]>
Commit | Line | Data |
---|---|---|
596d6b7e | 1 | #! /usr/bin/env perl |
54b40531 | 2 | # Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. |
ddcc5e5b | 3 | # |
909f1a2e | 4 | # Licensed under the Apache License 2.0 (the "License"). You may not use |
596d6b7e RS |
5 | # this file except in compliance with the License. You can obtain a copy |
6 | # in the file LICENSE in the source distribution or at | |
7 | # https://www.openssl.org/source/license.html | |
ddcc5e5b MC |
8 | |
9 | use strict; | |
42e0ccdf | 10 | use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/; |
3f22ed2f | 11 | use OpenSSL::Test::Utils; |
ddcc5e5b MC |
12 | use TLSProxy::Proxy; |
13 | use File::Temp qw(tempfile); | |
14 | ||
c27a4049 RL |
15 | my $test_name = "test_sslsessiontick"; |
16 | setup($test_name); | |
17 | ||
60f9f1e1 | 18 | plan skip_all => "TLSProxy isn't usable on $^O" |
c5856878 | 19 | if $^O =~ /^(VMS)$/; |
60f9f1e1 | 20 | |
2dd400bd | 21 | plan skip_all => "$test_name needs the dynamic engine feature enabled" |
19ab5790 | 22 | if disabled("engine") || disabled("dynamic-engine"); |
c27a4049 | 23 | |
f9e55034 MC |
24 | plan skip_all => "$test_name needs the sock feature enabled" |
25 | if disabled("sock"); | |
26 | ||
9362c93e MC |
27 | plan skip_all => "$test_name needs SSLv3, TLSv1, TLSv1.1 or TLSv1.2 enabled" |
28 | if alldisabled(("ssl3", "tls1", "tls1_1", "tls1_2")); | |
b273fcc5 | 29 | |
c27a4049 | 30 | sub checkmessages($$$$$$); |
5427976d | 31 | sub clearclient(); |
c27a4049 RL |
32 | sub clearall(); |
33 | ||
ddcc5e5b MC |
34 | my $chellotickext = 0; |
35 | my $shellotickext = 0; | |
36 | my $fullhand = 0; | |
37 | my $ticketseen = 0; | |
38 | ||
39 | my $proxy = TLSProxy::Proxy->new( | |
40 | undef, | |
25c78440 | 41 | cmdstr(app(["openssl"]), display => 1), |
b44b935e RL |
42 | srctop_file("apps", "server.pem"), |
43 | (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) | |
ddcc5e5b MC |
44 | ); |
45 | ||
46 | #Test 1: By default with no existing session we should get a session ticket | |
47 | #Expected result: ClientHello extension seen; ServerHello extension seen | |
48 | # NewSessionTicket message seen; Full handshake | |
9362c93e | 49 | $proxy->clientflags("-no_tls1_3"); |
b02b5743 MC |
50 | $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; |
51 | plan tests => 10; | |
ddcc5e5b MC |
52 | checkmessages(1, "Default session ticket test", 1, 1, 1, 1); |
53 | ||
54 | #Test 2: If the server does not accept tickets we should get a normal handshake | |
55 | #with no session tickets | |
56 | #Expected result: ClientHello extension seen; ServerHello extension not seen | |
57 | # NewSessionTicket message not seen; Full handshake | |
58 | clearall(); | |
9362c93e | 59 | $proxy->clientflags("-no_tls1_3"); |
ddcc5e5b MC |
60 | $proxy->serverflags("-no_ticket"); |
61 | $proxy->start(); | |
62 | checkmessages(2, "No server support session ticket test", 1, 0, 0, 1); | |
63 | ||
64 | #Test 3: If the client does not accept tickets we should get a normal handshake | |
65 | #with no session tickets | |
66 | #Expected result: ClientHello extension not seen; ServerHello extension not seen | |
67 | # NewSessionTicket message not seen; Full handshake | |
68 | clearall(); | |
9362c93e | 69 | $proxy->clientflags("-no_tls1_3 -no_ticket"); |
ddcc5e5b MC |
70 | $proxy->start(); |
71 | checkmessages(3, "No client support session ticket test", 0, 0, 0, 1); | |
72 | ||
73 | #Test 4: Test session resumption with session ticket | |
74 | #Expected result: ClientHello extension seen; ServerHello extension not seen | |
75 | # NewSessionTicket message not seen; Abbreviated handshake | |
76 | clearall(); | |
b38c43f7 | 77 | (undef, my $session) = tempfile(); |
ddcc5e5b | 78 | $proxy->serverconnects(2); |
9362c93e | 79 | $proxy->clientflags("-no_tls1_3 -sess_out ".$session); |
ddcc5e5b | 80 | $proxy->start(); |
5427976d | 81 | $proxy->clearClient(); |
9362c93e | 82 | $proxy->clientflags("-no_tls1_3 -sess_in ".$session); |
ddcc5e5b MC |
