[thirdparty/openssl.git] / test / recipes / 70-test_tls13messages.t

#! /usr/bin/env perl
# Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

use strict;
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
use OpenSSL::Test::Utils;
use File::Temp qw(tempfile);
use TLSProxy::Proxy;
use checkhandshake qw(checkhandshake @handmessages @extensions);

my $test_name = "test_tls13messages";
setup($test_name);

plan skip_all => "TLSProxy isn't usable on $^O"
    if $^O =~ /^(VMS)$/;

plan skip_all => "$test_name needs the dynamic engine feature enabled"
    if disabled("engine") || disabled("dynamic-engine");

plan skip_all => "$test_name needs the sock feature enabled"
    if disabled("sock");

plan skip_all => "$test_name needs TLSv1.3 enabled"
    if disabled("tls1_3");

plan skip_all => "$test_name needs EC enabled"
    if disabled("ec");

$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");


@handmessages = (
    [TLSProxy::Message::MT_CLIENT_HELLO,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_SERVER_HELLO,
        checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
    [TLSProxy::Message::MT_CLIENT_HELLO,
        checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE],
    [TLSProxy::Message::MT_SERVER_HELLO,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_CERTIFICATE_REQUEST,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_CERTIFICATE,
        checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
    [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
        checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)],
    [TLSProxy::Message::MT_FINISHED,
        checkhandshake::ALL_HANDSHAKES],
    [TLSProxy::Message::MT_CERTIFICATE,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_CERTIFICATE_VERIFY,
        checkhandshake::CLIENT_AUTH_HANDSHAKE],
    [TLSProxy::Message::MT_FINISHED,
        checkhandshake::ALL_HANDSHAKES],
    [0, 0]
);

@extensions = (
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
        TLSProxy::Message::CLIENT,
        checkhandshake::SERVER_NAME_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
        TLSProxy::Message::CLIENT,
        checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
        TLSProxy::Message::CLIENT,
        checkhandshake::ALPN_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
        TLSProxy::Message::CLIENT,
        checkhandshake::SCT_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
        TLSProxy::Message::CLIENT,
        checkhandshake::PSK_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
        TLSProxy::Message::CLIENT,
        checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],

    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        TLSProxy::Message::SERVER,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        TLSProxy::Message::SERVER,
        checkhandshake::KEY_SHARE_HRR_EXTENSION],

    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
        TLSProxy::Message::CLIENT,
        checkhandshake::SERVER_NAME_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
        TLSProxy::Message::CLIENT,
        checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
        TLSProxy::Message::CLIENT,
        checkhandshake::ALPN_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
        TLSProxy::Message::CLIENT,
        checkhandshake::SCT_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
        TLSProxy::Message::CLIENT,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
        TLSProxy::Message::CLIENT,
        checkhandshake::PSK_CLI_EXTENSION],
    [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
        TLSProxy::Message::CLIENT,
        checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],

    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
        TLSProxy::Message::SERVER,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
        TLSProxy::Message::SERVER,
        checkhandshake::DEFAULT_EXTENSIONS],
    [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
        TLSProxy::Message::SERVER,
        checkhandshake::PSK_SRV_EXTENSION],

    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
        TLSProxy::Message::SERVER,
        checkhandshake::SERVER_NAME_SRV_EXTENSION],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
        TLSProxy::Message::SERVER,
        checkhandshake::ALPN_SRV_EXTENSION],
    [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
        TLSProxy::Message::SERVER,
        checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],

    [TLSProxy::Message::MT_CERTIFICATE_REQUEST, TLSProxy::Message::EXT_SIG_ALGS,
        TLSProxy::Message::SERVER,
        checkhandshake::DEFAULT_EXTENSIONS],

    [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
        TLSProxy::Message::SERVER,
        checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
    [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
        TLSProxy::Message::SERVER,
        checkhandshake::SCT_SRV_EXTENSION],

    [0,0,0,0]
);

my $proxy = TLSProxy::Proxy->new(
    undef,
    cmdstr(app(["openssl"]), display => 1),
    srctop_file("apps", "server.pem"),
    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
);

