[thirdparty/openssl.git] / test / recipes / 70-test_tls13messages.t

#! /usr/bin/env perl
# Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

use strict;
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
use OpenSSL::Test::Utils;
use File::Temp qw(tempfile);
use TLSProxy::Proxy;
use checkhandshake qw(checkhandshake @handmessages @extensions);

my $test_name = "test_tls13messages";
setup($test_name);

plan skip_all => "TLSProxy isn't usable on $^O"
    if $^O =~ /^(VMS)$/;

plan skip_all => "$test_name needs the dynamic engine feature enabled"
    if disabled("engine") || disabled("dynamic-engine");

plan skip_all => "$test_name needs the sock feature enabled"
    if disabled("sock");

plan skip_all => "$test_name needs TLSv1.3 enabled"
    if disabled("tls1_3");

$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");


@handmessages = (
    [TLSProxy::Message::MT_CLIENT_HELLO,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_SERVER_HELLO,
        checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
    [TLSProxy::Message::MT_CLIENT_HELLO,
        checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
    [TLSProxy::Message::MT_SERVER_HELLO,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_CERTIFICATE,
        checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
    [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
        checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
    [TLSProxy::Message::MT_FINISHED,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_CERTIFICATE,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_FINISHED,
        checkhandshake::ALL_HANDSHAKES],
    [0, 0]
);

@extensions = (
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
        checkhandshake::SERVER_NAME_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
        checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
        checkhandshake::ALPN_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
        checkhandshake::SCT_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
        checkhandshake::PSK_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
        checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],

    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        checkhandshake::KEY_SHARE_HRR_EXTENSION],

    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
        checkhandshake::SERVER_NAME_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
        checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
        checkhandshake::ALPN_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
        checkhandshake::SCT_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
        checkhandshake::PSK_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
        checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],

    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
        checkhandshake::PSK_SRV_EXTENSION],

    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
        checkhandshake::SERVER_NAME_SRV_EXTENSION],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
        checkhandshake::ALPN_SRV_EXTENSION],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],

    [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
        checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
    [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
        checkhandshake::SCT_SRV_EXTENSION],

    [0,0,0]
);

my $proxy = TLSProxy::Proxy->new(
    undef,
    cmdstr(app(["openssl"]), display => 1),
    srctop_file("apps", "server.pem"),
    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
);

#Test 1: Check we get all the right messages for a default handshake
(undef, my $session) = tempfile();
$proxy->serverconnects(2);
$proxy->clientflags("-sess_out ".$session);
$proxy->sessionfile($session);
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 16;
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS,
               "Default handshake test");

#Test 2: Resumption handshake
$proxy->clearClient();
$proxy->clientflags("-sess_in ".$session);
$proxy->clientstart();
checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
               (checkhandshake::DEFAULT_EXTENSIONS
                | checkhandshake::PSK_CLI_EXTENSION
                | checkhandshake::PSK_SRV_EXTENSION),
               "Resumption handshake test");

SKIP: {
    skip "No OCSP support in this OpenSSL build", 3
        if disabled("ct") || disabled("ec") || disabled("ocsp");
    #Test 3: A status_request handshake (client request only)
    $proxy->clear();
    $proxy->clientflags("-status");
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
                   "status_request handshake test (client)");

    #Test 4: A status_request handshake (server support only)
    $proxy->clear();
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS,
                   "status_request handshake test (server)");

    #Test 5: A status_request handshake (client and server)
    $proxy->clear();
    $proxy->clientflags("-status");
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
                   | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
                   "status_request handshake test");
}

#Test 6: A client auth handshake
$proxy->clear();
$proxy->clientflags("-cert ".srctop_file("apps", "server.pem"));
$proxy->serverflags("-Verify 5");
$proxy->start();
checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS |
               checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
               "Client auth handshake test");

#Test 7: Server name handshake (no client request)
$proxy->clear();
$proxy->clientflags("-noservername");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
               "Server name handshake test (client)");

#Test 8: Server name handshake (server support only)
$proxy->clear();
$proxy->clientflags("-noservername");
$proxy->serverflags("-servername testhost");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
               "Server name handshake test (server)");

