diff options
Diffstat (limited to 'deps/openssl/openssl/test/recipes/70-test_sslmessages.t')
| -rw-r--r-- | deps/openssl/openssl/test/recipes/70-test_sslmessages.t | 442 |
1 files changed, 351 insertions, 91 deletions
diff --git a/deps/openssl/openssl/test/recipes/70-test_sslmessages.t b/deps/openssl/openssl/test/recipes/70-test_sslmessages.t index b4631ea39c..1e4676973a 100644 --- a/deps/openssl/openssl/test/recipes/70-test_sslmessages.t +++ b/deps/openssl/openssl/test/recipes/70-test_sslmessages.t @@ -7,11 +7,13 @@ # https://www.openssl.org/source/license.html use strict; -use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/; +use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/; use OpenSSL::Test::Utils; use File::Temp qw(tempfile); use TLSProxy::Proxy; -my $test_name = "test_tls13messages"; +use checkhandshake qw(checkhandshake @handmessages @extensions); + +my $test_name = "test_sslmessages"; setup($test_name); plan skip_all => "TLSProxy isn't usable on $^O" @@ -24,44 +26,11 @@ plan skip_all => "$test_name needs the sock feature enabled" if disabled("sock"); plan skip_all => "$test_name needs TLS enabled" - if alldisabled(available_protocols("tls")); + if alldisabled(available_protocols("tls")) + || (!disabled("tls1_3") && disabled("tls1_2")); $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; - -use constant { - DEFAULT_HANDSHAKE => 1, - OCSP_HANDSHAKE => 2, - RESUME_HANDSHAKE => 4, - CLIENT_AUTH_HANDSHAKE => 8, - RENEG_HANDSHAKE => 16, - - ALL_HANDSHAKES => 31 -}; - -my @handmessages = ( - [TLSProxy::Message::MT_CLIENT_HELLO, ALL_HANDSHAKES], - [TLSProxy::Message::MT_SERVER_HELLO, ALL_HANDSHAKES], - [TLSProxy::Message::MT_CERTIFICATE, ALL_HANDSHAKES & ~RESUME_HANDSHAKE], - [TLSProxy::Message::MT_CERTIFICATE_STATUS, OCSP_HANDSHAKE], - #ServerKeyExchange handshakes not currently supported by TLSProxy - [TLSProxy::Message::MT_CERTIFICATE_REQUEST, CLIENT_AUTH_HANDSHAKE], - [TLSProxy::Message::MT_SERVER_HELLO_DONE, ALL_HANDSHAKES & ~RESUME_HANDSHAKE], - [TLSProxy::Message::MT_CERTIFICATE, CLIENT_AUTH_HANDSHAKE], - [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE, ALL_HANDSHAKES & ~RESUME_HANDSHAKE], - [TLSProxy::Message::MT_CERTIFICATE_VERIFY, CLIENT_AUTH_HANDSHAKE], - [TLSProxy::Message::MT_FINISHED, ALL_HANDSHAKES], - [TLSProxy::Message::MT_NEW_SESSION_TICKET, ALL_HANDSHAKES & ~RESUME_HANDSHAKE], - [TLSProxy::Message::MT_FINISHED, ALL_HANDSHAKES], - [TLSProxy::Message::MT_CLIENT_HELLO, RENEG_HANDSHAKE], - [TLSProxy::Message::MT_SERVER_HELLO, RENEG_HANDSHAKE], - [TLSProxy::Message::MT_CERTIFICATE, RENEG_HANDSHAKE], - [TLSProxy::Message::MT_SERVER_HELLO_DONE, RENEG_HANDSHAKE], - [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE, RENEG_HANDSHAKE], - [TLSProxy::Message::MT_FINISHED, RENEG_HANDSHAKE], - [TLSProxy::Message::MT_NEW_SESSION_TICKET, RENEG_HANDSHAKE], - [TLSProxy::Message::MT_FINISHED, RENEG_HANDSHAKE], - [0, 0] -); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); my $proxy = TLSProxy::Proxy->new( undef, @@ -70,78 +39,369 @@ my $proxy = TLSProxy::Proxy->new( (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) ); -sub checkmessages($$); +@handmessages = ( + [TLSProxy::Message::MT_CLIENT_HELLO, + checkhandshake::ALL_HANDSHAKES], + [TLSProxy::Message::MT_SERVER_HELLO, + checkhandshake::ALL_HANDSHAKES], + [TLSProxy::Message::MT_CERTIFICATE, + checkhandshake::ALL_HANDSHAKES + & ~checkhandshake::RESUME_HANDSHAKE], + (disabled("ec") ? () : + [TLSProxy::Message::MT_SERVER_KEY_EXCHANGE, + checkhandshake::EC_HANDSHAKE]), + [TLSProxy::Message::MT_CERTIFICATE_STATUS, + checkhandshake::OCSP_HANDSHAKE], + #ServerKeyExchange handshakes not currently supported by TLSProxy + [TLSProxy::Message::MT_CERTIFICATE_REQUEST, + checkhandshake::CLIENT_AUTH_HANDSHAKE], + [TLSProxy::Message::MT_SERVER_HELLO_DONE, + checkhandshake::ALL_HANDSHAKES + & ~checkhandshake::RESUME_HANDSHAKE], + [TLSProxy::Message::MT_CERTIFICATE, + checkhandshake::CLIENT_AUTH_HANDSHAKE], + [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE, + checkhandshake::ALL_HANDSHAKES + & ~checkhandshake::RESUME_HANDSHAKE], + [TLSProxy::Message::MT_CERTIFICATE_VERIFY, + checkhandshake::CLIENT_AUTH_HANDSHAKE], + [TLSProxy::Message::MT_NEXT_PROTO, + checkhandshake::NPN_HANDSHAKE], + [TLSProxy::Message::MT_FINISHED, + checkhandshake::ALL_HANDSHAKES], + [TLSProxy::Message::MT_NEW_SESSION_TICKET, + checkhandshake::ALL_HANDSHAKES + & ~checkhandshake::RESUME_HANDSHAKE], + [TLSProxy::Message::MT_FINISHED, + checkhandshake::ALL_HANDSHAKES], + [TLSProxy::Message::MT_CLIENT_HELLO, + checkhandshake::RENEG_HANDSHAKE], + [TLSProxy::Message::MT_SERVER_HELLO, + checkhandshake::RENEG_HANDSHAKE], + [TLSProxy::Message::MT_CERTIFICATE, + checkhandshake::RENEG_HANDSHAKE], + [TLSProxy::Message::MT_SERVER_HELLO_DONE, + checkhandshake::RENEG_HANDSHAKE], + [TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE, + checkhandshake::RENEG_HANDSHAKE], + [TLSProxy::Message::MT_FINISHED, + checkhandshake::RENEG_HANDSHAKE], + [TLSProxy::Message::MT_NEW_SESSION_TICKET, + checkhandshake::RENEG_HANDSHAKE], + [TLSProxy::Message::MT_FINISHED, + checkhandshake::RENEG_HANDSHAKE], + [0, 0] +); + +@extensions = ( + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME, + checkhandshake::SERVER_NAME_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST, + checkhandshake::STATUS_REQUEST_CLI_EXTENSION], + (disabled("ec") ? () : + [TLSProxy::Message::MT_CLIENT_HELLO, + TLSProxy::Message::EXT_SUPPORTED_GROUPS, + checkhandshake::DEFAULT_EXTENSIONS]), + (disabled("ec") ? () : + [TLSProxy::Message::MT_CLIENT_HELLO, + TLSProxy::Message::EXT_EC_POINT_FORMATS, + checkhandshake::DEFAULT_EXTENSIONS]), + (disabled("tls1_2") ? () : + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS, + checkhandshake::DEFAULT_EXTENSIONS]), + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN, + checkhandshake::ALPN_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT, + checkhandshake::SCT_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_RENEGOTIATE, + checkhandshake::RENEGOTIATE_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_NPN, + checkhandshake::NPN_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SRP, + checkhandshake::SRP_CLI_EXTENSION], + + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_RENEGOTIATE, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SESSION_TICKET, + checkhandshake::SESSION_TICKET_SRV_EXTENSION], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SERVER_NAME, + checkhandshake::SERVER_NAME_SRV_EXTENSION], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST, + checkhandshake::STATUS_REQUEST_SRV_EXTENSION], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_ALPN, + checkhandshake::ALPN_SRV_EXTENSION], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SCT, + checkhandshake::SCT_SRV_EXTENSION], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_NPN, + checkhandshake::NPN_SRV_EXTENSION], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS, + checkhandshake::EC_POINT_FORMAT_SRV_EXTENSION], + [0,0,0] +); #Test 1: Check we get all the right messages for a default handshake (undef, my $session) = tempfile(); $proxy->serverconnects(2); -$proxy->clientflags("-sess_out ".$session); +$proxy->clientflags("-no_tls1_3 -sess_out ".$session); $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; -plan tests => 5; -checkmessages(DEFAULT_HANDSHAKE, "Default handshake test"); +plan tests => 21; +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "Default handshake test"); #Test 2: Resumption handshake $proxy->clearClient(); -$proxy->clientflags("-sess_in ".$session); +$proxy->clientflags("-no_tls1_3 -sess_in ".