#Test 1: Check we get all the right messages for a default handshake
(undef, my $session) = tempfile();
$proxy->serverconnects(2);
$proxy->clientflags("-sess_out ".$session);
$proxy->sessionfile($session);
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 17;
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS,
               "Default handshake test");

#Test 2: Resumption handshake
$proxy->clearClient();
$proxy->clientflags("-sess_in ".$session);
$proxy->clientstart();
checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
               (checkhandshake::DEFAULT_EXTENSIONS
                | checkhandshake::PSK_CLI_EXTENSION
                | checkhandshake::PSK_SRV_EXTENSION),
               "Resumption handshake test");

SKIP: {
    skip "No OCSP support in this OpenSSL build", 4
        if disabled("ct") || disabled("ec") || disabled("ocsp");
    #Test 3: A status_request handshake (client request only)
    $proxy->clear();
    $proxy->clientflags("-status");
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
                   "status_request handshake test (client)");

    #Test 4: A status_request handshake (server support only)
    $proxy->clear();
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS,
                   "status_request handshake test (server)");

    #Test 5: A status_request handshake (client and server)
    $proxy->clear();
    $proxy->clientflags("-status");
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
                   | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
                   "status_request handshake test");

    #Test 6: A status_request handshake (client and server) with client auth
    $proxy->clear();
    $proxy->clientflags("-status -enable_pha -cert "
                        .srctop_file("apps", "server.pem"));
    $proxy->serverflags("-Verify 5 -status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
                   | checkhandshake::STATUS_REQUEST_SRV_EXTENSION
                   | checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
                   "status_request handshake with client auth test");
}

#Test 7: A client auth handshake
$proxy->clear();
$proxy->clientflags("-enable_pha -cert ".srctop_file("apps", "server.pem"));
$proxy->serverflags("-Verify 5");
$proxy->start();
checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS |
               checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
               "Client auth handshake test");

#Test 8: Server name handshake (no client request)
$proxy->clear();
$proxy->clientflags("-noservername");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
               "Server name handshake test (client)");

#Test 9: Server name handshake (server support only)
$proxy->clear();
$proxy->clientflags("-noservername");
$proxy->serverflags("-servername testhost");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               & ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
               "Server name handshake test (server)");

#Test 10: Server name handshake (client and server)
$proxy->clear();
$proxy->clientflags("-servername testhost");
$proxy->serverflags("-servername testhost");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::SERVER_NAME_SRV_EXTENSION,
               "Server name handshake test");

#Test 11: ALPN handshake (client request only)
$proxy->clear();
$proxy->clientflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::ALPN_CLI_EXTENSION,
               "ALPN handshake test (client)");

#Test 12: ALPN handshake (server support only)
$proxy->clear();
$proxy->serverflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS,
               "ALPN handshake test (server)");

#Test 13: ALPN handshake (client and server)
$proxy->clear();
$proxy->clientflags("-alpn test");
$proxy->serverflags("-alpn test");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::ALPN_CLI_EXTENSION
               | checkhandshake::ALPN_SRV_EXTENSION,
               "ALPN handshake test");

SKIP: {
    skip "No CT, EC or OCSP support in this OpenSSL build", 1
        if disabled("ct") || disabled("ec") || disabled("ocsp");

    #Test 14: SCT handshake (client request only)
    $proxy->clear();
    #Note: -ct also sends status_request
    $proxy->clientflags("-ct");
    $proxy->serverflags("-status_file "
                        .srctop_file("test", "recipes", "ocsp-response.der")
                        ." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
    $proxy->start();
    checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
                   checkhandshake::DEFAULT_EXTENSIONS
                   | checkhandshake::SCT_CLI_EXTENSION
                   | checkhandshake::SCT_SRV_EXTENSION
                   | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
                   | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
                   "SCT handshake test");
}

#Test 15: HRR Handshake
$proxy->clear();
$proxy->serverflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::KEY_SHARE_HRR_EXTENSION,
               "HRR handshake test");

