProxy::Message::MT_CERTIFICATE,
  54         checkhandshake::CLIENT_AUTH_HANDSHAKE],
  55     [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
  56         checkhandshake::CLIENT_AUTH_HANDSHAKE],
  57     [TLSProxy::Message::MT_FINISHED,
  58         checkhandshake::ALL_HANDSHAKES],
  59     [0, 0]
  60 );
  61
  62 @extensions = (
  63     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
  64         TLSProxy::Message::CLIENT,
  65         checkhandshake::SERVER_NAME_CLI_EXTENSION],
  66     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
  67         TLSProxy::Message::CLIENT,
  68         checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
  69     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
  70         TLSProxy::Message::CLIENT,
  71         checkhandshake::DEFAULT_EXTENSIONS],
  72     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
  73         TLSProxy::Message::CLIENT,
  74         checkhandshake::DEFAULT_EXTENSIONS],
  75     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
  76         TLSProxy::Message::CLIENT,
  77         checkhandshake::DEFAULT_EXTENSIONS],
  78     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
  79         TLSProxy::Message::CLIENT,
  80         checkhandshake::ALPN_CLI_EXTENSION],
  81     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
  82         TLSProxy::Message::CLIENT,
  83         checkhandshake::SCT_CLI_EXTENSION],
  84     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
  85         TLSProxy::Message::CLIENT,
  86         checkhandshake::DEFAULT_EXTENSIONS],
  87     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
  88         TLSProxy::Message::CLIENT,
  89         checkhandshake::DEFAULT_EXTENSIONS],
  90     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
  91         TLSProxy::Message::CLIENT,
  92         checkhandshake::DEFAULT_EXTENSIONS],
  93     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
  94         TLSProxy::Message::CLIENT,
  95         checkhandshake::DEFAULT_EXTENSIONS],
  96     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
  97         TLSProxy::Message::CLIENT,
  98         checkhandshake::DEFAULT_EXTENSIONS],
  99     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
 100         TLSProxy::Message::CLIENT,
 101         checkhandshake::DEFAULT_EXTENSIONS],
 102     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
 103         TLSProxy::Message::CLIENT,
 104         checkhandshake::PSK_CLI_EXTENSION],
 105     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
 106         TLSProxy::Message::CLIENT,
 107         checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],
 108
 109     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
 110         TLSProxy::Message::SERVER,
 111         checkhandshake::DEFAULT_EXTENSIONS],
 112     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
 113         TLSProxy::Message::SERVER,
 114         checkhandshake::KEY_SHARE_HRR_EXTENSION],
 115
 116     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
 117         TLSProxy::Message::CLIENT,
 118         checkhandshake::SERVER_NAME_CLI_EXTENSION],
 119     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
 120         TLSProxy::Message::CLIENT,
 121         checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
 122     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
 123         TLSProxy::Message::CLIENT,
 124         checkhandshake::DEFAULT_EXTENSIONS],
 125     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
 126         TLSProxy::Message::CLIENT,
 127         checkhandshake::DEFAULT_EXTENSIONS],
 128     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
 129         TLSProxy::Message::CLIENT,
 130         checkhandshake::DEFAULT_EXTENSIONS],
 131     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
 132         TLSProxy::Message::CLIENT,
 133         checkhandshake::ALPN_CLI_EXTENSION],
 134     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
 135         TLSProxy::Message::CLIENT,
 136         checkhandshake::SCT_CLI_EXTENSION],
 137     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
 138         TLSProxy::Message::CLIENT,
 139         checkhandshake::DEFAULT_EXTENSIONS],
 140     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
 141         TLSProxy::Message::CLIENT,
 142         checkhandshake::DEFAULT_EXTENSIONS],
 143     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
 144         TLSProxy::Message::CLIENT,
 145         checkhandshake::DEFAULT_EXTENSIONS],
 146     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
 147         TLSProxy::Message::CLIENT,
 148         checkhandshake::DEFAULT_EXTENSIONS],
 149     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
 150         TLSProxy::Message::CLIENT,
 151         checkhandshake::DEFAULT_EXTENSIONS],
 152     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
 153         TLSProxy::Message::CLIENT,
 154         checkhandshake::DEFAULT_EXTENSIONS],
 155     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
 156         TLSProxy::Message::CLIENT,
 157         checkhandshake::PSK_CLI_EXTENSION],
 158     [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
 159         TLSProxy::Message::CLIENT,
 160         checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],
 161
 162     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
