2 # Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
12 use OpenSSL
::Test qw
/:DEFAULT cmdstr srctop_file bldtop_dir/;
13 use OpenSSL
::Test
::Utils
;
15 use TLSProxy
::Message
;
17 my $test_name = "test_sslrecords";
20 plan skip_all
=> "TLSProxy isn't usable on $^O"
23 plan skip_all
=> "$test_name needs the dynamic engine feature enabled"
24 if disabled
("engine") || disabled
("dynamic-engine");
26 plan skip_all
=> "$test_name needs the sock feature enabled"
29 my $testplanisset = 0;
30 my $inject_recs_num = undef;
31 my $content_type = undef;
32 my $boundary_test_type = undef;
33 my $fatal_alert = undef; # set by filters at expected fatal alerts
34 my $sslv2testtype = undef;
35 my $proxy_start_success = 0;
37 my $proxy = TLSProxy
::Proxy
->new(
39 cmdstr
(app
([ "openssl" ]), display
=> 1),
40 srctop_file
("apps", "server.pem"),
41 (!$ENV{HARNESS_ACTIVE
} || $ENV{HARNESS_VERBOSE
})
44 # Avoid failures with tls1_3 disabled builds
45 # TLSProxy defaults to use tls1_3 and tls1_2 is required by the tests so
46 # set it here and check that a simple proxy works before running the tests
47 $proxy->serverflags("-tls1_2");
48 $proxy->clientflags("-no_tls1_3");
50 $proxy->start() or plan skip_all
=> "Unable to start up Proxy for tests";
54 skip
"TLS 1.2 is disabled", 21 if disabled
("tls1_2");
60 skip
"DTLS 1.2 is disabled", 21 if disabled
("dtls1_2");
67 my $run_test_as_dtls = shift;
68 if ($run_test_as_dtls == 1) {
69 $proxy = TLSProxy
::Proxy
->new_dtls(
70 \
&add_empty_recs_filter
,
71 cmdstr
(app
([ "openssl" ]), display
=> 1),
72 srctop_file
("apps", "server.pem"),
73 (!$ENV{HARNESS_ACTIVE
} || $ENV{HARNESS_VERBOSE
})
76 $proxy = TLSProxy
::Proxy
->new(
77 \
&add_empty_recs_filter
,
78 cmdstr
(app
([ "openssl" ]), display
=> 1),
79 srctop_file
("apps", "server.pem"),
80 (!$ENV{HARNESS_ACTIVE
} || $ENV{HARNESS_VERBOSE
})
84 $fatal_alert = 0; # set by filters at expected fatal alerts
86 skip
"Record tests not intended for dtls", 1 if $run_test_as_dtls == 1;
87 #Test 1: Injecting out of context empty records should fail
89 $content_type = TLSProxy
::Record
::RT_APPLICATION_DATA
;
92 $proxy->serverflags("-tls1_2");
93 $proxy->clientflags("-no_tls1_3");
95 ok
($fatal_alert, "Out of context empty records test");
98 #Test 2: Injecting in context empty records should succeed
100 $content_type = TLSProxy
::Record
::RT_HANDSHAKE
;
101 if ($run_test_as_dtls == 1) {
102 $proxy->serverflags("-min_protocol DTLSv1.2 -max_protocol DTLSv1.2");
103 $proxy->clientflags("-max_protocol DTLSv1.2");
105 $proxy->serverflags("-tls1_2");
106 $proxy->clientflags("-no_tls1_3");
108 $proxy_start_success = $proxy->start();
109 ok
($proxy_start_success && TLSProxy
::Message
->success(),
110 "In context empty records test".($run_test_as_dtls == 1) ?
" for DTLS" : " for TLS");
113 skip
"Record tests not intended for dtls", 7 if $run_test_as_dtls == 1;
114 #Test 3: Injecting too many in context empty records should fail
117 #We allow 32 consecutive in context empty records
118 $inject_recs_num = 33;
119 $proxy->serverflags("-tls1_2");
120 $proxy->clientflags("-no_tls1_3");
122 ok
($fatal_alert, "Too many in context empty records test");
124 #Test 4: Injecting a fragmented fatal alert should fail. We expect the server to
125 # send back an alert of its own because it cannot handle fragmented
129 $proxy->filter(\
&add_frag_alert_filter
);
130 $proxy->serverflags("-tls1_2");
131 $proxy->clientflags("-no_tls1_3");
133 ok
($fatal_alert, "Fragmented alert records test");
135 #Run some SSLv2 ClientHello tests
138 TLSV1_2_IN_SSLV2
=> 0,
140 FRAGMENTED_IN_TLSV1_2
=> 2,
141 FRAGMENTED_IN_SSLV2
=> 3,
142 ALERT_BEFORE_SSLV2
=> 4
145 # The TLSv1.2 in SSLv2 ClientHello need to run at security level 0
146 # because in a SSLv2 ClientHello we can't send extensions to indicate
147 # which signature algorithm we want to use, and the default is SHA1.
