[thirdparty/openssl.git] / test / recipes / 70-test_tls13messages.t

#! /usr/bin/env perl
# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

use strict;
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
use OpenSSL::Test::Utils;
use File::Temp qw(tempfile);
use TLSProxy::Proxy;
use checkhandshake qw(checkhandshake @handmessages @extensions);

my $test_name = "test_tls13messages";
setup($test_name);

plan skip_all => "TLSProxy isn't usable on $^O"
    if $^O =~ /^(VMS|MSWin32)$/;

plan skip_all => "$test_name needs the dynamic engine feature enabled"
    if disabled("engine") || disabled("dynamic-engine");

plan skip_all => "$test_name needs the sock feature enabled"
    if disabled("sock");

plan skip_all => "$test_name needs TLSv1.3 enabled"
    if disabled("tls1_3");

$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");


@handmessages = (
    [TLSProxy::Message::MT_CLIENT_HELLO,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_SERVER_HELLO,
        checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
    [TLSProxy::Message::MT_CLIENT_HELLO,
        checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
    [TLSProxy::Message::MT_SERVER_HELLO,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_CERTIFICATE,
        checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
    [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
        checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
    [TLSProxy::Message::MT_FINISHED,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_CERTIFICATE,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_FINISHED,
        checkhandshake::ALL_HANDSHAKES],
    [0, 0]
);

@extensions = (
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
        checkhandshake::SERVER_NAME_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
        checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
        checkhandshake::ALPN_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
        checkhandshake::SCT_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
        checkhandshake::PSK_CLI_EXTENSION],

    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        checkhandshake::KEY_SHARE_HRR_EXTENSION],

    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
        checkhandshake::SERVER_NAME_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
        checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
        checkhandshake::ALPN_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
        checkhandshake::SCT_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
        checkhandshake::PSK_CLI_EXTENSION],

    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
        checkhandshake::PSK_SRV_EXTENSION],

    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
        checkhandshake::SERVER_NAME_SRV_EXTENSION],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
        checkhandshake::ALPN_SRV_EXTENSION],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],

    [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
        checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
    [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
        checkhandshake::SCT_SRV_EXTENSION],

    [0,0,0]
);

my $proxy = TLSProxy::Proxy->new(
    undef,
    cmdstr(app(["openssl"]), display => 1),
    srctop_file("apps", "server.pem"),
    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
);

#Test 1: Check we get all the right messages for a default handshake
(undef, my $session) = tempfile();
$proxy->serverconnects(2);
$proxy->clientflags("-sess_out ".$session);
$proxy->sessionfile($session);
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 16;
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS,
               "Default handshake test");

#Test 2: Resumption handshake
$proxy->clearClient();
$proxy->clientflags("-sess_in ".$session);
$proxy->clientstart();
checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
               (checkhandshake::DEFAULT_EXTENSIONS
                | checkhandshake::PSK_CLI_EXTENSION
                | checkhandshake::PSK_SRV_EXTENSION),
               "Resumption handshake test");

SKIP: {
    skip "No OCSP support in this OpenSSL build", 3
        if disabled("ct") || disabled("ec") || disabled("ocsp");
    #Test 3: A status_request handshake (client request only)
    $proxy->clear();
    $proxy->clientflags("-status");
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
                   "status_request handshake test (client)");

    #Test 4: A status_request handshake (server support only)
    $proxy->clear();
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS,
                   "status_request handshake test (server)");

    #Test 5: A status_request handshake (client and server)
    $proxy->clear();
    $proxy->clientflags("-status");
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
                   | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
                   "status_request handshake test");
}

#Test 6: A client auth handshake
$proxy->clear();
$proxy->clientflags("-cert ".srctop_file("apps", "server.pem"));
$proxy->serverflags("-Verify 5");
$proxy->start();
checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS,
               "Client auth handshake test");

#Test 7: Server name handshake (no client request)
$proxy->clear();
$proxy->clientflags("-noservername");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
               "Server name handshake test (client)");

#Test 8: Server name handshake (server support only)
$proxy->clear();
$proxy->clientflags("-noservername");
$proxy->serverflags("-servername testhost");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
               "Server name handshake test (server)");