83 | $proxy->clientstart(); |
84 | checkmessages(4, "Session resumption session ticket test", 1, 0, 0, 0); | |
b38c43f7 | 85 | unlink $session; |
ddcc5e5b MC |
86 | |
87 | #Test 5: Test session resumption with ticket capable client without a ticket | |
88 | #Expected result: ClientHello extension seen; ServerHello extension seen | |
89 | # NewSessionTicket message seen; Abbreviated handshake | |
90 | clearall(); | |
b38c43f7 | 91 | (undef, $session) = tempfile(); |
ddcc5e5b | 92 | $proxy->serverconnects(2); |
9362c93e | 93 | $proxy->clientflags("-no_tls1_3 -sess_out ".$session." -no_ticket"); |
ddcc5e5b | 94 | $proxy->start(); |
5427976d | 95 | $proxy->clearClient(); |
9362c93e | 96 | $proxy->clientflags("-no_tls1_3 -sess_in ".$session); |
ddcc5e5b MC |
97 | $proxy->clientstart(); |
98 | checkmessages(5, "Session resumption with ticket capable client without a " | |
99 | ."ticket", 1, 1, 1, 0); | |
b38c43f7 | 100 | unlink $session; |
ddcc5e5b | 101 | |
7f6d90ac EK |
102 | #Test 6: Client accepts empty ticket. |
103 | #Expected result: ClientHello extension seen; ServerHello extension seen; | |
104 | # NewSessionTicket message seen; Full handshake. | |
105 | clearall(); | |
106 | $proxy->filter(\&ticket_filter); | |
9362c93e | 107 | $proxy->clientflags("-no_tls1_3"); |
7f6d90ac EK |
108 | $proxy->start(); |
109 | checkmessages(6, "Empty ticket test", 1, 1, 1, 1); | |
110 | ||
cf7f8592 EK |
111 | #Test 7-8: Client keeps existing ticket on empty ticket. |
112 | clearall(); | |
b38c43f7 | 113 | (undef, $session) = tempfile(); |
cf7f8592 EK |
114 | $proxy->serverconnects(3); |
115 | $proxy->filter(undef); | |
9362c93e | 116 | $proxy->clientflags("-no_tls1_3 -sess_out ".$session); |
cf7f8592 | 117 | $proxy->start(); |
5427976d | 118 | $proxy->clearClient(); |
9362c93e | 119 | $proxy->clientflags("-no_tls1_3 -sess_in ".$session." -sess_out ".$session); |
cf7f8592 EK |
120 | $proxy->filter(\&inject_empty_ticket_filter); |
121 | $proxy->clientstart(); | |
122 | #Expected result: ClientHello extension seen; ServerHello extension seen; | |
123 | # NewSessionTicket message seen; Abbreviated handshake. | |
124 | checkmessages(7, "Empty ticket resumption test", 1, 1, 1, 0); | |
5427976d | 125 | clearclient(); |
9362c93e | 126 | $proxy->clientflags("-no_tls1_3 -sess_in ".$session); |
cf7f8592 EK |
127 | $proxy->filter(undef); |
128 | $proxy->clientstart(); | |
129 | #Expected result: ClientHello extension seen; ServerHello extension not seen; | |
130 | # NewSessionTicket message not seen; Abbreviated handshake. | |
131 | checkmessages(8, "Empty ticket resumption test", 1, 0, 0, 0); | |
b38c43f7 | 132 | unlink $session; |
cf7f8592 | 133 | |
5f726759 MC |
134 | #Test 9: Bad server sends the ServerHello extension but does not send a |
135 | #NewSessionTicket | |
136 | #Expected result: Connection failure | |
137 | clearall(); | |
9362c93e | 138 | $proxy->clientflags("-no_tls1_3"); |
5f726759 MC |
139 | $proxy->serverflags("-no_ticket"); |
140 | $proxy->filter(\&inject_ticket_extension_filter); | |
141 | $proxy->start(); | |
142 | ok(TLSProxy::Message->fail, "Server sends ticket extension but no ticket test"); | |
143 | ||
144 | #Test10: Bad server does not send the ServerHello extension but does send a | |
145 | #NewSessionTicket | |
146 | #Expected result: Connection failure | |
147 | clearall(); | |
9362c93e | 148 | $proxy->clientflags("-no_tls1_3"); |
5f726759 MC |
149 | $proxy->serverflags("-no_ticket"); |
150 | $proxy->filter(\&inject_empty_ticket_filter); | |
151 | $proxy->start(); | |
152 | ok(TLSProxy::Message->fail, "No server ticket extension but ticket sent test"); | |
7f6d90ac EK |
153 | |
154 | sub ticket_filter | |
155 | { | |
156 | my $proxy = shift; | |
157 | ||
158 | foreach my $message (@{$proxy->message_list}) { | |
159 | if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { | |
160 | $message->ticket(""); | |
161 | $message->repack(); | |
162 | } | |
163 | } | |
164 | } | |
165 | ||
cf7f8592 EK |