149 #Test 5: Inject an SSLv2 style record format for a TLSv1.2 ClientHello
150 $sslv2testtype = TLSV1_2_IN_SSLV2
;
152 $proxy->filter(\
&add_sslv2_filter
);
153 $proxy->serverflags("-tls1_2");
154 $proxy->clientflags("-no_tls1_3 -legacy_renegotiation");
155 $proxy->ciphers("AES128-SHA:\@SECLEVEL=0");
157 ok
(TLSProxy
::Message
->success(), "TLSv1.2 in SSLv2 ClientHello test");
159 #Test 6: Inject an SSLv2 style record format for an SSLv2 ClientHello. We don't
160 # support this so it should fail. We actually treat it as an unknown
161 # protocol so we don't even send an alert in this case.
162 $sslv2testtype = SSLV2_IN_SSLV2
;
164 $proxy->serverflags("-tls1_2");
165 $proxy->clientflags("-no_tls1_3");
166 $proxy->ciphers("AES128-SHA:\@SECLEVEL=0");
168 ok
(TLSProxy
::Message
->fail(), "SSLv2 in SSLv2 ClientHello test");
170 #Test 7: Sanity check ClientHello fragmentation. This isn't really an SSLv2 test
171 # at all, but it gives us confidence that Test 8 fails for the right
173 $sslv2testtype = FRAGMENTED_IN_TLSV1_2
;
175 $proxy->serverflags("-tls1_2");
176 $proxy->clientflags("-no_tls1_3");
177 $proxy->ciphers("AES128-SHA:\@SECLEVEL=0");
179 ok
(TLSProxy
::Message
->success(), "Fragmented ClientHello in TLSv1.2 test");
181 #Test 8: Fragment a TLSv1.2 ClientHello across a TLS1.2 record; an SSLv2
182 # record; and another TLS1.2 record. This isn't allowed so should fail
183 $sslv2testtype = FRAGMENTED_IN_SSLV2
;
185 $proxy->serverflags("-tls1_2");
186 $proxy->clientflags("-no_tls1_3");
187 $proxy->ciphers("AES128-SHA:\@SECLEVEL=0");
189 ok
(TLSProxy
::Message
->fail(), "Fragmented ClientHello in TLSv1.2/SSLv2 test");
191 #Test 9: Send a TLS warning alert before an SSLv2 ClientHello. This should
192 # fail because an SSLv2 ClientHello must be the first record.
193 $sslv2testtype = ALERT_BEFORE_SSLV2
;
195 $proxy->serverflags("-tls1_2");
196 $proxy->clientflags("-no_tls1_3");
197 $proxy->ciphers("AES128-SHA:\@SECLEVEL=0");
199 ok
(TLSProxy
::Message
->fail(), "Alert before SSLv2 ClientHello test");
201 #Unrecognised record type tests
203 #Test 10: Sending an unrecognised record type in TLS1.2 should fail
206 if ($run_test_as_dtls == 1) {
207 $proxy->serverflags("-min_protocol DTLSv1.2 -max_protocol DTLSv1.2");
208 $proxy->clientflags("-max_protocol DTLSv1.2");
210 $proxy->serverflags("-tls1_2");
211 $proxy->clientflags("-no_tls1_3");
213 $proxy->filter(\
&add_unknown_record_type
);
214 $proxy_start_success = $proxy->start();
216 if ($run_test_as_dtls == 1) {
217 ok
($proxy_start_success == 0, "Unrecognised record type in DTLS1.2");
219 ok
($fatal_alert, "Unrecognised record type in TLS1.2");
223 skip
"TLSv1.1 or DTLSv1 disabled", 1 if ($run_test_as_dtls == 0 && disabled
("tls1_1"))
224 || ($run_test_as_dtls == 1 && disabled
("dtls1"));
226 #Test 11: Sending an unrecognised record type in TLS1.1 should fail
229 if ($run_test_as_dtls == 1) {
230 $proxy->clientflags("-min_protocol DTLSv1 -max_protocol DTLSv1 -cipher DEFAULT:\@SECLEVEL=0");
232 $proxy->clientflags("-tls1_1 -cipher DEFAULT:\@SECLEVEL=0");