$session); $proxy->clientstart(); -checkmessages(RESUME_HANDSHAKE, "Resumption handshake test"); +checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + & ~checkhandshake::SESSION_TICKET_SRV_EXTENSION, + "Resumption handshake test"); unlink $session; -#Test 3: A client auth handshake +SKIP: { + skip "No OCSP support in this OpenSSL build", 3 + if disabled("ocsp"); + + #Test 3: A status_request handshake (client request only) + $proxy->clear(); + $proxy->clientflags("-no_tls1_3 -status"); + $proxy->start(); + checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::STATUS_REQUEST_CLI_EXTENSION, + "status_request handshake test (client)"); + + #Test 4: A status_request handshake (server support only) + $proxy->clear(); + $proxy->clientflags("-no_tls1_3"); + $proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der")); + $proxy->start(); + checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "status_request handshake test (server)"); + + #Test 5: A status_request handshake (client and server) + $proxy->clear(); + $proxy->clientflags("-no_tls1_3 -status"); + $proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der")); + $proxy->start(); + checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::STATUS_REQUEST_CLI_EXTENSION + | checkhandshake::STATUS_REQUEST_SRV_EXTENSION, + "status_request handshake test"); +} + +#Test 6: A client auth handshake $proxy->clear(); -$proxy->clientflags("-cert ".srctop_file("apps", "server.pem")); +$proxy->clientflags("-no_tls1_3 -cert ".srctop_file("apps", "server.pem")); $proxy->serverflags("-Verify 5"); $proxy->start(); -checkmessages(CLIENT_AUTH_HANDSHAKE, "Client auth handshake test"); +checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "Client auth handshake test"); -#Test 4: A handshake with a renegotiation +#Test 7: A handshake with a renegotiation $proxy->clear(); +$proxy->clientflags("-no_tls1_3"); $proxy->reneg(1); $proxy->start(); -checkmessages(RENEG_HANDSHAKE, "Renegotiation handshake test"); +checkhandshake($proxy, checkhandshake::RENEG_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "Renegotiation handshake test"); -#Test 5: A handshake with a renegotiation and client auth +#Test 8: Server name handshake (no client request) $proxy->clear(); -$proxy->clientflags("-cert ".srctop_file("apps", "server.pem")); -$proxy->serverflags("-Verify 5"); -$proxy->reneg(1); +$proxy->clientflags("-no_tls1_3 -noservername"); +$proxy->start(); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + & ~checkhandshake::SERVER_NAME_CLI_EXTENSION, + "Server name handshake test (client)"); + +#Test 9: Server name handshake (server support only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -noservername"); +$proxy->serverflags("-servername testhost"); +$proxy->start(); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + & ~checkhandshake::SERVER_NAME_CLI_EXTENSION, + "Server name handshake test (server)"); + +#Test 10: Server name handshake (client and server) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -servername testhost"); +$proxy->serverflags("-servername testhost"); +$proxy->start(); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::SERVER_NAME_SRV_EXTENSION, + "Server name handshake test"); + +#Test 11: ALPN handshake (client request only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -alpn test"); +$proxy->start(); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::ALPN_CLI_EXTENSION, + "ALPN handshake test (client)"); + +#Test 12: ALPN handshake (server support only) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3"); +$proxy->serverflags("-alpn test"); +$proxy->start(); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "ALPN handshake test (server)"); + +#Test 13: ALPN handshake (client and server) +$proxy->clear(); +$proxy->clientflags("-no_tls1_3 -alpn test"); +$proxy->serverflags("-alpn test"); $proxy->start(); -checkmessages(RENEG_HANDSHAKE | CLIENT_AUTH_HANDSHAKE, - "Renogitation and client auth handshake test"); - -sub checkmessages($$) -{ - my ($handtype, $testname) = @_; - - subtest $testname => sub { - my $loop = 0; - my $numtests; - - #First count the number of tests - for ($numtests = 0; $handmessages[$loop][1] != 0; $loop++) { - $numtests++ if (($handmessages[$loop][1] & $handtype) != 0); - } - - plan tests => $numtests; - - my $nextmess = 0; - my $message = undef; - for ($loop = 0; $handmessages[$loop][1] != 0; $loop++) { - next if (($handmessages[$loop][1] & $handtype) == 0); - if (scalar @{$proxy->message_list} > $nextmess) { - $message = ${$proxy->message_list}[$nextmess]; - $nextmess++; - } else { - $message = undef; - } - if (!defined $message) { - fail("Message type check. Got nothing, expected " - .