#Test 16: Resumption handshake with HRR
$proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->serverflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
               (checkhandshake::DEFAULT_EXTENSIONS
                | checkhandshake::KEY_SHARE_HRR_EXTENSION
                | checkhandshake::PSK_CLI_EXTENSION
                | checkhandshake::PSK_SRV_EXTENSION),
               "Resumption handshake with HRR test");

#Test 17: Acceptable but non preferred key_share
$proxy->clear();
$proxy->clientflags("-curves P-256");
$proxy->start();
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
               checkhandshake::DEFAULT_EXTENSIONS
               | checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
               "Acceptable but non preferred key_share");

unlink $session;
Commit	Line	Data
c11237c2	1	#! /usr/bin/env perl
6738bf14	2	# Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
c11237c2	3	#
909f1a2e	4	# Licensed under the Apache License 2.0 (the "License"). You may not use
c11237c2 MC	5	# this file except in compliance with the License. You can obtain a copy
	6	# in the file LICENSE in the source distribution or at
	7	# https://www.openssl.org/source/license.html
	8
	9	use strict;
f50306c2	10	use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/;
c11237c2	11	use OpenSSL::Test::Utils;
cc24a22b	12	use File::Temp qw(tempfile);
c11237c2	13	use TLSProxy::Proxy;
1e566129	14	use checkhandshake qw(checkhandshake @handmessages @extensions);
f50306c2	15
1e566129 MC	16	my $test_name = "test_tls13messages";
1e566129 MC	17	setup($test_name);
f50306c2	18
c11237c2	19	plan skip_all => "TLSProxy isn't usable on $^O"
c5856878	20	if $^O =~ /^(VMS)$/;
c11237c2 MC	21
	22	plan skip_all => "$test_name needs the dynamic engine feature enabled"
	23	if disabled("engine") \|\| disabled("dynamic-engine");
	24
	25	plan skip_all => "$test_name needs the sock feature enabled"
	26	if disabled("sock");
	27
	28	plan skip_all => "$test_name needs TLSv1.3 enabled"
	29	if disabled("tls1_3");
	30
dbc6268f MC	31	plan skip_all => "$test_name needs EC enabled"
	32	if disabled("ec");
	33
c11237c2	34	$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
433deaff	35	$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
c11237c2	36
c11237c2	37
f50306c2 MC	38	@handmessages = (
f50306c2 MC	39	[TLSProxy::Message::MT_CLIENT_HELLO,
1e566129	40	checkhandshake::ALL_HANDSHAKES],
597c51bc	41	[TLSProxy::Message::MT_SERVER_HELLO,
b0bfd140 MC	42	checkhandshake::HRR_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE],
	43	[TLSProxy::Message::MT_CLIENT_HELLO,
	44	checkhandshake::HRR_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE],
f50306c2	45	[TLSProxy::Message::MT_SERVER_HELLO,
1e566129	46	checkhandshake::ALL_HANDSHAKES],
f50306c2	47	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS,
1e566129	48	checkhandshake::ALL_HANDSHAKES],
f50306c2	49	[TLSProxy::Message::MT_CERTIFICATE_REQUEST,
1e566129	50	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	51	[TLSProxy::Message::MT_CERTIFICATE,
b0bfd140	52	checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE)],
2c5dfdc3	53	[TLSProxy::Message::MT_CERTIFICATE_VERIFY,
b0bfd140	54	checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE \| checkhandshake::HRR_RESUME_HANDSHAKE)],
f50306c2	55	[TLSProxy::Message::MT_FINISHED,
1e566129	56	checkhandshake::ALL_HANDSHAKES],
f50306c2	57	[TLSProxy::Message::MT_CERTIFICATE,
1e566129	58	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	59	[TLSProxy::Message::MT_CERTIFICATE_VERIFY,
1e566129	60	checkhandshake::CLIENT_AUTH_HANDSHAKE],
f50306c2	61	[TLSProxy::Message::MT_FINISHED,
1e566129	62	checkhandshake::ALL_HANDSHAKES],
c11237c2 MC	63	[0, 0]
	64	);
	65
f50306c2 MC	66	@extensions = (
f50306c2 MC	67	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