234 $proxy->ciphers("AES128-SHA:\@SECLEVEL=0");
235 $proxy_start_success = $proxy->start();
236 if ($run_test_as_dtls == 1) {
237 ok
($proxy_start_success == 0, "Unrecognised record type in DTLSv1");
239 ok
($fatal_alert, "Unrecognised record type in TLSv1.1");
244 skip
"Record tests not intended for dtls", 10 if $run_test_as_dtls == 1;
245 #Test 12: Sending a different record version in TLS1.2 should fail
248 $proxy->clientflags("-tls1_2");
249 $proxy->filter(\
&change_version
);
251 ok
($fatal_alert, "Changed record version in TLS1.2");
253 #TLS1.3 specific tests
255 skip
"TLSv1.3 disabled", 9
256 if disabled
("tls1_3") || (disabled
("ec") && disabled
("dh"));
258 #Test 13: Sending a different record version in TLS1.3 should fail
260 $proxy->filter(\
&change_version
);
262 ok
(TLSProxy
::Message
->fail(), "Changed record version in TLS1.3");
264 #Test 14: Sending an unrecognised record type in TLS1.3 should fail
267 $proxy->filter(\
&add_unknown_record_type
);
269 ok
($fatal_alert, "Unrecognised record type in TLS1.3");
271 #Test 15: Sending an outer record type other than app data once encrypted
275 $proxy->filter(\
&change_outer_record_type
);
277 ok
($fatal_alert, "Wrong outer record type in TLS1.3");
280 DATA_AFTER_SERVER_HELLO
=> 0,
281 DATA_AFTER_FINISHED
=> 1,
282 DATA_AFTER_KEY_UPDATE
=> 2,
283 DATA_BETWEEN_KEY_UPDATE
=> 3,
284 NO_DATA_BETWEEN_KEY_UPDATE
=> 4,
287 #Test 16: Sending a ServerHello which doesn't end on a record boundary
291 $boundary_test_type = DATA_AFTER_SERVER_HELLO
;
292 $proxy->filter(\
¬_on_record_boundary
);
294 ok
($fatal_alert, "Record not on boundary in TLS1.3 (ServerHello)");
296 #Test 17: Sending a Finished which doesn't end on a record boundary
300 $boundary_test_type = DATA_AFTER_FINISHED
;
302 ok
($fatal_alert, "Record not on boundary in TLS1.3 (Finished)");
304 #Test 18: Sending a KeyUpdate which doesn't end on a record boundary
308 $boundary_test_type = DATA_AFTER_KEY_UPDATE
;
310 ok
($fatal_alert, "Record not on boundary in TLS1.3 (KeyUpdate)");
312 #Test 19: Sending application data in the middle of a fragmented KeyUpdate
313 # should fail. Strictly speaking this is not a record boundary test
314 # but we use the same filter.
317 $boundary_test_type = DATA_BETWEEN_KEY_UPDATE
;
319 ok
($fatal_alert, "Data between KeyUpdate");
321 #Test 20: Fragmented KeyUpdate. This should succeed. Strictly speaking this
322 # is not a record boundary test but we use the same filter.
324 $boundary_test_type = NO_DATA_BETWEEN_KEY_UPDATE
;
326 ok
(TLSProxy
::Message
->success(), "No data between KeyUpdate");
329 skip
"EC disabled", 1 if disabled
("ec");
331 #Test 21: Force an HRR and change the "real" ServerHello to have a protocol
332 # record version of 0x0301 (TLSv1.0). At this point we have already
333 # decided that we are doing TLSv1.3 but are still using plaintext
334 # records. The server should be sending a record version of 0x303
335 # (TLSv1.2), but the RFC requires us to ignore this field so we
336 # should tolerate the incorrect version.