 163         TLSProxy::Message::SERVER,
 164         checkhandshake::DEFAULT_EXTENSIONS],
 165     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
 166         TLSProxy::Message::SERVER,
 167         checkhandshake::DEFAULT_EXTENSIONS],
 168     [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
 169         TLSProxy::Message::SERVER,
 170         checkhandshake::PSK_SRV_EXTENSION],
 171
 172     [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
 173         TLSProxy::Message::SERVER,
 174         checkhandshake::SERVER_NAME_SRV_EXTENSION],
 175     [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
 176         TLSProxy::Message::SERVER,
 177         checkhandshake::ALPN_SRV_EXTENSION],
 178     [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
 179         TLSProxy::Message::SERVER,
 180         checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],
 181
 182     [TLSProxy::Message::MT_CERTIFICATE_REQUEST, TLSProxy::Message::EXT_SIG_ALGS,
 183         TLSProxy::Message::SERVER,
 184         checkhandshake::DEFAULT_EXTENSIONS],
 185
 186     [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
 187         TLSProxy::Message::SERVER,
 188         checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
 189     [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
 190         TLSProxy::Message::SERVER,
 191         checkhandshake::SCT_SRV_EXTENSION],
 192
 193     [0,0,0,0]
 194 );
 195
 196 my $proxy = TLSProxy::Proxy->new(
 197     undef,
 198     cmdstr(app(["openssl"]), display => 1),
 199     srctop_file("apps", "server.pem"),
 200     (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
 201 );
 202
 203 #Test 1: Check we get all the right messages for a default handshake
 204 (undef, my $session) = tempfile();
 205 $proxy->serverconnects(2);
 206 $proxy->clientflags("-no_rx_cert_comp -sess_out ".$session);
 207 $proxy->sessionfile($session);
 208 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
 209 plan tests => 17;
 210 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 211                checkhandshake::DEFAULT_EXTENSIONS,
 212                "Default handshake test");
 213
 214 #Test 2: Resumption handshake
 215 $proxy->clearClient();
 216 $proxy->clientflags("-no_rx_cert_comp -sess_in ".$session);
 217 $proxy->clientstart();
 218 checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
 219                (checkhandshake::DEFAULT_EXTENSIONS
 220                 | checkhandshake::PSK_CLI_EXTENSION
 221                 | checkhandshake::PSK_SRV_EXTENSION),
 222                "Resumption handshake test");
 223
 224 SKIP: {
 225     skip "No OCSP support in this OpenSSL build", 4
 226         if disabled("ct") || disabled("ec") || disabled("ocsp");
 227     #Test 3: A status_request handshake (client request only)
 228     $proxy->clear();
 229     $proxy->clientflags("-no_rx_cert_comp -status");
 230     $proxy->start();
 231     checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 232                    checkhandshake::DEFAULT_EXTENSIONS
 233                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
 234                    "status_request handshake test (client)");
 235
 236     #Test 4: A status_request handshake (server support only)
 237     $proxy->clear();
 238     $proxy->clientflags("-no_rx_cert_comp");
 239     $proxy->serverflags("-no_rx_cert_comp -status_file "
 240                         .srctop_file("test", "recipes", "ocsp-response.der"));
 241     $proxy->start();
 242     checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 243                    checkhandshake::DEFAULT_EXTENSIONS,
 244                    "status_request handshake test (server)");
 245
 246     #Test 5: A status_request handshake (client and server)
 247     $proxy->clear();
 248     $proxy->clientflags("-no_rx_cert_comp -status");
 249     $proxy->serverflags("-no_rx_cert_comp -status_file "
 250                         .srctop_file("test", "recipes", "ocsp-response.der"));
 251     $proxy->start();
 252     checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 253                    checkhandshake::DEFAULT_EXTENSIONS
 254                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 255                    | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
 256                    "status_request handshake test");
 257
 258     #Test 6: A status_request handshake (client and server) with client auth
 259     $proxy->clear();
 260     $proxy->clientflags("-no_rx_cert_comp -status -enable_pha -cert "
 261                         .srctop_file("apps", "server.pem"));
 262     $proxy->serverflags("-no_rx_cert_comp -Verify 5 -status_file "
 263                         .srctop_file("test", "recipes", "ocsp-response.der"));
 264     $proxy->start();
 265     checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
 266                    checkhandshake::DEFAULT_EXTENSIONS
 267                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 268                    | checkhandshake::STATUS_REQUEST_SRV_EXTENSION
 269                    | checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
 270                    "status_request handshake with client auth test");
 271 }
 272
 273 #Test 7: A client auth handshake
 274 $proxy->clear();
 275 $proxy->clientflags("-no_rx_cert_comp -enable_pha -cert ".srctop_file("apps", "server.pem"));