dc5bcb88	68	TLSProxy::Message::CLIENT,
1e566129	69	checkhandshake::SERVER_NAME_CLI_EXTENSION],
f50306c2	70	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
dc5bcb88	71	TLSProxy::Message::CLIENT,
1e566129	72	checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
f50306c2	73	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
dc5bcb88	74	TLSProxy::Message::CLIENT,
1e566129	75	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	76	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
dc5bcb88	77	TLSProxy::Message::CLIENT,
1e566129	78	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	79	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
dc5bcb88	80	TLSProxy::Message::CLIENT,
1e566129	81	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	82	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
dc5bcb88	83	TLSProxy::Message::CLIENT,
1e566129	84	checkhandshake::ALPN_CLI_EXTENSION],
f50306c2	85	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
dc5bcb88	86	TLSProxy::Message::CLIENT,
1e566129	87	checkhandshake::SCT_CLI_EXTENSION],
f50306c2	88	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
dc5bcb88	89	TLSProxy::Message::CLIENT,
1e566129	90	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	91	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
dc5bcb88	92	TLSProxy::Message::CLIENT,
1e566129	93	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	94	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
dc5bcb88	95	TLSProxy::Message::CLIENT,
1e566129	96	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	97	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
dc5bcb88	98	TLSProxy::Message::CLIENT,
1e566129	99	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	100	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
dc5bcb88	101	TLSProxy::Message::CLIENT,
1e566129	102	checkhandshake::DEFAULT_EXTENSIONS],
b2f7e8c0	103	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
dc5bcb88	104	TLSProxy::Message::CLIENT,
b2f7e8c0	105	checkhandshake::DEFAULT_EXTENSIONS],
a23bb15a	106	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
dc5bcb88	107	TLSProxy::Message::CLIENT,
a23bb15a	108	checkhandshake::PSK_CLI_EXTENSION],
9d75dce3	109	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
dc5bcb88	110	TLSProxy::Message::CLIENT,
9d75dce3	111	checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],
f50306c2	112
426dfc9f	113	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
dc5bcb88	114	TLSProxy::Message::SERVER,
426dfc9f	115	checkhandshake::DEFAULT_EXTENSIONS],
597c51bc	116	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
dc5bcb88	117	TLSProxy::Message::SERVER,
b0bfd140 MC	118	checkhandshake::KEY_SHARE_HRR_EXTENSION],
	119
	120	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME,
dc5bcb88	121	TLSProxy::Message::CLIENT,
b0bfd140 MC	122	checkhandshake::SERVER_NAME_CLI_EXTENSION],
b0bfd140 MC	123	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
dc5bcb88	124	TLSProxy::Message::CLIENT,
b0bfd140 MC	125	checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
b0bfd140 MC	126	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
dc5bcb88	127	TLSProxy::Message::CLIENT,
b0bfd140	128	checkhandshake::DEFAULT_EXTENSIONS],
a2b97bdf	129	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
dc5bcb88	130	TLSProxy::Message::CLIENT,
a2b97bdf	131	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140	132	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
dc5bcb88	133	TLSProxy::Message::CLIENT,
b0bfd140 MC	134	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140 MC	135	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
dc5bcb88	136	TLSProxy::Message::CLIENT,
b0bfd140 MC	137	checkhandshake::ALPN_CLI_EXTENSION],
b0bfd140 MC	138	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
dc5bcb88	139	TLSProxy::Message::CLIENT,
