2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
11 use OpenSSL::Test::Utils;
12 use File::Temp qw(tempfile);
17 # This block needs to run before 'use lib srctop_dir' directives.
19 $test_name = "test_sslmessages";
20 OpenSSL::Test::setup($test_name);
22 use lib srctop_dir("test");
24 use recipes::checkhandshake qw(checkhandshake @handmessages @extensions);
26 plan skip_all => "TLSProxy isn't usable on $^O"
27 if $^O =~ /^(VMS|MSWin32)$/;
29 plan skip_all => "$test_name needs the dynamic engine feature enabled"
30 if disabled("engine") || disabled("dynamic-engine");
32 plan skip_all => "$test_name needs the sock feature enabled"
35 plan skip_all => "$test_name needs TLS enabled"
36 if alldisabled(available_protocols("tls"));
38 $ENV{OPENSSL_ia32cap} = '~0x200000200000000';
39 $ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
41 my $proxy = TLSProxy::Proxy->new(
43 cmdstr(app(["openssl"]), display => 1),
44 srctop_file("apps", "server.pem"),
45 (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
49 [TLSProxy::Message::MT_CLIENT_HELLO,
50 recipes::checkhandshake::ALL_HANDSHAKES],
51 [TLSProxy::Message::MT_SERVER_HELLO,
52 recipes::checkhandshake::ALL_HANDSHAKES],
53 [TLSProxy::Message::MT_CERTIFICATE,
54 recipes::checkhandshake::ALL_HANDSHAKES
55 & ~recipes::checkhandshake::RESUME_HANDSHAKE],
56 [TLSProxy::Message::MT_CERTIFICATE_STATUS,
57 recipes::checkhandshake::OCSP_HANDSHAKE],
58 #ServerKeyExchange handshakes not currently supported by TLSProxy
59 [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
60 recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE],
61 [TLSProxy::Message::MT_SERVER_HELLO_DONE,
62 recipes::checkhandshake::ALL_HANDSHAKES
63 & ~recipes::checkhandshake::RESUME_HANDSHAKE],
64 [TLSProxy::Message::MT_CERTIFICATE,
65 recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE],
66 [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE,
67 recipes::checkhandshake::ALL_HANDSHAKES
68 & ~recipes::checkhandshake::RESUME_HANDSHAKE],
69 [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
70 recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE],
71 [TLSProxy::Message::MT_NEXT_PROTO,
72 recipes::checkhandshake::NPN_HANDSHAKE],
73 [TLSProxy::Message::MT_FINISHED,
74 recipes::checkhandshake::ALL_HANDSHAKES],
75 [TLSProxy::Message::MT_NEW_SESSION_TICKET,
76 recipes::checkhandshake::ALL_HANDSHAKES
77 & ~recipes::checkhandshake::RESUME_HANDSHAKE],
78 [TLSProxy::Message::MT_FINISHED,
79 recipes::checkhandshake::ALL_HANDSHAKES],
80 [TLSProxy::Message::MT_CLIENT_HELLO,
81 recipes::checkhandshake::RENEG_HANDSHAKE],
82 [TLSProxy::Message::MT_SERVER_HELLO,
83 recipes::checkhandshake::RENEG_HANDSHAKE],
84 [TLSProxy::Message::MT_CERTIFICATE,
85 recipes::checkhandshake::RENEG_HANDSHAKE],
86 [TLSProxy::Message::MT_SERVER_HELLO_DONE,
87 recipes::checkhandshake::RENEG_HANDSHAKE],
88 [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE,
89 recipes::checkhandshake::RENEG_HANDSHAKE],
90 [TLSProxy::Message::MT_FINISHED,
91 recipes::checkhandshake::RENEG_HANDSHAKE],
92 [TLSProxy::Message::MT_NEW_SESSION_TICKET,
93 recipes::checkhandshake::RENEG_HANDSHAKE],
94 [TLSProxy::Message::MT_FINISHED,
95 recipes::checkhandshake::RENEG_HANDSHAKE],
100 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
101 recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION],
102 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
103 recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
104 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
105 recipes::checkhandshake::DEFAULT_EXTENSIONS],
106 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
107 recipes::checkhandshake::DEFAULT_EXTENSIONS],
108 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
109 recipes::checkhandshake::DEFAULT_EXTENSIONS],
110 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
111 recipes::checkhandshake::ALPN_CLI_EXTENSION],
112 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
113 recipes::checkhandshake::SCT_CLI_EXTENSION],
114 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
115 recipes::checkhandshake::DEFAULT_EXTENSIONS],
116 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
117 recipes::checkhandshake::DEFAULT_EXTENSIONS],
118 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
119 recipes::checkhandshake::DEFAULT_EXTENSIONS],
120 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_RENEGOTIATE,
121 recipes::checkhandshake::RENEGOTIATE_CLI_EXTENSION],