#Test 9: Server name handshake (client and server)
$proxy->clear();
$proxy->clientflags("-servername testhost");
$proxy->serverflags("-servername testhost");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::SERVER_NAME_SRV_EXTENSION,
               "Server name handshake test");

#Test 10: ALPN handshake (client request only)
$proxy->clear();
$proxy->clientflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::ALPN_CLI_EXTENSION,
               "ALPN handshake test (client)");

#Test 11: ALPN handshake (server support only)
$proxy->clear();
$proxy->serverflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS,
               "ALPN handshake test (server)");

#Test 12: ALPN handshake (client and server)
$proxy->clear();
$proxy->clientflags("-alpn test");
$proxy->serverflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::ALPN_CLI_EXTENSION
               | checkhandshake::ALPN_SRV_EXTENSION,
               "ALPN handshake test");

SKIP: {
    skip "No CT, EC or OCSP support in this OpenSSL build", 1
        if disabled("ct") || disabled("ec") || disabled("ocsp");

    #Test 13: SCT handshake (client request only)
    $proxy->clear();
    #Note: -ct also sends status_request
    $proxy->clientflags("-ct");
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der")
                        ." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::SCT_CLI_EXTENSION
                   | checkhandshake::SCT_SRV_EXTENSION
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
                   | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
                   "SCT handshake test");
}


#Test 14: HRR Handshake
$proxy->clear();
$proxy->serverflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::KEY_SHARE_HRR_EXTENSION,
               "HRR handshake test");

#Test 15: Resumption handshake with HRR
$proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->serverflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
               (checkhandshake::DEFAULT_EXTENSIONS
                | checkhandshake::KEY_SHARE_HRR_EXTENSION
                | checkhandshake::PSK_CLI_EXTENSION
                | checkhandshake::PSK_SRV_EXTENSION),
               "Resumption handshake with HRR test");

#Test 16: Acceptable but non preferred key_share
$proxy->clear();
$proxy->clientflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
               "Acceptable but non preferred key_share");