b0bfd140	140	checkhandshake::SCT_CLI_EXTENSION],
a2b97bdf	141	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC,
dc5bcb88	142	TLSProxy::Message::CLIENT,
a2b97bdf MC	143	checkhandshake::DEFAULT_EXTENSIONS],
a2b97bdf MC	144	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET,
dc5bcb88	145	TLSProxy::Message::CLIENT,
a2b97bdf MC	146	checkhandshake::DEFAULT_EXTENSIONS],
a2b97bdf MC	147	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET,
dc5bcb88	148	TLSProxy::Message::CLIENT,
a2b97bdf	149	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140	150	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
dc5bcb88	151	TLSProxy::Message::CLIENT,
b0bfd140 MC	152	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140 MC	153	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
dc5bcb88	154	TLSProxy::Message::CLIENT,
b0bfd140 MC	155	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140 MC	156	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES,
dc5bcb88	157	TLSProxy::Message::CLIENT,
b0bfd140 MC	158	checkhandshake::DEFAULT_EXTENSIONS],
b0bfd140 MC	159	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK,
dc5bcb88	160	TLSProxy::Message::CLIENT,
b0bfd140	161	checkhandshake::PSK_CLI_EXTENSION],
9d75dce3	162	[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_POST_HANDSHAKE_AUTH,
dc5bcb88	163	TLSProxy::Message::CLIENT,
9d75dce3	164	checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION],
b0bfd140	165
88050dd1	166	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS,
dc5bcb88	167	TLSProxy::Message::SERVER,
88050dd1	168	checkhandshake::DEFAULT_EXTENSIONS],
f50306c2	169	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE,
dc5bcb88	170	TLSProxy::Message::SERVER,
1e566129	171	checkhandshake::DEFAULT_EXTENSIONS],
a23bb15a	172	[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK,
dc5bcb88	173	TLSProxy::Message::SERVER,
a23bb15a	174	checkhandshake::PSK_SRV_EXTENSION],
f50306c2 MC	175
f50306c2 MC	176	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME,
dc5bcb88	177	TLSProxy::Message::SERVER,
1e566129	178	checkhandshake::SERVER_NAME_SRV_EXTENSION],
f50306c2	179	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN,
dc5bcb88	180	TLSProxy::Message::SERVER,
1e566129	181	checkhandshake::ALPN_SRV_EXTENSION],
de65f7b9	182	[TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
dc5bcb88	183	TLSProxy::Message::SERVER,
de65f7b9	184	checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION],
e96e0f8e	185
dc5bcb88 MC	186	[TLSProxy::Message::MT_CERTIFICATE_REQUEST, TLSProxy::Message::EXT_SIG_ALGS,
	187	TLSProxy::Message::SERVER,
	188	checkhandshake::DEFAULT_EXTENSIONS],
	189
e96e0f8e	190	[TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST,
dc5bcb88	191	TLSProxy::Message::SERVER,
e96e0f8e	192	checkhandshake::STATUS_REQUEST_SRV_EXTENSION],
c3a48c7b	193	[TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_SCT,
dc5bcb88	194	TLSProxy::Message::SERVER,
c3a48c7b	195	checkhandshake::SCT_SRV_EXTENSION],
e96e0f8e	196
dc5bcb88	197	[0,0,0,0]
9ce3ed2a MC	198	);
9ce3ed2a MC	199
c11237c2 MC	200	my $proxy = TLSProxy::Proxy->new(
	201	undef,
	202	cmdstr(app(["openssl"]), display => 1),
	203	srctop_file("apps", "server.pem"),
	204	(!$ENV{HARNESS_ACTIVE} \|\| $ENV{HARNESS_VERBOSE})
	205	);
	206
c11237c2	207	#Test 1: Check we get all the right messages for a default handshake
cc24a22b	208	(undef, my $session) = tempfile();
a23bb15a	209	$proxy->serverconnects(2);
cc24a22b	210	$proxy->clientflags("-sess_out ".$session);
a23bb15a	211	$proxy->sessionfile($session);
c11237c2	212	$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
dc5bcb88	213	plan tests => 17;
1e566129 MC	214	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	215	checkhandshake::DEFAULT_EXTENSIONS,
f50306c2	216	"Default handshake test");
c11237c2	217
cc24a22b	218	#Test 2: Resumption handshake