122 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_NPN,
123 recipes::checkhandshake::NPN_CLI_EXTENSION],
124 [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SRP,
125 recipes::checkhandshake::SRP_CLI_EXTENSION],
127 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_RENEGOTIATE,
128 recipes::checkhandshake::DEFAULT_EXTENSIONS],
129 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
130 recipes::checkhandshake::DEFAULT_EXTENSIONS],
131 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
132 recipes::checkhandshake::DEFAULT_EXTENSIONS],
133 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
134 recipes::checkhandshake::SESSION_TICKET_SRV_EXTENSION],
135 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
136 recipes::checkhandshake::SERVER_NAME_SRV_EXTENSION],
137 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
138 recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
139 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ALPN,
140 recipes::checkhandshake::ALPN_SRV_EXTENSION],
141 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SCT,
142 recipes::checkhandshake::SCT_SRV_EXTENSION],
143 [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_NPN,
144 recipes::checkhandshake::NPN_SRV_EXTENSION],
148 #Test 1: Check we get all the right messages for a default handshake
149 (undef, my $session) = tempfile();
150 $proxy->serverconnects(2);
151 $proxy->clientflags("-no_tls1_3 -sess_out ".$session);
152 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
154 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
155 recipes::checkhandshake::DEFAULT_EXTENSIONS,
156 "Default handshake test");
158 #Test 2: Resumption handshake
159 $proxy->clearClient();
160 $proxy->clientflags("-no_tls1_3 -sess_in ".$session);
161 $proxy->clientstart();
162 checkhandshake($proxy, recipes::checkhandshake::RESUME_HANDSHAKE,
163 recipes::checkhandshake::DEFAULT_EXTENSIONS
164 & ~recipes::checkhandshake::SESSION_TICKET_SRV_EXTENSION,
165 "Resumption handshake test");
168 #Test 3: A status_request handshake (client request only)
170 $proxy->clientflags("-no_tls1_3 -status");
172 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
173 recipes::checkhandshake::DEFAULT_EXTENSIONS
174 | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
175 "status_request handshake test (client)");
177 #Test 4: A status_request handshake (server support only)
179 $proxy->clientflags("-no_tls1_3");
180 $proxy->serverflags("-status_file "
181 .srctop_file("test", "recipes", "ocsp-response.der"));
183 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
184 recipes::checkhandshake::DEFAULT_EXTENSIONS,
185 "status_request handshake test (server)");
187 #Test 5: A status_request handshake (client and server)
189 $proxy->clientflags("-no_tls1_3 -status");
190 $proxy->serverflags("-status_file "
191 .srctop_file("test", "recipes", "ocsp-response.der"));
193 checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE,
194 recipes::checkhandshake::DEFAULT_EXTENSIONS
195 | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION
196 | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
197 "status_request handshake test");
199 #Test 6: A client auth handshake
201 $proxy->clientflags("-no_tls1_3 -cert ".srctop_file("apps", "server.pem"));
202 $proxy->serverflags("-Verify 5");
204 checkhandshake($proxy, recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE,
205 recipes::checkhandshake::DEFAULT_EXTENSIONS,
206 "Client auth handshake test");
208 #Test 7: A handshake with a renegotiation
210 $proxy->clientflags("-no_tls1_3");
213 checkhandshake($proxy, recipes::checkhandshake::RENEG_HANDSHAKE,
214 recipes::checkhandshake::DEFAULT_EXTENSIONS,
215 "Rengotiation handshake test");
217 #Test 8: Server name handshake (client request only)
219 $proxy->clientflags("-no_tls1_3 -servername testhost");
221 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
222 recipes::checkhandshake::DEFAULT_EXTENSIONS
223 | recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION,
224 "Server name handshake test (client)");
226 #Test 9: Server name handshake (server support only)
228 $proxy->clientflags("-no_tls1_3");
229 $proxy->serverflags("-servername testhost");
231 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
232 recipes::checkhandshake::DEFAULT_EXTENSIONS,
233 "Server name handshake test (server)");
235 #Test 10: Server name handshake (client and server)
237 $proxy->clientflags("-no_tls1_3 -servername testhost");