unlink $session;
Commit	Line	Data
c11237c2	1	#! /usr/bin/env perl
6738bf14	2	# Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
c11237c2 MC	3	#
	4	# Licensed under the OpenSSL license (the "License"). You may not use
	5	# this file except in compliance with the License. You can obtain a copy
	6	# in the file LICENSE in the source distribution or at
	7	# https://www.openssl.org/source/license.html
	8
	9	use strict;
f50306c2	10	use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
c11237c2	11	use OpenSSL::Test::Utils;
cc24a22b	12	use File::Temp qw(tempfile);
c11237c2	13	use TLSProxy::Proxy;
1e566129	14	use checkhandshake qw(checkhandshake @handmessages @extensions);
f50306c2	15
1e566129 MC	16	my $test_name = "test_tls13messages";
1e566129 MC	17	setup($test_name);
f50306c2	18
c11237c2	19	plan skip_all => "TLSProxy isn't usable on $^O"
c5856878	20	if $^O =~ /^(VMS)$/;
c11237c2 MC	21
	22	plan skip_all => "$test_name needs the dynamic engine feature enabled"
	23	if disabled("engine") \|\| disabled("dynamic-engine");
	24
	25	plan skip_all => "$test_name needs the sock feature enabled"
	26	if disabled("sock");
	27
	28	plan skip_all => "$test_name needs TLSv1.3 enabled"
	29	if disabled("tls1_3");
	30
	31	$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
9ce3ed2a	32	$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
c11237c2	33
c11237c2	34
f50306c2 MC	35	@handmessages = (
f50306c2 MC	36	[TLSProxy::Message::MT_CLIENT_HELLO,
1e566129	37	checkhandshake::ALL_HANDSHAKES],
597c51bc	38	[TLSProxy::Message::MT_SERVER_HELLO,
b0bfd140 MC	39	checkhandshake::HRR_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE],
	40	[TLSProxy::Message::MT_CLIENT_HELLO,
	41	checkhandshake::HRR_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE],
f50306c2	42	[TLSProxy::Message::MT_SERVER_HELLO,
1e566129	43	checkhandshake::ALL_HANDSHAKES],
f50306c2	44	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
1e566129	45	checkhandshake::ALL_HANDSHAKES],
f50306c2	46	[TLSProxy::Message::MT_CERTIFICATE_REQUEST,
1e566129	47	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	48	[TLSProxy::Message::MT_CERTIFICATE,
b0bfd140	49	checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE)],
2c5dfdc3	50	[TLSProxy::Message::MT_CERTIFICATE_VERIFY,
b0bfd140	51	checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE)],
f50306c2	52	[TLSProxy::Message::MT_FINISHED,
1e566129	53	checkhandshake::ALL_HANDSHAKES],
f50306c2	54	[TLSProxy::Message::MT_CERTIFICATE,
1e566129	55	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	56	[TLSProxy::Message::MT_CERTIFICATE_VERIFY,
1e566129	57	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	58	[TLSProxy::Message::MT_FINISHED,
1e566129	59	checkhandshake::ALL_HANDSHAKES],
c11237c2 MC	60	[0, 0]
	61	);
	62
f50306c2 MC	63	@extensions = (
f50306c2 MC	64	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
1e566129	65	checkhandshake::SERVER_NAME_CLI_EXTENSION],
f50306c2	66	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
1e566129	67	checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
f50306c2	68	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
1e566129	69	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	70	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
1e566129	71	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	72	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
1e566129	73	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	74	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
1e566129	75	checkhandshake::ALPN_CLI_EXTENSION],
f50306c2	76	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
1e566129	77	checkhandshake::SCT_CLI_EXTENSION],
f50306c2	78	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
1e566129	79	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	80	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
1e566129	81	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	82	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
1e566129	83	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	84	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
1e566129	85	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	86	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
1e566129	87	checkhandshake::DEFAULT_EXTENSIONS],
b2f7e8c0 MC	88	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
b2f7e8c0 MC	89	checkhandshake::DEFAULT_EXTENSIONS],
a23bb15a MC	90	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
a23bb15a MC	91	checkhandshake::PSK_CLI_EXTENSION],
9d75dce3 TS	92	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
9d75dce3 TS	93	checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],
f50306c2	94
426dfc9f MC	95	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
426dfc9f MC	96	checkhandshake::DEFAULT_EXTENSIONS],
597c51bc	97	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
b0bfd140 MC	98	checkhandshake::KEY_SHARE_HRR_EXTENSION],
	99
	100	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
	101	checkhandshake::SERVER_NAME_CLI_EXTENSION],
	102	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