a23bb15a MC	219	$proxy->clearClient();
	220	$proxy->clientflags("-sess_in ".$session);
	221	$proxy->clientstart();
	222	checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE,
db919b1e MC	223	(checkhandshake::DEFAULT_EXTENSIONS
db919b1e MC	224	\| checkhandshake::PSK_CLI_EXTENSION
b510b740	225	\| checkhandshake::PSK_SRV_EXTENSION),
a23bb15a	226	"Resumption handshake test");
cc24a22b	227
5f21b440	228	SKIP: {
dc5bcb88	229	skip "No OCSP support in this OpenSSL build", 4
5f21b440 BK	230	if disabled("ct") \|\| disabled("ec") \|\| disabled("ocsp");
	231	#Test 3: A status_request handshake (client request only)
	232	$proxy->clear();
	233	$proxy->clientflags("-status");
	234	$proxy->start();
	235	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	236	checkhandshake::DEFAULT_EXTENSIONS
	237	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION,
	238	"status_request handshake test (client)");
	239
	240	#Test 4: A status_request handshake (server support only)
	241	$proxy->clear();
	242	$proxy->serverflags("-status_file "
	243	.srctop_file("test", "recipes", "ocsp-response.der"));
	244	$proxy->start();
	245	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	246	checkhandshake::DEFAULT_EXTENSIONS,
	247	"status_request handshake test (server)");
	248
	249	#Test 5: A status_request handshake (client and server)
	250	$proxy->clear();
	251	$proxy->clientflags("-status");
	252	$proxy->serverflags("-status_file "
	253	.srctop_file("test", "recipes", "ocsp-response.der"));
	254	$proxy->start();
	255	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	256	checkhandshake::DEFAULT_EXTENSIONS
	257	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION
	258	\| checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
	259	"status_request handshake test");
dc5bcb88 MC	260
	261	#Test 6: A status_request handshake (client and server) with client auth
	262	$proxy->clear();
	263	$proxy->clientflags("-status -enable_pha -cert "
	264	.srctop_file("apps", "server.pem"));
	265	$proxy->serverflags("-Verify 5 -status_file "
	266	.srctop_file("test", "recipes", "ocsp-response.der"));
	267	$proxy->start();
	268	checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
	269	checkhandshake::DEFAULT_EXTENSIONS
	270	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION
	271	\| checkhandshake::STATUS_REQUEST_SRV_EXTENSION
	272	\| checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
	273	"status_request handshake with client auth test");
5f21b440	274	}
cc24a22b	275
dc5bcb88	276	#Test 7: A client auth handshake
cc24a22b	277	$proxy->clear();
32097b33	278	$proxy->clientflags("-enable_pha -cert ".srctop_file("apps", "server.pem"));
cc24a22b MC	279	$proxy->serverflags("-Verify 5");
cc24a22b MC	280	$proxy->start();
1e566129	281	checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE,
9d75dce3 TS	282	checkhandshake::DEFAULT_EXTENSIONS \|
9d75dce3 TS	283	checkhandshake::POST_HANDSHAKE_AUTH_CLI_EXTENSION,
96153874	284	"Client auth handshake test");
cc24a22b	285
dc5bcb88	286	#Test 8: Server name handshake (no client request)
9ce3ed2a	287	$proxy->clear();
11ba87f2	288	$proxy->clientflags("-noservername");
9ce3ed2a	289	$proxy->start();
1e566129 MC	290	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	291	checkhandshake::DEFAULT_EXTENSIONS
11ba87f2	292	& ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
96153874	293	"Server name handshake test (client)");
9ce3ed2a	294
dc5bcb88	295	#Test 9: Server name handshake (server support only)
9ce3ed2a	296	$proxy->clear();
11ba87f2	297	$proxy->clientflags("-noservername");
9ce3ed2a MC	298	$proxy->serverflags("-servername testhost");
9ce3ed2a MC	299	$proxy->start();
1e566129	300	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
11ba87f2 MC	301	checkhandshake::DEFAULT_EXTENSIONS