166 | sub inject_empty_ticket_filter { |
167 | my $proxy = shift; | |
168 | ||
169 | foreach my $message (@{$proxy->message_list}) { | |
170 | if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { | |
171 | # Only inject the message first time we're called. | |
172 | return; | |
173 | } | |
174 | } | |
175 | ||
176 | my @new_message_list = (); | |
177 | foreach my $message (@{$proxy->message_list}) { | |
178 | push @new_message_list, $message; | |
179 | if ($message->mt == TLSProxy::Message::MT_SERVER_HELLO) { | |
aa474d1f | 180 | $message->set_extension(TLSProxy::Message::EXT_SESSION_TICKET, ""); |
cf7f8592 EK |
181 | $message->repack(); |
182 | # Tack NewSessionTicket onto the ServerHello record. | |
183 | # This only works if the ServerHello is exactly one record. | |
184 | my $record = ${$message->records}[0]; | |
185 | ||
186 | my $offset = $message->startoffset + $message->encoded_length; | |
187 | my $newsessionticket = TLSProxy::NewSessionTicket->new( | |
188 | 1, "", [$record], $offset, []); | |
189 | $newsessionticket->repack(); | |
190 | push @new_message_list, $newsessionticket; | |
191 | } | |
192 | } | |
193 | $proxy->message_list([@new_message_list]); | |
194 | } | |
195 | ||
5f726759 MC |
196 | sub inject_ticket_extension_filter |
197 | { | |
198 | my $proxy = shift; | |
199 | ||
200 | # We're only interested in the initial ServerHello | |
201 | if ($proxy->flight != 1) { | |
202 | return; | |
203 | } | |
204 | ||
205 | foreach my $message (@{$proxy->message_list}) { | |
206 | if ($message->mt == TLSProxy::Message::MT_SERVER_HELLO) { | |
207 | #Add the session ticket extension to the ServerHello even though | |
208 | #we are not going to send a NewSessionTicket message | |
209 | $message->set_extension(TLSProxy::Message::EXT_SESSION_TICKET, ""); | |
210 | ||
211 | $message->repack(); | |
212 | } | |
213 | } | |
214 | } | |
215 | ||
c27a4049 | 216 | sub checkmessages($$$$$$) |
ddcc5e5b MC |
217 | { |
218 | my ($testno, $testname, $testch, $testsh, $testtickseen, $testhand) = @_; | |
219 | ||
c27a4049 RL |
220 | subtest $testname => sub { |
221 | ||
a0430488 P |
222 | foreach my $message (@{$proxy->message_list}) { |
223 | if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO | |
ddcc5e5b | 224 | || $message->mt == TLSProxy::Message::MT_SERVER_HELLO) { |
a0430488 P |
225 | #Get the extensions data |
226 | my %extensions = %{$message->extension_data}; | |
227 | if (defined | |
aa474d1f | 228 | $extensions{TLSProxy::Message::EXT_SESSION_TICKET}) { |
a0430488 P |
229 | if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) { |
230 | $chellotickext = 1; | |
231 | } else { | |
232 | $shellotickext = 1; | |
233 | } | |
234 | } | |
235 | } elsif ($message->mt == TLSProxy::Message::MT_CERTIFICATE) { | |
236 | #Must be doing a full handshake | |
237 | $fullhand = 1; | |
238 | } elsif ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { | |
239 | $ticketseen = 1; | |
240 | } | |
241 | } | |
242 | ||
243 | plan tests => 5; | |
244 | ||
245 | ok(TLSProxy::Message->success, "Handshake"); | |
246 | ok(($testch && $chellotickext) || (!$testch && !$chellotickext), | |
247 | "ClientHello extension Session Ticket check"); | |
248 | ok(($testsh && $shellotickext) || (!$testsh && !$shellotickext), | |
249 | "ServerHello extension Session Ticket check"); | |
250 | ok(($testtickseen && $ticketseen) || (!$testtickseen && !$ticketseen), | |
251 | "Session Ticket message presence check"); | |
252 | ok(($testhand && $fullhand) || (!$testhand && !$fullhand), | |
253 | "Session Ticket full handshake check"); | |
ddcc5e5b | 254 | } |
ddcc5e5b MC |
255 | } |
256 | ||
5427976d MC |
257 | |
258 | sub clearclient() | |
ddcc5e5b MC |
259 | { |
260 | $chellotickext = 0; | |
261 | $shellotickext = 0; | |
262 | $fullhand = 0; | |
263 | $ticketseen = 0; | |
5427976d MC |
264 | $proxy->clearClient(); |
265 | } | |
266 | ||
267 | sub clearall() | |
268 | { | |
269 | clearclient(); | |
ddcc5e5b MC |
270 | $proxy->clear(); |
271 | } |