	103	checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
	104	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
	105	checkhandshake::DEFAULT_EXTENSIONS],
a2b97bdf MC	106	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
a2b97bdf MC	107	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140 MC	108	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
	109	checkhandshake::DEFAULT_EXTENSIONS],
	110	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
	111	checkhandshake::ALPN_CLI_EXTENSION],
	112	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
	113	checkhandshake::SCT_CLI_EXTENSION],
a2b97bdf MC	114	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
	115	checkhandshake::DEFAULT_EXTENSIONS],
	116	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
	117	checkhandshake::DEFAULT_EXTENSIONS],
	118	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
	119	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140 MC	120	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
	121	checkhandshake::DEFAULT_EXTENSIONS],
	122	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
	123	checkhandshake::DEFAULT_EXTENSIONS],
	124	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
	125	checkhandshake::DEFAULT_EXTENSIONS],
	126	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
	127	checkhandshake::PSK_CLI_EXTENSION],
9d75dce3 TS	128	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
9d75dce3 TS	129	checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],
b0bfd140	130
88050dd1 MC	131	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
88050dd1 MC	132	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	133	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
1e566129	134	checkhandshake::DEFAULT_EXTENSIONS],
a23bb15a MC	135	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
a23bb15a MC	136	checkhandshake::PSK_SRV_EXTENSION],
f50306c2 MC	137
f50306c2 MC	138	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
1e566129	139	checkhandshake::SERVER_NAME_SRV_EXTENSION],
f50306c2	140	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
1e566129	141	checkhandshake::ALPN_SRV_EXTENSION],
de65f7b9 MC	142	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
de65f7b9 MC	143	checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],
e96e0f8e MC	144
	145	[TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
	146	checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
c3a48c7b MC	147	[TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
c3a48c7b MC	148	checkhandshake::SCT_SRV_EXTENSION],
e96e0f8e	149
9ce3ed2a MC	150	[0,0,0]
	151	);
	152
c11237c2 MC	153	my $proxy = TLSProxy::Proxy->new(
	154	undef,
	155	cmdstr(app(["openssl"]), display => 1),
	156	srctop_file("apps", "server.pem"),
	157	(!$ENV{HARNESS_ACTIVE} \|\| $ENV{HARNESS_VERBOSE})
	158	);
	159
c11237c2	160	#Test 1: Check we get all the right messages for a default handshake
cc24a22b	161	(undef, my $session) = tempfile();
a23bb15a	162	$proxy->serverconnects(2);
cc24a22b	163	$proxy->clientflags("-sess_out ".$session);
a23bb15a	164	$proxy->sessionfile($session);
c11237c2	165	$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
de65f7b9	166	plan tests => 16;
1e566129 MC	167	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	168	checkhandshake::DEFAULT_EXTENSIONS,
f50306c2	169	"Default handshake test");
c11237c2	170
cc24a22b	171	#Test 2: Resumption handshake
a23bb15a MC	172	$proxy->clearClient();
	173	$proxy->clientflags("-sess_in ".$session);
	174	$proxy->clientstart();
	175	checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
db919b1e MC	176	(checkhandshake::DEFAULT_EXTENSIONS
db919b1e MC	177	\| checkhandshake::PSK_CLI_EXTENSION
b510b740	178	\| checkhandshake::PSK_SRV_EXTENSION),
a23bb15a	179	"Resumption handshake test");
cc24a22b	180
5f21b440 BK	181	SKIP: {
	182	skip "No OCSP support in this OpenSSL build", 3
	183	if disabled("ct") \|\| disabled("ec") \|\| disabled("ocsp");
	184	#Test 3: A status_request handshake (client request only)
	185	$proxy->clear();
	186	$proxy->clientflags("-status");
	187	$proxy->start();
	188	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	189	checkhandshake::DEFAULT_EXTENSIONS
	190	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
	191	"status_request handshake test (client)");
	192
	193	#Test 4: A status_request handshake (server support only)
	194	$proxy->clear();
	195	$proxy->serverflags("-status_file "
	196	.srctop_file("test", "recipes", "ocsp-response.der"));
	197	$proxy->start();
	198	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	199	checkhandshake::DEFAULT_EXTENSIONS,
	200	"status_request handshake test (server)");
	201
	202	#Test 5: A status_request handshake (client and server)
	203	$proxy->clear();
	204	$proxy->clientflags("-status");
	205	$proxy->serverflags("-status_file "
	206	.srctop_file("test", "recipes", "ocsp-response.der"));
	207	$proxy->start();
	208	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	209	checkhandshake::DEFAULT_EXTENSIONS
	210	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION
