]>
Commit | Line | Data |
---|---|---|
c35cb287 | 1 | #! /usr/bin/env perl |
6738bf14 | 2 | # Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. |
c35cb287 | 3 | # |
909f1a2e | 4 | # Licensed under the Apache License 2.0 (the "License"). You may not use |
c35cb287 MC |
5 | # this file except in compliance with the License. You can obtain a copy |
6 | # in the file LICENSE in the source distribution or at | |
7 | # https://www.openssl.org/source/license.html | |
8 | ||
9 | use strict; | |
10 | use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/; | |
11 | use OpenSSL::Test::Utils; | |
12 | use TLSProxy::Proxy; | |
13 | ||
14 | my $test_name = "test_tls13hrr"; | |
15 | setup($test_name); | |
16 | ||
17 | plan skip_all => "TLSProxy isn't usable on $^O" | |
c5856878 | 18 | if $^O =~ /^(VMS)$/; |
c35cb287 MC |
19 | |
20 | plan skip_all => "$test_name needs the dynamic engine feature enabled" | |
21 | if disabled("engine") || disabled("dynamic-engine"); | |
22 | ||
23 | plan skip_all => "$test_name needs the sock feature enabled" | |
24 | if disabled("sock"); | |
25 | ||
26 | plan skip_all => "$test_name needs TLS1.3 enabled" | |
a763ca11 | 27 | if disabled("tls1_3") || (disabled("ec") && disabled("dh")); |
c35cb287 MC |
28 | |
29 | $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; | |
30 | ||
31 | my $proxy = TLSProxy::Proxy->new( | |
32 | undef, | |
33 | cmdstr(app(["openssl"]), display => 1), | |
34 | srctop_file("apps", "server.pem"), | |
35 | (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) | |
36 | ); | |
37 | ||
38 | use constant { | |
39 | CHANGE_HRR_CIPHERSUITE => 0, | |
40 | CHANGE_CH1_CIPHERSUITE => 1 | |
41 | }; | |
42 | ||
43 | #Test 1: A client should fail if the server changes the ciphersuite between the | |
44 | # HRR and the SH | |
45 | $proxy->filter(\&hrr_filter); | |
dbc6268f MC |
46 | if (disabled("ec")) { |
47 | $proxy->serverflags("-curves ffdhe3072"); | |
48 | } else { | |
49 | $proxy->serverflags("-curves P-256"); | |
50 | } | |
c35cb287 MC |
51 | my $testtype = CHANGE_HRR_CIPHERSUITE; |
52 | $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; | |
53 | plan tests => 2; | |
54 | ok(TLSProxy::Message->fail(), "Server ciphersuite changes"); | |
55 | ||
56 | #Test 2: It is an error if the client changes the offered ciphersuites so that | |
57 | # we end up selecting a different ciphersuite between HRR and the SH | |
58 | $proxy->clear(); | |
dbc6268f MC |
59 | if (disabled("ec")) { |
60 | $proxy->serverflags("-curves ffdhe3072"); | |
61 | } else { | |
62 | $proxy->serverflags("-curves P-256"); | |
63 | } | |
f865b081 | 64 | $proxy->ciphersuitess("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"); |
c35cb287 MC |
65 | $testtype = CHANGE_CH1_CIPHERSUITE; |
66 | $proxy->start(); | |
67 | ok(TLSProxy::Message->fail(), "Client ciphersuite changes"); | |
68 | ||
69 | sub hrr_filter | |
70 | { | |
71 | my $proxy = shift; | |
72 | ||
73 | if ($testtype == CHANGE_HRR_CIPHERSUITE) { | |
74 | # We're only interested in the HRR | |
75 | if ($proxy->flight != 1) { | |
76 | return; | |
77 | } | |
78 | ||
79 | my $hrr = ${$proxy->message_list}[1]; | |
80 | ||
81 | # We will normally only ever select CIPHER_TLS13_AES_128_GCM_SHA256 | |
82 | # because that's what Proxy tells s_server to do. Setting as below means | |
83 | # the ciphersuite will change will we get the ServerHello | |
84 | $hrr->ciphersuite(TLSProxy::Message::CIPHER_TLS13_AES_256_GCM_SHA384); | |
85 | $hrr->repack(); | |
86 | return; | |
87 | } | |
88 | ||
89 | # CHANGE_CH1_CIPHERSUITE | |
90 | if ($proxy->flight != 0) { | |
91 | return; | |
92 | } | |
93 | ||
94 | my $ch1 = ${$proxy->message_list}[0]; | |
95 | ||
f865b081 | 96 | # The server will always pick TLS_AES_256_GCM_SHA384 |
c35cb287 MC |
97 | my @ciphersuites = (TLSProxy::Message::CIPHER_TLS13_AES_128_GCM_SHA256); |
98 | $ch1->ciphersuite_len(2 * scalar @ciphersuites); | |
99 | $ch1->ciphersuites(\@ciphersuites); | |
100 | $ch1->repack(); | |
101 | } |