From 60ea0034b8c5cb8b915ea025eb78970a1cb08f99 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 30 Nov 2016 12:04:34 +0000 Subject: [PATCH] Add more extension tests to test_sslmessages Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz Reviewed-by: Richard Levitte --- test/recipes/70-test_sslmessages.t | 199 +++++++++++++++++++++++++-- test/recipes/70-test_tls13messages.t | 8 +- test/recipes/checkhandshake.pm | 9 +- 3 files changed, 195 insertions(+), 21 deletions(-) diff --git a/test/recipes/70-test_sslmessages.t b/test/recipes/70-test_sslmessages.t index 7e1bf17552..1c1653af7c 100755 --- a/test/recipes/70-test_sslmessages.t +++ b/test/recipes/70-test_sslmessages.t @@ -12,18 +12,18 @@ use OpenSSL::Test::Utils; use File::Temp qw(tempfile); use TLSProxy::Proxy; +my $test_name; + # This block needs to run before 'use lib srctop_dir' directives. BEGIN { - OpenSSL::Test::setup("no_test_here"); + $test_name = "test_sslmessages"; + OpenSSL::Test::setup($test_name); } use lib srctop_dir("test", "recipes"); use recipes::checkhandshake qw(checkhandshake @handmessages @extensions); -my $test_name = "test_sslmessages"; -setup($test_name); - plan skip_all => "TLSProxy isn't usable on $^O" if $^O =~ /^(VMS|MSWin32)$/; @@ -37,7 +37,7 @@ plan skip_all => "$test_name needs TLS enabled" if alldisabled(available_protocols("tls")); $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; - +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); my $proxy = TLSProxy::Proxy->new( undef, @@ -46,8 +46,6 @@ my $proxy = TLSProxy::Proxy->new( (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) ); -sub checkhandshake($$$$$); - @handmessages = ( [TLSProxy::Message::MT_CLIENT_HELLO, recipes::checkhandshake::ALL_HANDSHAKES], @@ -71,6 +69,8 @@ sub checkhandshake($$$$$); & ~recipes::checkhandshake::RESUME_HANDSHAKE], [TLSProxy::Message::MT_CERTIFICATE_VERIFY, recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE], + [TLSProxy::Message::MT_NEXT_PROTO, + recipes::checkhandshake::NPN_HANDSHAKE], [TLSProxy::Message::MT_FINISHED, recipes::checkhandshake::ALL_HANDSHAKES], [TLSProxy::Message::MT_NEW_SESSION_TICKET, @@ -120,6 +120,10 @@ sub checkhandshake($$$$$); recipes::checkhandshake::DEFAULT_EXTENSIONS], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_RENEGOTIATE, recipes::checkhandshake::RENEGOTIATE_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_NPN, + recipes::checkhandshake::NPN_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SRP, + recipes::checkhandshake::SRP_CLI_EXTENSION], [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_RENEGOTIATE, recipes::checkhandshake::DEFAULT_EXTENSIONS], @@ -135,6 +139,10 @@ sub checkhandshake($$$$$); recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION], [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ALPN, recipes::checkhandshake::ALPN_SRV_EXTENSION], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SCT, + recipes::checkhandshake::SCT_SRV_EXTENSION], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_NPN, + recipes::checkhandshake::NPN_SRV_EXTENSION], [0,0,0] ); @@ -143,7 +151,7 @@ sub checkhandshake($$$$$); $proxy->serverconnects(2); $proxy->clientflags("-no_tls1_3 -sess_out ".$session); $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; -plan tests => 5; +plan tests => 20; checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, recipes::checkhandshake::DEFAULT_EXTENSIONS, "Default handshake test"); @@ -158,19 +166,38 @@ checkhandshake($proxy, recipes::checkhandshake::RESUME_HANDSHAKE, "Resumption handshake test"); unlink $session; -#Test 3: A default handshake, but with a CertificateStatus message +#Test 3: A status_request handshake (client request only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -status"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION, + "status_request handshake test (client)"); + +#Test 4: A status_request handshake (server support only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3"); +$proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der")); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS, + "status_request handshake test (server)"); + +#Test 5: A status_request handshake (client and server) $proxy->clear(); $proxy->clientflags("-no_tls1_3 -status"); $proxy->serverflags("-status_file " .srctop_file("test", "recipes", "ocsp-response.der")); $proxy->start(); checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS - | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION - | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION, - "OCSP handshake test"); + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION + | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION, + "status_request handshake test"); -#Test 4: A client auth handshake +#Test 6: A client auth handshake $proxy->clear(); $proxy->clientflags("-no_tls1_3 -cert ".srctop_file("apps", "server.pem")); $proxy->serverflags("-Verify 5"); @@ -179,7 +206,7 @@ checkhandshake($proxy, recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE, recipes::checkhandshake::DEFAULT_EXTENSIONS, "Client auth handshake test"); -#Test 5: A handshake with a renegotiation +#Test 7: A handshake with a renegotiation $proxy->clear(); $proxy->clientflags("-no_tls1_3"); $proxy->reneg(1); @@ -188,4 +215,146 @@ checkhandshake($proxy, recipes::checkhandshake::RENEG_HANDSHAKE, recipes::checkhandshake::DEFAULT_EXTENSIONS, "Rengotiation handshake test"); +#Test 8: Server name handshake (client request only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -servername testhost"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION, + "Server name handshake test (client)"); + +#Test 