 276 $proxy->serverflags("-no_rx_cert_comp -Verify 5");
 277 $proxy->start();
 278 checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
 279                checkhandshake::DEFAULT_EXTENSIONS |
 280                checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
 281                "Client auth handshake test");
 282
 283 #Test 8: Server name handshake (no client request)
 284 $proxy->clear();
 285 $proxy->clientflags("-no_rx_cert_comp -noservername");
 286 $proxy->start();
 287 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 288                checkhandshake::DEFAULT_EXTENSIONS
 289                & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
 290                "Server name handshake test (client)");
 291
 292 #Test 9: Server name handshake (server support only)
 293 $proxy->clear();
 294 $proxy->clientflags("-no_rx_cert_comp -noservername");
 295 $proxy->serverflags("-no_rx_cert_comp -servername testhost");
 296 $proxy->start();
 297 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 298                checkhandshake::DEFAULT_EXTENSIONS
 299                & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
 300                "Server name handshake test (server)");
 301
 302 #Test 10: Server name handshake (client and server)
 303 $proxy->clear();
 304 $proxy->clientflags("-no_rx_cert_comp -servername testhost");
 305 $proxy->serverflags("-no_rx_cert_comp -servername testhost");
 306 $proxy->start();
 307 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 308                checkhandshake::DEFAULT_EXTENSIONS
 309                | checkhandshake::SERVER_NAME_SRV_EXTENSION,
 310                "Server name handshake test");
 311
 312 #Test 11: ALPN handshake (client request only)
 313 $proxy->clear();
 314 $proxy->clientflags("-no_rx_cert_comp -alpn test");
 315 $proxy->start();
 316 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 317                checkhandshake::DEFAULT_EXTENSIONS
 318                | checkhandshake::ALPN_CLI_EXTENSION,
 319                "ALPN handshake test (client)");
 320
 321 #Test 12: ALPN handshake (server support only)
 322 $proxy->clear();
 323 $proxy->clientflags("-no_rx_cert_comp");
 324 $proxy->serverflags("-no_rx_cert_comp -alpn test");
 325 $proxy->start();
 326 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 327                checkhandshake::DEFAULT_EXTENSIONS,
 328                "ALPN handshake test (server)");
 329
 330 #Test 13: ALPN handshake (client and server)
 331 $proxy->clear();
 332 $proxy->clientflags("-no_rx_cert_comp -alpn test");
 333 $proxy->serverflags("-no_rx_cert_comp -alpn test");
 334 $proxy->start();
 335 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 336                checkhandshake::DEFAULT_EXTENSIONS
 337                | checkhandshake::ALPN_CLI_EXTENSION
 338                | checkhandshake::ALPN_SRV_EXTENSION,
 339                "ALPN handshake test");
 340
 341 SKIP: {
 342     skip "No CT, EC or OCSP support in this OpenSSL build", 1
 343         if disabled("ct") || disabled("ec") || disabled("ocsp");
 344
 345     #Test 14: SCT handshake (client request only)
 346     $proxy->clear();
 347     #Note: -ct also sends status_request
 348     $proxy->clientflags("-no_rx_cert_comp -ct");
 349     $proxy->serverflags("-no_rx_cert_comp -status_file "
 350                         .srctop_file("test", "recipes", "ocsp-response.der")
 351                         ." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
 352     $proxy->start();
 353     checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 354                    checkhandshake::DEFAULT_EXTENSIONS
 355                    | checkhandshake::SCT_CLI_EXTENSION
 356                    | checkhandshake::SCT_SRV_EXTENSION
 357                    | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
 358                    | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
 359                    "SCT handshake test");
 360 }
 361
 362 #Test 15: HRR Handshake
 363 $proxy->clear();
 364 $proxy->clientflags("-no_rx_cert_comp");
 365 $proxy->serverflags("-no_rx_cert_comp -curves P-384");
 366 $proxy->start();
 367 checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
 368                checkhandshake::DEFAULT_EXTENSIONS
 369                | checkhandshake::KEY_SHARE_HRR_EXTENSION,
 370                "HRR handshake test");
 371
 372 #Test 16: Resumption handshake with HRR
 373 $proxy->clear();
 374 $proxy->clientflags("-no_rx_cert_comp -sess_in ".$session);
 375 $proxy->serverflags("-no_rx_cert_comp -curves P-384");
 376 $proxy->start();
 377 checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
 378                (checkhandshake::DEFAULT_EXTENSIONS
 379                 | checkhandshake::KEY_SHARE_HRR_EXTENSION
 380                 | checkhandshake::PSK_CLI_EXTENSION
 381                 | checkhandshake::PSK_SRV_EXTENSION),
 382                "Resumption handshake with HRR test");
 383
 384 #Test 17: Acceptable but non preferred key_share
 385 $proxy->clear();
 386 $proxy->clientflags("-no_rx_cert_comp -curves P-384");
 387 $proxy->start();
 388 checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
 389                checkhandshake::DEFAULT_EXTENSIONS
 390                | checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
 391                "Acceptable but non preferred key_share");
 392
 393 unlink $session;