$handmessages[$loop][0]); - } else { - ok($message->mt == $handmessages[$loop][0], - "Message type check. Got ".$message->mt - .", expected ".$handmessages[$loop][0]); - } - } - } +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::ALPN_CLI_EXTENSION + | checkhandshake::ALPN_SRV_EXTENSION, + "ALPN handshake test"); + +SKIP: { + skip "No CT, EC or OCSP support in this OpenSSL build", 1 + if disabled("ct") || disabled("ec") || disabled("ocsp"); + + #Test 14: SCT handshake (client request only) + $proxy->clear(); + #Note: -ct also sends status_request + $proxy->clientflags("-no_tls1_3 -ct"); + $proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der")); + $proxy->start(); + checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::SCT_CLI_EXTENSION + | checkhandshake::STATUS_REQUEST_CLI_EXTENSION + | checkhandshake::STATUS_REQUEST_SRV_EXTENSION, + "SCT handshake test (client)"); +} + +SKIP: { + skip "No OCSP support in this OpenSSL build", 1 + if disabled("ocsp"); + + #Test 15: SCT handshake (server support only) + $proxy->clear(); + #Note: -ct also sends status_request + $proxy->clientflags("-no_tls1_3"); + $proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der")); + $proxy->start(); + checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "SCT handshake test (server)"); +} + +SKIP: { + skip "No CT, EC or OCSP support in this OpenSSL build", 1 + if disabled("ct") || disabled("ec") || disabled("ocsp"); + + #Test 16: SCT handshake (client and server) + #There is no built-in server side support for this so we are actually also + #testing custom extensions here + $proxy->clear(); + #Note: -ct also sends status_request + $proxy->clientflags("-no_tls1_3 -ct"); + $proxy->serverflags("-status_file " + .srctop_file("test", "recipes", "ocsp-response.der") + ." -serverinfo ".srctop_file("test", "serverinfo.pem")); + $proxy->start(); + checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::SCT_CLI_EXTENSION + | checkhandshake::SCT_SRV_EXTENSION + | checkhandshake::STATUS_REQUEST_CLI_EXTENSION + | checkhandshake::STATUS_REQUEST_SRV_EXTENSION, + "SCT handshake test"); +} + + +SKIP: { + skip "No NPN support in this OpenSSL build", 3 + if disabled("nextprotoneg"); + + #Test 17: NPN handshake (client request only) + $proxy->clear(); + $proxy->clientflags("-no_tls1_3 -nextprotoneg test"); + $proxy->start(); + checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::NPN_CLI_EXTENSION, + "NPN handshake test (client)"); + + #Test 18: NPN handshake (server support only) + $proxy->clear(); + $proxy->clientflags("-no_tls1_3"); + $proxy->serverflags("-nextprotoneg test"); + $proxy->start(); + checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "NPN handshake test (server)"); + + #Test 19: NPN handshake (client and server) + $proxy->clear(); + $proxy->clientflags("-no_tls1_3 -nextprotoneg test"); + $proxy->serverflags("-nextprotoneg test"); + $proxy->start(); + checkhandshake($proxy, checkhandshake::NPN_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::NPN_CLI_EXTENSION + | checkhandshake::NPN_SRV_EXTENSION, + "NPN handshake test"); +} + +SKIP: { + skip "No SRP support in this OpenSSL build", 1 + if disabled("srp"); + + #Test 20: SRP extension + #Note: We are not actually going to perform an SRP handshake (TLSProxy + #does not support it). However it is sufficient for us to check that the + #SRP extension gets added on the client side. There is no SRP extension + #generated on the server side anyway. + $proxy->clear(); + $proxy->clientflags("-no_tls1_3 -srpuser user -srppass pass:pass"); + $proxy->start(); + checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::SRP_CLI_EXTENSION, + "SRP extension test"); +} + +#Test 21: EC handshake +SKIP: { + skip "No EC support in this OpenSSL build", 1 if disabled("ec"); + $proxy->clear(); + $proxy->clientflags("-no_tls1_3"); + $proxy->serverflags("-no_tls1_3"); + $proxy->ciphers("ECDHE-RSA-AES128-SHA"); + $proxy->start(); + checkhandshake($proxy, checkhandshake::EC_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::EC_POINT_FORMAT_SRV_EXTENSION, + "EC handshake test"); } |