9: Server name handshake (server support only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3"); +$proxy->serverflags("-servername testhost"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS, + "Server name handshake test (server)"); + +#Test 10: Server name handshake (client and server) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -servername testhost"); +$proxy->serverflags("-servername testhost"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION + | recipes::checkhandshake::SERVER_NAME_SRV_EXTENSION, + "Server name handshake test"); + +#Test 11: ALPN handshake (client request only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -alpn test"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::ALPN_CLI_EXTENSION, + "ALPN handshake test (client)"); +#Test 12: ALPN handshake (server support only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3"); +$proxy->serverflags("-alpn test"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS, + "ALPN handshake test (server)"); + +#Test 13: ALPN handshake (client and server) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -alpn test"); +$proxy->serverflags("-alpn test"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::ALPN_CLI_EXTENSION + | recipes::checkhandshake::ALPN_SRV_EXTENSION, + "ALPN handshake test"); + +#Test 14: SCT handshake (client request only) +$proxy->clear(); +#Note: -ct also sends status_request +$proxy->clientflags("-no_tls1_3 -ct"); +$proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der")); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::SCT_CLI_EXTENSION + | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION + | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION, + "SCT handshake test (client)"); + +#Test 15: SCT handshake (server support only) +$proxy->clear(); +#Note: -ct also sends status_request +$proxy->clientflags("-no_tls1_3"); +$proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der")); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS, + "SCT handshake test (server)"); + +#Test 16: SCT handshake (client and server) +#There is no built-in server side support for this so we are actually also +#testing custom extensions here +$proxy->clear(); +#Note: -ct also sends status_request +$proxy->clientflags("-no_tls1_3 -ct"); +$proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der") + ." -serverinfo ".srctop_file("test", "serverinfo.pem")); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::SCT_CLI_EXTENSION + | recipes::checkhandshake::SCT_SRV_EXTENSION + | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION + | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION, + "SCT handshake test"); + + +#Test 17: NPN handshake (client request only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -nextprotoneg test"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::NPN_CLI_EXTENSION, + "NPN handshake test (client)"); + +#Test 18: NPN handshake (server support only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3"); +$proxy->serverflags("-nextprotoneg test"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS, + "NPN handshake test (server)"); + +#Test 19: NPN handshake (client and server) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -nextprotoneg test"); +$proxy->serverflags("-nextprotoneg test"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::NPN_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::NPN_CLI_EXTENSION + | recipes::checkhandshake::NPN_SRV_EXTENSION, + "NPN handshake test"); + +#Test 20: SRP extension +#Note: We are not actually going to perform an SRP handshake (TLSProxy does not +#support it). However it is sufficient for us to check that the SRP extension +#gets added on the client side. There is no SRP extension generated on the +#server side anyway. +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -srpuser user -srppass pass:pass"); +$proxy->start(); +checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, + recipes::checkhandshake::DEFAULT_EXTENSIONS + | recipes::checkhandshake::SRP_CLI_EXTENSION, + "SRP extension test"); diff --git a/test/recipes/70-test_tls13messages.t b/test/recipes/70-test_tls13messages.t index 6a5783b8b4..5bd5f7ad30 100755 --- a/test/recipes/70-test_tls13messages.t +++ b/test/recipes/70-test_tls13messages.t @@ -12,18 +12,18 @@ use OpenSSL::Test::Utils; use File::Temp qw(tempfile); use TLSProxy::Proxy; +my $test_name; + # This block needs to run before 'use lib srctop_dir' directives. BEGIN { - OpenSSL::Test::setup("no_test_here"); + $test_name = "test_tls13messages"; + OpenSSL::Test::setup($test_name); } use lib srctop_dir("test", "recipes"); use recipes::checkhandshake qw(checkhandshake @handmessages @extensions); -my $test_name = "test_tls13messages"; -setup($test_name); - plan skip_all => "TLSProxy isn't usable on $^O" if $^O =~ /^(VMS|MSWin32)$/; diff --git a/test/recipes/checkhandshake.pm b/test/recipes/checkhandshake.pm index 04ca9296c7..abd1ffd119 100644 --- a/test/recipes/checkhandshake.pm +++ b/test/recipes/checkhandshake.pm @@ -22,8 +22,9 @@ use constant { RESUME_HANDSHAKE => 4, CLIENT_AUTH_HANDSHAKE => 8, RENEG_HANDSHAKE => 16, + NPN_HANDSHAKE => 32, - ALL_HANDSHAKES => 31 + ALL_HANDSHAKES => 63 }; use constant { @@ -37,7 +38,11 @@ use constant { ALPN_CLI_EXTENSION => 0x00000040, ALPN_SRV_EXTENSION => 0x00000080, SCT_CLI_EXTENSION => 0x00000100, - RENEGOTIATE_CLI_EXTENSION => 0x00000200 + SCT_SRV_EXTENSION => 0x00000200, + RENEGOTIATE_CLI_EXTENSION => 0x00000400, + NPN_CLI_EXTENSION => 0x00000800, + NPN_SRV_EXTENSION => 0x00001000, + SRP_CLI_EXTENSION => 0x00002000, }; our @handmessages = (); -- 2.25.1