	211	\| checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
	212	"status_request handshake test");
	213	}
cc24a22b	214
9ce3ed2a	215	#Test 6: A client auth handshake
cc24a22b MC	216	$proxy->clear();
	217	$proxy->clientflags("-cert ".srctop_file("apps", "server.pem"));
	218	$proxy->serverflags("-Verify 5");
	219	$proxy->start();
1e566129	220	checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
9d75dce3 TS	221	checkhandshake::DEFAULT_EXTENSIONS \|
9d75dce3 TS	222	checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
96153874	223	"Client auth handshake test");
cc24a22b	224
11ba87f2	225	#Test 7: Server name handshake (no client request)
9ce3ed2a	226	$proxy->clear();
11ba87f2	227	$proxy->clientflags("-noservername");
9ce3ed2a	228	$proxy->start();
1e566129 MC	229	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	230	checkhandshake::DEFAULT_EXTENSIONS
11ba87f2	231	& ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
96153874	232	"Server name handshake test (client)");
9ce3ed2a MC	233
	234	#Test 8: Server name handshake (server support only)
	235	$proxy->clear();
11ba87f2	236	$proxy->clientflags("-noservername");
9ce3ed2a MC	237	$proxy->serverflags("-servername testhost");
9ce3ed2a MC	238	$proxy->start();
1e566129	239	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
11ba87f2 MC	240	checkhandshake::DEFAULT_EXTENSIONS
11ba87f2 MC	241	& ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
96153874	242	"Server name handshake test (server)");
9ce3ed2a MC	243
	244	#Test 9: Server name handshake (client and server)
	245	$proxy->clear();
	246	$proxy->clientflags("-servername testhost");
	247	$proxy->serverflags("-servername testhost");
	248	$proxy->start();
1e566129	249	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
96153874	250	checkhandshake::DEFAULT_EXTENSIONS
96153874 MC	251	\| checkhandshake::SERVER_NAME_SRV_EXTENSION,
96153874 MC	252	"Server name handshake test");
9ce3ed2a MC	253
	254	#Test 10: ALPN handshake (client request only)
	255	$proxy->clear();
	256	$proxy->clientflags("-alpn test");
	257	$proxy->start();
1e566129 MC	258	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	259	checkhandshake::DEFAULT_EXTENSIONS
	260	\| checkhandshake::ALPN_CLI_EXTENSION,
96153874	261	"ALPN handshake test (client)");
9ce3ed2a MC	262
	263	#Test 11: ALPN handshake (server support only)
	264	$proxy->clear();
	265	$proxy->serverflags("-alpn test");
	266	$proxy->start();
1e566129 MC	267	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	268	checkhandshake::DEFAULT_EXTENSIONS,
96153874	269	"ALPN handshake test (server)");
a1448c26	270
9ce3ed2a MC	271	#Test 12: ALPN handshake (client and server)
	272	$proxy->clear();
	273	$proxy->clientflags("-alpn test");
	274	$proxy->serverflags("-alpn test");
	275	$proxy->start();
1e566129	276	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
96153874 MC	277	checkhandshake::DEFAULT_EXTENSIONS
	278	\| checkhandshake::ALPN_CLI_EXTENSION
	279	\| checkhandshake::ALPN_SRV_EXTENSION,
	280	"ALPN handshake test");
9ce3ed2a	281
c3a48c7b MC	282	SKIP: {
	283	skip "No CT, EC or OCSP support in this OpenSSL build", 1
	284	if disabled("ct") \|\| disabled("ec") \|\| disabled("ocsp");
	285
	286	#Test 13: SCT handshake (client request only)
	287	$proxy->clear();
	288	#Note: -ct also sends status_request
	289	$proxy->clientflags("-ct");
	290	$proxy->serverflags("-status_file "
	291	.srctop_file("test", "recipes", "ocsp-response.der")
	292	." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
	293	$proxy->start();
	294	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	295	checkhandshake::DEFAULT_EXTENSIONS
	296	\| checkhandshake::SCT_CLI_EXTENSION
	297	\| checkhandshake::SCT_SRV_EXTENSION
	298	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION
	299	\| checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
	300	"SCT handshake test");
	301	}
	302
	303
	304
b0bfd140 MC	305
	306	#Test 14: HRR Handshake
	307	$proxy->clear();
	308	$proxy->serverflags("-curves P-256");
	309	$proxy->start();
	310	checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
	311	checkhandshake::DEFAULT_EXTENSIONS
	312	\| checkhandshake::KEY_SHARE_HRR_EXTENSION,
	313	"HRR handshake test");
	314
	315	#Test 15: Resumption handshake with HRR
	316	$proxy->clear();
	317	$proxy->clientflags("-sess_in ".$session);
	318	$proxy->serverflags("-curves P-256");
	319	$proxy->start();
	320	checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
db919b1e MC	321	(checkhandshake::DEFAULT_EXTENSIONS
	322	\| checkhandshake::KEY_SHARE_HRR_EXTENSION
	323	\| checkhandshake::PSK_CLI_EXTENSION
b510b740	324	\| checkhandshake::PSK_SRV_EXTENSION),
b0bfd140	325	"Resumption handshake with HRR test");
de65f7b9 MC	326
	327	#Test 16: Acceptable but non preferred key_share
	328	$proxy->clear();
	329	$proxy->clientflags("-curves P-256");
	330	$proxy->start();
	331	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	332	checkhandshake::DEFAULT_EXTENSIONS
	333	\| checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
597c51bc	334	"Acceptable but non preferred key_share");
de65f7b9	335
b0bfd140	336	unlink $session;