#Test 9: Server name handshake (client and server)
$proxy->clear();
$proxy->clientflags("-servername testhost");
$proxy->serverflags("-servername testhost");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::SERVER_NAME_SRV_EXTENSION,
               "Server name handshake test");

#Test 10: ALPN handshake (client request only)
$proxy->clear();
$proxy->clientflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::ALPN_CLI_EXTENSION,
               "ALPN handshake test (client)");

#Test 11: ALPN handshake (server support only)
$proxy->clear();
$proxy->serverflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS,
               "ALPN handshake test (server)");

#Test 12: ALPN handshake (client and server)
$proxy->clear();
$proxy->clientflags("-alpn test");
$proxy->serverflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::ALPN_CLI_EXTENSION
               | checkhandshake::ALPN_SRV_EXTENSION,
               "ALPN handshake test");

SKIP: {
    skip "No CT, EC or OCSP support in this OpenSSL build", 1
        if disabled("ct") || disabled("ec") || disabled("ocsp");

    #Test 13: SCT handshake (client request only)
    $proxy->clear();
    #Note: -ct also sends status_request
    $proxy->clientflags("-ct");
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der")
                        ." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::SCT_CLI_EXTENSION
                   | checkhandshake::SCT_SRV_EXTENSION
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
                   | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
                   "SCT handshake test");
}


#Test 14: HRR Handshake
$proxy->clear();
$proxy->serverflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::KEY_SHARE_HRR_EXTENSION,
               "HRR handshake test");

#Test 15: Resumption handshake with HRR
$proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->serverflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
               (checkhandshake::DEFAULT_EXTENSIONS
                | checkhandshake::KEY_SHARE_HRR_EXTENSION
                | checkhandshake::PSK_CLI_EXTENSION
                | checkhandshake::PSK_SRV_EXTENSION),
               "Resumption handshake with HRR test");

#Test 16: Acceptable but non preferred key_share
$proxy->clear();
$proxy->clientflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
               "Acceptable but non preferred key_share");

