]>
Commit | Line | Data |
---|---|---|
596d6b7e RS |
1 | #! /usr/bin/env perl |
2 | # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. | |
ddcc5e5b | 3 | # |
596d6b7e RS |
4 | # Licensed under the OpenSSL license (the "License"). You may not use |
5 | # this file except in compliance with the License. You can obtain a copy | |
6 | # in the file LICENSE in the source distribution or at | |
7 | # https://www.openssl.org/source/license.html | |
ddcc5e5b MC |
8 | |
9 | use strict; | |
42e0ccdf | 10 | use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/; |
3f22ed2f | 11 | use OpenSSL::Test::Utils; |
ddcc5e5b MC |
12 | use TLSProxy::Proxy; |
13 | use File::Temp qw(tempfile); | |
14 | ||
c27a4049 RL |
15 | my $test_name = "test_sslsessiontick"; |
16 | setup($test_name); | |
17 | ||
60f9f1e1 | 18 | plan skip_all => "TLSProxy isn't usable on $^O" |
2d32d3be | 19 | if $^O =~ /^(VMS|MSWin32)$/; |
60f9f1e1 | 20 | |
2dd400bd | 21 | plan skip_all => "$test_name needs the dynamic engine feature enabled" |
19ab5790 | 22 | if disabled("engine") || disabled("dynamic-engine"); |
c27a4049 | 23 | |
f9e55034 MC |
24 | plan skip_all => "$test_name needs the sock feature enabled" |
25 | if disabled("sock"); | |
26 | ||
c27a4049 RL |
27 | $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; |
28 | ||
29 | sub checkmessages($$$$$$); | |
5427976d | 30 | sub clearclient(); |
c27a4049 RL |
31 | sub clearall(); |
32 | ||
ddcc5e5b MC |
33 | my $chellotickext = 0; |
34 | my $shellotickext = 0; | |
35 | my $fullhand = 0; | |
36 | my $ticketseen = 0; | |
37 | ||
38 | my $proxy = TLSProxy::Proxy->new( | |
39 | undef, | |
25c78440 | 40 | cmdstr(app(["openssl"]), display => 1), |
b44b935e RL |
41 | srctop_file("apps", "server.pem"), |
42 | (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) | |
ddcc5e5b MC |
43 | ); |
44 | ||
cf7f8592 | 45 | plan tests => 8; |
c27a4049 | 46 | |
ddcc5e5b MC |
47 | #Test 1: By default with no existing session we should get a session ticket |
48 | #Expected result: ClientHello extension seen; ServerHello extension seen | |
49 | # NewSessionTicket message seen; Full handshake | |
50 | $proxy->start(); | |
51 | checkmessages(1, "Default session ticket test", 1, 1, 1, 1); | |
52 | ||
53 | #Test 2: If the server does not accept tickets we should get a normal handshake | |
54 | #with no session tickets | |
55 | #Expected result: ClientHello extension seen; ServerHello extension not seen | |
56 | # NewSessionTicket message not seen; Full handshake | |
57 | clearall(); | |
58 | $proxy->serverflags("-no_ticket"); | |
59 | $proxy->start(); | |
60 | checkmessages(2, "No server support session ticket test", 1, 0, 0, 1); | |
61 | ||
62 | #Test 3: If the client does not accept tickets we should get a normal handshake | |
63 | #with no session tickets | |
64 | #Expected result: ClientHello extension not seen; ServerHello extension not seen | |
65 | # NewSessionTicket message not seen; Full handshake | |
66 | clearall(); | |
67 | $proxy->clientflags("-no_ticket"); | |
68 | $proxy->start(); | |
69 | checkmessages(3, "No client support session ticket test", 0, 0, 0, 1); | |
70 | ||
71 | #Test 4: Test session resumption with session ticket | |
72 | #Expected result: ClientHello extension seen; ServerHello extension not seen | |
73 | # NewSessionTicket message not seen; Abbreviated handshake | |
74 | clearall(); | |
75 | (my $fh, my $session) = tempfile(); | |
76 | $proxy->serverconnects(2); | |
77 | $proxy->clientflags("-sess_out ".$session); | |
78 | $proxy->start(); | |
5427976d | 79 | $proxy->clearClient(); |
ddcc5e5b MC |
80 | $proxy->clientflags("-sess_in ".$session); |
81 | $proxy->clientstart(); | |
82 | checkmessages(4, "Session resumption session ticket test", 1, 0, 0, 0); | |
83 | ||
84 | #Test 5: Test session resumption with ticket capable client without a ticket | |
85 | #Expected result: ClientHello extension seen; ServerHello extension seen | |
86 | # NewSessionTicket message seen; Abbreviated handshake | |
87 | clearall(); | |
c27a4049 | 88 | ($fh, $session) = tempfile(); |
ddcc5e5b MC |
89 | $proxy->serverconnects(2); |
90 | $proxy->clientflags("-sess_out ".$session." -no_ticket"); | |
91 | $proxy->start(); | |
5427976d | 92 | $proxy->clearClient(); |
ddcc5e5b MC |
93 | $proxy->clientflags("-sess_in ".$session); |
94 | $proxy->clientstart(); | |
95 | checkmessages(5, "Session resumption with ticket capable client without a " | |
96 | ."ticket", 1, 1, 1, 0); | |
97 | ||
7f6d90ac EK |
98 | #Test 6: Client accepts empty ticket. |
99 | #Expected result: ClientHello extension seen; ServerHello extension seen; | |
100 | # NewSessionTicket message seen; Full handshake. | |
101 | clearall(); | |
102 | $proxy->filter(\&ticket_filter); | |
103 | $proxy->start(); | |
104 | checkmessages(6, "Empty ticket test", 1, 1, 1, 1); | |
105 | ||
cf7f8592 EK |