11ba87f2 MC	302	& ~checkhandshake::SERVER_NAME_CLI_EXTENSION,
96153874	303	"Server name handshake test (server)");
9ce3ed2a	304
dc5bcb88	305	#Test 10: Server name handshake (client and server)
9ce3ed2a MC	306	$proxy->clear();
	307	$proxy->clientflags("-servername testhost");
	308	$proxy->serverflags("-servername testhost");
	309	$proxy->start();
1e566129	310	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
96153874	311	checkhandshake::DEFAULT_EXTENSIONS
96153874 MC	312	\| checkhandshake::SERVER_NAME_SRV_EXTENSION,
96153874 MC	313	"Server name handshake test");
9ce3ed2a	314
dc5bcb88	315	#Test 11: ALPN handshake (client request only)
9ce3ed2a MC	316	$proxy->clear();
	317	$proxy->clientflags("-alpn test");
	318	$proxy->start();
1e566129 MC	319	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	320	checkhandshake::DEFAULT_EXTENSIONS
	321	\| checkhandshake::ALPN_CLI_EXTENSION,
96153874	322	"ALPN handshake test (client)");
9ce3ed2a	323
dc5bcb88	324	#Test 12: ALPN handshake (server support only)
9ce3ed2a MC	325	$proxy->clear();
	326	$proxy->serverflags("-alpn test");
	327	$proxy->start();
1e566129 MC	328	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
1e566129 MC	329	checkhandshake::DEFAULT_EXTENSIONS,
96153874	330	"ALPN handshake test (server)");
a1448c26	331
dc5bcb88	332	#Test 13: ALPN handshake (client and server)
9ce3ed2a MC	333	$proxy->clear();
	334	$proxy->clientflags("-alpn test");
	335	$proxy->serverflags("-alpn test");
	336	$proxy->start();
1e566129	337	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
96153874 MC	338	checkhandshake::DEFAULT_EXTENSIONS
	339	\| checkhandshake::ALPN_CLI_EXTENSION
	340	\| checkhandshake::ALPN_SRV_EXTENSION,
	341	"ALPN handshake test");
9ce3ed2a	342
c3a48c7b MC	343	SKIP: {
	344	skip "No CT, EC or OCSP support in this OpenSSL build", 1
	345	if disabled("ct") \|\| disabled("ec") \|\| disabled("ocsp");
	346
dc5bcb88	347	#Test 14: SCT handshake (client request only)
c3a48c7b MC	348	$proxy->clear();
	349	#Note: -ct also sends status_request
	350	$proxy->clientflags("-ct");
	351	$proxy->serverflags("-status_file "
	352	.srctop_file("test", "recipes", "ocsp-response.der")
	353	." -serverinfo ".srctop_file("test", "serverinfo2.pem"));
	354	$proxy->start();
	355	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	356	checkhandshake::DEFAULT_EXTENSIONS
	357	\| checkhandshake::SCT_CLI_EXTENSION
	358	\| checkhandshake::SCT_SRV_EXTENSION
	359	\| checkhandshake::STATUS_REQUEST_CLI_EXTENSION
	360	\| checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
	361	"SCT handshake test");
	362	}
	363
dc5bcb88	364	#Test 15: HRR Handshake
b0bfd140 MC	365	$proxy->clear();
	366	$proxy->serverflags("-curves P-256");
	367	$proxy->start();
	368	checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE,
	369	checkhandshake::DEFAULT_EXTENSIONS
	370	\| checkhandshake::KEY_SHARE_HRR_EXTENSION,
	371	"HRR handshake test");
	372
dc5bcb88	373	#Test 16: Resumption handshake with HRR
b0bfd140 MC	374	$proxy->clear();
	375	$proxy->clientflags("-sess_in ".$session);
	376	$proxy->serverflags("-curves P-256");
	377	$proxy->start();
	378	checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE,
db919b1e MC	379	(checkhandshake::DEFAULT_EXTENSIONS
	380	\| checkhandshake::KEY_SHARE_HRR_EXTENSION
	381	\| checkhandshake::PSK_CLI_EXTENSION
b510b740	382	\| checkhandshake::PSK_SRV_EXTENSION),
b0bfd140	383	"Resumption handshake with HRR test");
de65f7b9	384
dc5bcb88	385	#Test 17: Acceptable but non preferred key_share
de65f7b9 MC	386	$proxy->clear();
	387	$proxy->clientflags("-curves P-256");
	388	$proxy->start();
	389	checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
	390	checkhandshake::DEFAULT_EXTENSIONS
	391	\| checkhandshake::SUPPORTED_GROUPS_SRV_EXTENSION,
597c51bc	392	"Acceptable but non preferred key_share");
de65f7b9	393
b0bfd140	394	unlink $session;