unlink $session;
Commit	Line	Data
c11237c2 MC	1	#! /usr/bin/env perl
	2	# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
	3	#
	4	# Licensed under the OpenSSL license (the "License"). You may not use
	5	# this file except in compliance with the License. You can obtain a copy
	6	# in the file LICENSE in the source distribution or at
	7	# https://www.openssl.org/source/license.html
	8
	9	use strict;
f50306c2	10	use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
c11237c2	11	use OpenSSL::Test::Utils;
cc24a22b	12	use File::Temp qw(tempfile);
c11237c2	13	use TLSProxy::Proxy;
1e566129	14	use checkhandshake qw(checkhandshake @handmessages @extensions);
f50306c2	15
1e566129 MC	16	my $test_name = "test_tls13messages";
1e566129 MC	17	setup($test_name);
f50306c2	18
c11237c2 MC	19	plan skip_all => "TLSProxy isn't usable on $^O"
	20	if $^O =~ /^(VMS\|MSWin32)$/;
	21
	22	plan skip_all => "$test_name needs the dynamic engine feature enabled"
	23	if disabled("engine") \|\| disabled("dynamic-engine");
	24
	25	plan skip_all => "$test_name needs the sock feature enabled"
	26	if disabled("sock");
	27
	28	plan skip_all => "$test_name needs TLSv1.3 enabled"
	29	if disabled("tls1_3");
	30
	31	$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
9ce3ed2a	32	$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
c11237c2	33
c11237c2	34
f50306c2 MC	35	@handmessages = (
f50306c2 MC	36	[TLSProxy::Message::MT_CLIENT_HELLO,
1e566129	37	checkhandshake::ALL_HANDSHAKES],
597c51bc	38	[TLSProxy::Message::MT_SERVER_HELLO,
b0bfd140 MC	39	checkhandshake::HRR_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE],
	40	[TLSProxy::Message::MT_CLIENT_HELLO,
	41	checkhandshake::HRR_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE],
f50306c2	42	[TLSProxy::Message::MT_SERVER_HELLO,
1e566129	43	checkhandshake::ALL_HANDSHAKES],
f50306c2	44	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
1e566129	45	checkhandshake::ALL_HANDSHAKES],
f50306c2	46	[TLSProxy::Message::MT_CERTIFICATE_REQUEST,
1e566129	47	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	48	[TLSProxy::Message::MT_CERTIFICATE,
b0bfd140	49	checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE)],
2c5dfdc3	50	[TLSProxy::Message::MT_CERTIFICATE_VERIFY,
b0bfd140	51	checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE)],
f50306c2	52	[TLSProxy::Message::MT_FINISHED,
1e566129	53	checkhandshake::ALL_HANDSHAKES],
f50306c2	54	[TLSProxy::Message::MT_CERTIFICATE,
1e566129	55	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	56	[TLSProxy::Message::MT_CERTIFICATE_VERIFY,
1e566129	57	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	58	[TLSProxy::Message::MT_FINISHED,
1e566129	59	checkhandshake::ALL_HANDSHAKES],
c11237c2 MC	60	[0, 0]
	61	);
	62
f50306c2 MC	63	@extensions = (
f50306c2 MC	64	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
1e566129	65	checkhandshake::SERVER_NAME_CLI_EXTENSION],
f50306c2	66	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
1e566129	67	checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
f50306c2	68	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
1e566129	69	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	70	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
1e566129	71	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	72	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
1e566129	73	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	74	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
1e566129	75	checkhandshake::ALPN_CLI_EXTENSION],
f50306c2	76	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
1e566129	77	checkhandshake::SCT_CLI_EXTENSION],
f50306c2	78	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
1e566129	79	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	80	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
1e566129	81	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	82	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
1e566129	83	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	84	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
1e566129	85	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	86	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
1e566129	87	checkhandshake::DEFAULT_EXTENSIONS],
b2f7e8c0 MC	88	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
b2f7e8c0 MC	89	checkhandshake::DEFAULT_EXTENSIONS],
a23bb15a MC	90	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
a23bb15a MC	91	checkhandshake::PSK_CLI_EXTENSION],
f50306c2	92
597c51bc	93	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
b0bfd140 MC	94	checkhandshake::KEY_SHARE_HRR_EXTENSION],
	95
	96	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
	97	checkhandshake::SERVER_NAME_CLI_EXTENSION],
	98	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
	99	checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
	100	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