106 | #Test 7-8: Client keeps existing ticket on empty ticket. |
107 | clearall(); | |
108 | ($fh, $session) = tempfile(); | |
109 | $proxy->serverconnects(3); | |
110 | $proxy->filter(undef); | |
111 | $proxy->clientflags("-sess_out ".$session); | |
112 | $proxy->start(); | |
5427976d | 113 | $proxy->clearClient(); |
cf7f8592 EK |
114 | $proxy->clientflags("-sess_in ".$session." -sess_out ".$session); |
115 | $proxy->filter(\&inject_empty_ticket_filter); | |
116 | $proxy->clientstart(); | |
117 | #Expected result: ClientHello extension seen; ServerHello extension seen; | |
118 | # NewSessionTicket message seen; Abbreviated handshake. | |
119 | checkmessages(7, "Empty ticket resumption test", 1, 1, 1, 0); | |
5427976d | 120 | clearclient(); |
cf7f8592 EK |
121 | $proxy->clientflags("-sess_in ".$session); |
122 | $proxy->filter(undef); | |
123 | $proxy->clientstart(); | |
124 | #Expected result: ClientHello extension seen; ServerHello extension not seen; | |
125 | # NewSessionTicket message not seen; Abbreviated handshake. | |
126 | checkmessages(8, "Empty ticket resumption test", 1, 0, 0, 0); | |
127 | ||
7f6d90ac EK |
128 | |
129 | sub ticket_filter | |
130 | { | |
131 | my $proxy = shift; | |
132 | ||
133 | foreach my $message (@{$proxy->message_list}) { | |
134 | if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { | |
135 | $message->ticket(""); | |
136 | $message->repack(); | |
137 | } | |
138 | } | |
139 | } | |
140 | ||
cf7f8592 EK |
141 | sub inject_empty_ticket_filter { |
142 | my $proxy = shift; | |
143 | ||
144 | foreach my $message (@{$proxy->message_list}) { | |
145 | if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { | |
146 | # Only inject the message first time we're called. | |
147 | return; | |
148 | } | |
149 | } | |
150 | ||
151 | my @new_message_list = (); | |
152 | foreach my $message (@{$proxy->message_list}) { | |
153 | push @new_message_list, $message; | |
154 | if ($message->mt == TLSProxy::Message::MT_SERVER_HELLO) { | |
aa474d1f | 155 | $message->set_extension(TLSProxy::Message::EXT_SESSION_TICKET, ""); |
cf7f8592 EK |
156 | $message->repack(); |
157 | # Tack NewSessionTicket onto the ServerHello record. | |
158 | # This only works if the ServerHello is exactly one record. | |
159 | my $record = ${$message->records}[0]; | |
160 | ||
161 | my $offset = $message->startoffset + $message->encoded_length; | |
162 | my $newsessionticket = TLSProxy::NewSessionTicket->new( | |
163 | 1, "", [$record], $offset, []); | |
164 | $newsessionticket->repack(); | |
165 | push @new_message_list, $newsessionticket; | |
166 | } | |
167 | } | |
168 | $proxy->message_list([@new_message_list]); | |
169 | } | |
170 | ||
c27a4049 | 171 | sub checkmessages($$$$$$) |
ddcc5e5b MC |
172 | { |
173 | my ($testno, $testname, $testch, $testsh, $testtickseen, $testhand) = @_; | |
174 | ||
c27a4049 RL |
175 | subtest $testname => sub { |
176 | ||
177 | foreach my $message (@{$proxy->message_list}) { | |
178 | if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO | |
ddcc5e5b | 179 | || $message->mt == TLSProxy::Message::MT_SERVER_HELLO) { |
c27a4049 RL |
180 | #Get the extensions data |
181 | my %extensions = %{$message->extension_data}; | |
182 | if (defined | |
aa474d1f | 183 | $extensions{TLSProxy::Message::EXT_SESSION_TICKET}) { |
c27a4049 RL |
184 | if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) { |
185 | $chellotickext = 1; | |
186 | } else { | |
187 | $shellotickext = 1; | |
188 | } | |
189 | } | |
190 | } elsif ($message->mt == TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE) { | |
191 | #Must be doing a full handshake | |
192 | $fullhand = 1; | |
193 | } elsif ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { | |
194 | $ticketseen = 1; | |
195 | } | |
196 | } | |
ddcc5e5b | 197 | |
c27a4049 RL |
198 | plan tests => 5; |
199 | ||
7f6d90ac | 200 | ok(TLSProxy::Message->success, "Handshake"); |
c27a4049 RL |
201 | ok(($testch && $chellotickext) || (!$testch && !$chellotickext), |
202 | "ClientHello extension Session Ticket check"); | |
203 | ok(($testsh && $shellotickext) || (!$testsh && !$shellotickext), | |
204 | "ServerHello extension Session Ticket check"); | |
205 | ok(($testtickseen && $ticketseen) || (!$testtickseen && !$ticketseen), | |
206 | "Session Ticket message presence check"); | |
207 | ok(($testhand && $fullhand) || (!$testhand && !$fullhand), | |
208 | "Session Ticket full handshake check"); | |
ddcc5e5b | 209 | } |
ddcc5e5b MC |
210 | } |
211 | ||
5427976d MC |
212 | |
213 | sub clearclient() | |
ddcc5e5b MC |
214 | { |
215 | $chellotickext = 0; | |
216 | $shellotickext = 0; | |
217 | $fullhand = 0; | |
218 | $ticketseen = 0; | |
5427976d MC |
219 | $proxy->clearClient(); |
220 | } | |
221 | ||
222 | sub clearall() | |
223 | { | |
224 | clearclient(); | |
ddcc5e5b MC |
225 | $proxy->clear(); |
226 | } |