238 $proxy->serverflags("-servername testhost");
240 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
241 recipes::checkhandshake::DEFAULT_EXTENSIONS
242 | recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION
243 | recipes::checkhandshake::SERVER_NAME_SRV_EXTENSION,
244 "Server name handshake test");
246 #Test 11: ALPN handshake (client request only)
248 $proxy->clientflags("-no_tls1_3 -alpn test");
250 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
251 recipes::checkhandshake::DEFAULT_EXTENSIONS
252 | recipes::checkhandshake::ALPN_CLI_EXTENSION,
253 "ALPN handshake test (client)");
255 #Test 12: ALPN handshake (server support only)
257 $proxy->clientflags("-no_tls1_3");
258 $proxy->serverflags("-alpn test");
260 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
261 recipes::checkhandshake::DEFAULT_EXTENSIONS,
262 "ALPN handshake test (server)");
264 #Test 13: ALPN handshake (client and server)
266 $proxy->clientflags("-no_tls1_3 -alpn test");
267 $proxy->serverflags("-alpn test");
269 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
270 recipes::checkhandshake::DEFAULT_EXTENSIONS
271 | recipes::checkhandshake::ALPN_CLI_EXTENSION
272 | recipes::checkhandshake::ALPN_SRV_EXTENSION,
273 "ALPN handshake test");
275 #Test 14: SCT handshake (client request only)
277 #Note: -ct also sends status_request
278 $proxy->clientflags("-no_tls1_3 -ct");
279 $proxy->serverflags("-status_file "
280 .srctop_file("test", "recipes", "ocsp-response.der"));
282 checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE,
283 recipes::checkhandshake::DEFAULT_EXTENSIONS
284 | recipes::checkhandshake::SCT_CLI_EXTENSION
285 | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION
286 | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
287 "SCT handshake test (client)");
289 #Test 15: SCT handshake (server support only)
291 #Note: -ct also sends status_request
292 $proxy->clientflags("-no_tls1_3");
293 $proxy->serverflags("-status_file "
294 .srctop_file("test", "recipes", "ocsp-response.der"));
296 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
297 recipes::checkhandshake::DEFAULT_EXTENSIONS,
298 "SCT handshake test (server)");
300 #Test 16: SCT handshake (client and server)
301 #There is no built-in server side support for this so we are actually also
302 #testing custom extensions here
304 #Note: -ct also sends status_request
305 $proxy->clientflags("-no_tls1_3 -ct");
306 $proxy->serverflags("-status_file "
307 .srctop_file("test", "recipes", "ocsp-response.der")
308 ." -serverinfo ".srctop_file("test", "serverinfo.pem"));
310 checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE,
311 recipes::checkhandshake::DEFAULT_EXTENSIONS
312 | recipes::checkhandshake::SCT_CLI_EXTENSION
313 | recipes::checkhandshake::SCT_SRV_EXTENSION
314 | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION
315 | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
316 "SCT handshake test");
319 #Test 17: NPN handshake (client request only)
321 $proxy->clientflags("-no_tls1_3 -nextprotoneg test");
323 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
324 recipes::checkhandshake::DEFAULT_EXTENSIONS
325 | recipes::checkhandshake::NPN_CLI_EXTENSION,
326 "NPN handshake test (client)");
328 #Test 18: NPN handshake (server support only)
330 $proxy->clientflags("-no_tls1_3");
331 $proxy->serverflags("-nextprotoneg test");
333 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
334 recipes::checkhandshake::DEFAULT_EXTENSIONS,
335 "NPN handshake test (server)");
337 #Test 19: NPN handshake (client and server)
339 $proxy->clientflags("-no_tls1_3 -nextprotoneg test");
340 $proxy->serverflags("-nextprotoneg test");
342 checkhandshake($proxy, recipes::checkhandshake::NPN_HANDSHAKE,
343 recipes::checkhandshake::DEFAULT_EXTENSIONS
344 | recipes::checkhandshake::NPN_CLI_EXTENSION
345 | recipes::checkhandshake::NPN_SRV_EXTENSION,
346 "NPN handshake test");
348 #Test 20: SRP extension
349 #Note: We are not actually going to perform an SRP handshake (TLSProxy does not
350 #support it). However it is sufficient for us to check that the SRP extension
351 #gets added on the client side. There is no SRP extension generated on the
354 $proxy->clientflags("-no_tls1_3 -srpuser user -srppass pass:pass");
356 checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE,
357 recipes::checkhandshake::DEFAULT_EXTENSIONS
358 | recipes::checkhandshake::SRP_CLI_EXTENSION,
359 "SRP extension test");