	101	checkhandshake::DEFAULT_EXTENSIONS],
a2b97bdf MC	102	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
a2b97bdf MC	103	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140 MC	104	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
	105	checkhandshake::DEFAULT_EXTENSIONS],
	106	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
	107	checkhandshake::ALPN_CLI_EXTENSION],
	108	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
	109	checkhandshake::SCT_CLI_EXTENSION],
a2b97bdf MC	110	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
	111	checkhandshake::DEFAULT_EXTENSIONS],
	112	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
	113	checkhandshake::DEFAULT_EXTENSIONS],
	114	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
	115	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140 MC	116	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
	117	checkhandshake::DEFAULT_EXTENSIONS],
	118	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
	119	checkhandshake::DEFAULT_EXTENSIONS],
	120	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
	121	checkhandshake::DEFAULT_EXTENSIONS],
	122	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
	123	checkhandshake::PSK_CLI_EXTENSION],
	124
88050dd1 MC	125	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
88050dd1 MC	126	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	127	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
1e566129	128	checkhandshake::DEFAULT_EXTENSIONS],
a23bb15a MC	129	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
a23bb15a MC	130	checkhandshake::PSK_SRV_EXTENSION],
f50306c2 MC	131
f50306c2 MC	132	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
1e566129	133	checkhandshake::SERVER_NAME_SRV_EXTENSION],
f50306c2	134	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
1e566129	135	checkhandshake::ALPN_SRV_EXTENSION],
de65f7b9 MC	136	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
de65f7b9 MC	137	checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],
e96e0f8e MC	138
	139	[TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
	140	checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
c3a48c7b MC	141	[TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
c3a48c7b MC	142	checkhandshake::SCT_SRV_EXTENSION],
e96e0f8e	143
9ce3ed2a MC	144	[0,0,0]
	145	);
	146
c11237c2 MC	147	my $proxy = TLSProxy::Proxy->new(
	148	undef,
	149	cmdstr(app(["openssl"]), display => 1),
	150	srctop_file("apps", "server.pem"),
	151	(!$ENV{HARNESS_ACTIVE} \|\| $ENV{HARNESS_VERBOSE})
	152	);
	153
c11237c2	154	#Test 1: Check we get all the right messages for a default handshake
cc24a22b	155	(undef, my $session) = tempfile();
a23bb15a	156	$proxy->serverconnects(2);
cc24a22b	157	$proxy->clientflags("-sess_out ".$session);
a23bb15a	158	$proxy->sessionfile($session);
c11237c2	159	$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
de65f7b9	160	plan tests => 16;
1e566129 MC	161	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	162	checkhandshake::DEFAULT_EXTENSIONS,
f50306c2	163	"Default handshake test");
c11237c2	164
cc24a22b	165	#Test 2: Resumption handshake
a23bb15a MC	166	$proxy->clearClient();
	167	$proxy->clientflags("-sess_in ".$session);
	168	$proxy->clientstart();
	169	checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
db919b1e MC	170	(checkhandshake::DEFAULT_EXTENSIONS
db919b1e MC	171	\| checkhandshake::PSK_CLI_EXTENSION
b510b740	172	\| checkhandshake::PSK_SRV_EXTENSION),
a23bb15a	173	"Resumption handshake test");
cc24a22b	174
5f21b440 BK	175	SKIP: {
	176	skip "No OCSP support in this OpenSSL build", 3
	177	if disabled("ct") \|\| disabled("ec") \|\| disabled("ocsp");
	178	#Test 3: A status_request handshake (client request only)
	179	$proxy->clear();
	180	$proxy->clientflags("-status");
	181	$proxy->start();
	182	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	183	checkhandshake::DEFAULT_EXTENSIONS
	184	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
	185	"status_request handshake test (client)");
	186
	187	#Test 4: A status_request handshake (server support only)
	188	$proxy->clear();
	189	$proxy->serverflags("-status_file "
	190	.srctop_file("test", "recipes", "ocsp-response.der"));
	191	$proxy->start();
	192	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	193	checkhandshake::DEFAULT_EXTENSIONS,
	194	"status_request handshake test (server)");
	195
	196	#Test 5: A status_request handshake (client and server)
	197	$proxy->clear();
	198	$proxy->clientflags("-status");
	199	$proxy->serverflags("-status_file "
	200	.srctop_file("test", "recipes", "ocsp-response.der"));
	201	$proxy->start();
	202	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	203	checkhandshake::DEFAULT_EXTENSIONS
	204	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION
	205	\| checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
	206	"status_request handshake test");
	207	}
cc24a22b	208
