]>
Commit | Line | Data |
---|---|---|
203b1cdf MC |
1 | #! /usr/bin/env perl |
2 | # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. | |
3 | # | |
4 | # Licensed under the OpenSSL license (the "License"). You may not use | |
5 | # this file except in compliance with the License. You can obtain a copy | |
6 | # in the file LICENSE in the source distribution or at | |
7 | # https://www.openssl.org/source/license.html | |
8 | ||
9 | use strict; | |
10 | use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/; | |
11 | use OpenSSL::Test::Utils; | |
12 | use TLSProxy::Proxy; | |
13 | use File::Temp qw(tempfile); | |
14 | ||
15 | use constant { | |
16 | REVERSE_ORDER_VERSIONS => 1, | |
17 | UNRECOGNISED_VERSIONS => 2, | |
18 | NO_EXTENSION => 3, | |
19 | EMPTY_EXTENSION => 4, | |
20 | NO_TLS1_3 => 5 | |
21 | }; | |
22 | ||
23 | my $testtype; | |
24 | ||
25 | my $test_name = "test_sslversions"; | |
26 | setup($test_name); | |
27 | ||
28 | plan skip_all => "TLSProxy isn't usable on $^O" | |
29 | if $^O =~ /^(VMS|MSWin32)$/; | |
30 | ||
31 | plan skip_all => "$test_name needs the dynamic engine feature enabled" | |
32 | if disabled("engine") || disabled("dynamic-engine"); | |
33 | ||
34 | plan skip_all => "$test_name needs the sock feature enabled" | |
35 | if disabled("sock"); | |
36 | ||
37 | plan skip_all => "$test_name needs TLS1.3, TLS1.2 and TLS1.1 enabled" | |
38 | if disabled("tls1_3") || disabled("tls1_2") || disabled("tls1_1"); | |
39 | ||
40 | $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; | |
41 | ||
42 | my $proxy = TLSProxy::Proxy->new( | |
43 | undef, | |
44 | cmdstr(app(["openssl"]), display => 1), | |
45 | srctop_file("apps", "server.pem"), | |
46 | (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) | |
47 | ); | |
48 | ||
49 | #We're just testing various negative and unusual scenarios here. ssltest with | |
50 | #02-protocol-version.conf should check all the various combinations of normal | |
51 | #version neg | |
52 | ||
53 | #Test 1: An empty supported_versions extension should not succeed | |
54 | $testtype = EMPTY_EXTENSION; | |
55 | $proxy->filter(\&modify_supported_versions_filter); | |
56 | $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; | |
57 | plan tests => 6; | |
58 | ok(TLSProxy::Message->fail(), "Empty supported versions"); | |
59 | ||
60 | #Test 2: supported_versions extension with no recognised versions should not | |
61 | #succeed | |
62 | $proxy->clear(); | |
63 | $testtype = UNRECOGNISED_VERSIONS; | |
64 | $proxy->start(); | |
65 | ok(TLSProxy::Message->fail(), "No recognised versions"); | |
66 | ||
67 | #Test 3: No supported versions extensions should succeed and select TLSv1.2 | |
68 | $proxy->clear(); | |
69 | $testtype = NO_EXTENSION; | |
70 | $proxy->start(); | |
71 | my $record = pop @{$proxy->record_list}; | |
72 | ok(TLSProxy::Message->success() | |
73 | && $record->version() == TLSProxy::Record::VERS_TLS_1_2, | |
74 | "No supported versions extension"); | |
75 | ||
76 | #Test 4: No supported versions extensions should fail if only TLS1.3 available | |
77 | $proxy->clear(); | |
78 | $proxy->serverflags("-tls1_3"); | |
79 | $proxy->start(); | |
80 | ok(TLSProxy::Message->fail(), "No supported versions extension (only TLS1.3)"); | |
81 | ||
82 | #Test 5: supported versions extension with best version last should succeed | |
83 | #and select TLSv1.3 | |
84 | $proxy->clear(); | |
85 | $testtype = REVERSE_ORDER_VERSIONS; | |
86 | $proxy->start(); | |
87 | $record = pop @{$proxy->record_list}; | |
88 | ok(TLSProxy::Message->success() | |
89 | && $record->version() == TLSProxy::Record::VERS_TLS_1_3, | |
90 | "Reverse order versions"); | |
91 | ||
92 | #Test 6: no TLSv1.3 or TLSv1.2 version in supported versions extension, but | |
93 | #TLSv1.1 and TLSv1.0 are present. Should just use TLSv1.1 and succeed | |
94 | $proxy->clear(); | |
95 | $testtype = NO_TLS1_3; | |
96 | $proxy->start(); | |
97 | $record = pop @{$proxy->record_list}; | |
98 | ok(TLSProxy::Message->success() | |
99 | && $record->version() == TLSProxy::Record::VERS_TLS_1_1, | |
100 | "No TLS1.3 in supported versions extension"); | |
101 | ||
102 | sub modify_supported_versions_filter | |
103 | { | |
104 | my $proxy = shift; | |
105 | ||
106 | # We're only interested in the initial ClientHello | |
107 | if ($proxy->flight != 0) { | |
108 | return; | |
109 | } | |
110 | ||
111 | foreach my $message (@{$proxy->message_list}) { | |
112 | if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) { | |
113 | my $ext; | |
114 | if ($testtype == REVERSE_ORDER_VERSIONS) { | |
115 | $ext = pack "C5", | |
116 | 0x04, # Length | |
117 | 0x03, 0x03, #TLSv1.2 | |
118 | 0x03, 0x04; #TLSv1.3 | |
119 | } elsif ($testtype == UNRECOGNISED_VERSIONS) { | |
120 | $ext = pack "C5", | |
121 | 0x04, # Length | |
122 | 0x04, 0x04, #Some unrecognised version | |
123 | 0x04, 0x03; #Another unrecognised version | |
124 | } elsif ($testtype == NO_TLS1_3) { | |
125 | $ext = pack "C5", | |
126 | 0x04, # Length | |
127 | 0x03, 0x02, #TLSv1.1 | |
128 | 0x03, 0x01; #TLSv1.0 | |
129 | } | |
130 | if ($testtype == REVERSE_ORDER_VERSIONS | |
131 | || $testtype == UNRECOGNISED_VERSIONS | |
132 | || $testtype == NO_TLS1_3) { | |
133 | $message->set_extension( | |
134 | TLSProxy::Message::EXT_SUPPORTED_VERSIONS, $ext); | |
135 | } elsif ($testtype == EMPTY_EXTENSION) { | |
136 | $message->set_extension( | |
137 | TLSProxy::Message::EXT_SUPPORTED_VERSIONS, ""); | |
138 | } else { | |
139 | $message->delete_extension( | |
140 | TLSProxy::Message::EXT_SUPPORTED_VERSIONS); | |
141 | } | |
142 | ||
143 | $message->repack(); | |
144 | } | |
145 | } | |
146 | } | |
147 | ||
148 |