9ce3ed2a	209	#Test 6: A client auth handshake
cc24a22b MC	210	$proxy->clear();
	211	$proxy->clientflags("-cert ".srctop_file("apps", "server.pem"));
	212	$proxy->serverflags("-Verify 5");
	213	$proxy->start();
1e566129 MC	214	checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
1e566129 MC	215	checkhandshake::DEFAULT_EXTENSIONS,
96153874	216	"Client auth handshake test");
cc24a22b	217
11ba87f2	218	#Test 7: Server name handshake (no client request)
9ce3ed2a	219	$proxy->clear();
11ba87f2	220	$proxy->clientflags("-noservername");
9ce3ed2a	221	$proxy->start();
1e566129 MC	222	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	223	checkhandshake::DEFAULT_EXTENSIONS
11ba87f2	224	& ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
96153874	225	"Server name handshake test (client)");
9ce3ed2a MC	226
	227	#Test 8: Server name handshake (server support only)
	228	$proxy->clear();
11ba87f2	229	$proxy->clientflags("-noservername");
9ce3ed2a MC	230	$proxy->serverflags("-servername testhost");
9ce3ed2a MC	231	$proxy->start();
1e566129	232	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
11ba87f2 MC	233	checkhandshake::DEFAULT_EXTENSIONS
11ba87f2 MC	234	& ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
96153874	235	"Server name handshake test (server)");
9ce3ed2a MC	236
	237	#Test 9: Server name handshake (client and server)
	238	$proxy->clear();
	239	$proxy->clientflags("-servername testhost");
	240	$proxy->serverflags("-servername testhost");
	241	$proxy->start();
1e566129	242	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
96153874	243	checkhandshake::DEFAULT_EXTENSIONS
96153874 MC	244	\| checkhandshake::SERVER_NAME_SRV_EXTENSION,
96153874 MC	245	"Server name handshake test");
9ce3ed2a MC	246
	247	#Test 10: ALPN handshake (client request only)
	248	$proxy->clear();
	249	$proxy->clientflags("-alpn test");
	250	$proxy->start();
1e566129 MC	251	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	252	checkhandshake::DEFAULT_EXTENSIONS
	253	\| checkhandshake::ALPN_CLI_EXTENSION,
96153874	254	"ALPN handshake test (client)");
9ce3ed2a MC	255
	256	#Test 11: ALPN handshake (server support only)
	257	$proxy->clear();
	258	$proxy->serverflags("-alpn test");
	259	$proxy->start();
1e566129 MC	260	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	261	checkhandshake::DEFAULT_EXTENSIONS,
96153874	262	"ALPN handshake test (server)");
a1448c26	263
9ce3ed2a MC	264	#Test 12: ALPN handshake (client and server)
	265	$proxy->clear();
	266	$proxy->clientflags("-alpn test");
	267	$proxy->serverflags("-alpn test");
	268	$proxy->start();
1e566129	269	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
96153874 MC	270	checkhandshake::DEFAULT_EXTENSIONS
	271	\| checkhandshake::ALPN_CLI_EXTENSION
	272	\| checkhandshake::ALPN_SRV_EXTENSION,
	273	"ALPN handshake test");
9ce3ed2a	274
c3a48c7b MC	275	SKIP: {
	276	skip "No CT, EC or OCSP support in this OpenSSL build", 1
	277	if disabled("ct") \|\| disabled("ec") \|\| disabled("ocsp");
	278
	279	#Test 13: SCT handshake (client request only)
	280	$proxy->clear();
	281	#Note: -ct also sends status_request
	282	$proxy->clientflags("-ct");
	283	$proxy->serverflags("-status_file "
	284	.srctop_file("test", "recipes", "ocsp-response.der")
	285	." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
	286	$proxy->start();
	287	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	288	checkhandshake::DEFAULT_EXTENSIONS
	289	\| checkhandshake::SCT_CLI_EXTENSION
	290	\| checkhandshake::SCT_SRV_EXTENSION
	291	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION
	292	\| checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
	293	"SCT handshake test");
	294	}
	295
	296
	297
b0bfd140 MC	298
	299	#Test 14: HRR Handshake
	300	$proxy->clear();
	301	$proxy->serverflags("-curves P-256");
	302	$proxy->start();
	303	checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
	304	checkhandshake::DEFAULT_EXTENSIONS
	305	\| checkhandshake::KEY_SHARE_HRR_EXTENSION,
	306	"HRR handshake test");
	307
	308	#Test 15: Resumption handshake with HRR
	309	$proxy->clear();
	310	$proxy->clientflags("-sess_in ".$session);
	311	$proxy->serverflags("-curves P-256");
	312	$proxy->start();
	313	checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
db919b1e MC	314	(checkhandshake::DEFAULT_EXTENSIONS
	315	\| checkhandshake::KEY_SHARE_HRR_EXTENSION
	316	\| checkhandshake::PSK_CLI_EXTENSION
b510b740	317	\| checkhandshake::PSK_SRV_EXTENSION),
b0bfd140	318	"Resumption handshake with HRR test");
de65f7b9 MC	319
	320	#Test 16: Acceptable but non preferred key_share
	321	$proxy->clear();
	322	$proxy->clientflags("-curves P-256");
	323	$proxy->start();
	324	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	325	checkhandshake::DEFAULT_EXTENSIONS
	326	\| checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
597c51bc	327	"Acceptable but non preferred key_share");
de65f7b9	328
b0bfd140	329	unlink $session;