338 $proxy->filter(\
&change_server_hello_version
);
339 $proxy->serverflags("-groups P-256"); # Force an HRR
341 ok
(TLSProxy
::Message
->success(), "Bad ServerHello record version after HRR");
348 sub add_empty_recs_filter
351 my $records = $proxy->record_list;
352 my $isdtls = $proxy->isdtls();
354 # We're only interested in the initial ClientHello
355 if ($proxy->flight != 0) {
356 $fatal_alert = 1 if @
{$records}[-1]->is_fatal_alert(1) == TLSProxy
::Message
::AL_DESC_UNEXPECTED_MESSAGE
;
360 for (my $i = 0; $i < $inject_recs_num; $i++) {
363 $record = TLSProxy
::Record
->new_dtls(
366 TLSProxy
::Record
::VERS_DTLS_1_2
,
377 $record = TLSProxy
::Record
->new(
380 TLSProxy
::Record
::VERS_TLS_1_2
,
389 push @
{$records}, $record;
393 sub add_frag_alert_filter
396 my $records = $proxy->record_list;
399 # We're only interested in the initial ClientHello
400 if ($proxy->flight != 0) {
401 $fatal_alert = 1 if @
{$records}[-1]->is_fatal_alert(1) == TLSProxy
::Message
::AL_DESC_UNEXPECTED_MESSAGE
;
405 # Add a zero length fragment first
406 #my $record = TLSProxy::Record->new(
408 # TLSProxy::Record::RT_ALERT,
409 # TLSProxy::Record::VERS_TLS_1_2,
416 #push @{$proxy->record_list}, $record;
418 # Now add the alert level (Fatal) as a separate record
419 $byte = pack('C', TLSProxy
::Message
::AL_LEVEL_FATAL
);
420 my $record = TLSProxy
::Record
->new(
422 TLSProxy
::Record
::RT_ALERT
,
423 TLSProxy
::Record
::VERS_TLS_1_2
,
431 push @
{$records}, $record;
433 # And finally the description (Unexpected message) in a third record
434 $byte = pack('C', TLSProxy
::Message
::AL_DESC_UNEXPECTED_MESSAGE
);
435 $record = TLSProxy
::Record
->new(
437 TLSProxy
::Record
::RT_ALERT
,
438 TLSProxy
::Record
::VERS_TLS_1_2
,
446 push @
{$records}, $record;
455 # We're only interested in the initial ClientHello
456 if ($proxy->flight != 0) {
460 # Ditch the real ClientHello - we're going to replace it with our own
461 shift @
{$proxy->record_list};
463 if ($sslv2testtype == ALERT_BEFORE_SSLV2
) {
464 my $alert = pack('CC', TLSProxy
::Message
::AL_LEVEL_FATAL
,
465 TLSProxy
::Message
::AL_DESC_NO_RENEGOTIATION
);
466 my $alertlen = length $alert;
467 $record = TLSProxy
::Record
->new(
469 TLSProxy
::Record
::RT_ALERT
,
470 TLSProxy
::Record
::VERS_TLS_1_2
,
479 push @
{$proxy->record_list}, $record;
482 if ($sslv2testtype == ALERT_BEFORE_SSLV2
483 || $sslv2testtype == TLSV1_2_IN_SSLV2
484 || $sslv2testtype == SSLV2_IN_SSLV2
) {
485 # This is an SSLv2 format ClientHello
490 0x00, 0x03, # Ciphersuites len
491 0x00, 0x00, # Session id len
492 0x00, 0x20, # Challenge len
493 0x00, 0x00, 0x2f, #AES128-SHA
494 0x01, 0x18, 0x9F, 0x76, 0xEC, 0x57, 0xCE, 0xE5, 0xB3, 0xAB, 0x79, 0x90,
495 0xAD, 0xAC, 0x6E, 0xD1, 0x58, 0x35, 0x03, 0x97, 0x16, 0x10, 0x82, 0x56,
496 0xD8, 0x55, 0xFF, 0xE1, 0x8A, 0xA3, 0x2E, 0xF6; # Challenge
498 if ($sslv2testtype == SSLV2_IN_SSLV2
) {
499 # Set the version to "real" SSLv2
500 vec($clienthello, 1, 8) = 0x00;
501 vec($clienthello, 2, 8) = 0x02;
504 my $chlen = length $clienthello;
506 $record = TLSProxy
::Record
->new(
508 TLSProxy
::Record
::RT_HANDSHAKE
,
509 TLSProxy
::Record
::VERS_TLS_1_2
,
518 push @
{$proxy->record_list}, $record;
520 # For this test we're using a real TLS ClientHello
524 0x00, 0x00, 0x2D, # Message length
525 0x03, 0x03, # TLSv1.2
526 0x01, 0x18, 0x9F, 0x76, 0xEC, 0x57, 0xCE, 0xE5, 0xB3, 0xAB, 0x79, 0x90,
527 0xAD, 0xAC, 0x6E, 0xD1, 0x58, 0x35, 0x03, 0x97, 0x16, 0x10, 0x82, 0x56,
528 0xD8, 0x55, 0xFF, 0xE1, 0x8A, 0xA3, 0x2E, 0xF6, # Random
529 0x00, # Session id len
530 0x00, 0x04, # Ciphersuites len
531 0x00, 0x2f, # AES128-SHA
532 0x00, 0xff, # Empty reneg info SCSV
533 0x01, # Compression methods len
534 0x00, # Null compression
535 0x00, 0x00; # Extensions len
537 # Split this into 3: A TLS record; a SSLv2 record and a TLS record.
538 # We deliberately split the second record prior to the Challenge/Random
539 # and set the first byte of the random to 1. This makes the second SSLv2
540 # record look like an SSLv2 ClientHello
541 my $frag1 = substr $clienthello, 0, 6;
542 my $frag2 = substr $clienthello, 6, 32;
543 my $frag3 = substr $clienthello, 38;
545 my $fraglen = length $frag1;
546 $record = TLSProxy
::Record
->new(
548 TLSProxy
::Record
::RT_HANDSHAKE
,
549 TLSProxy
::Record
::VERS_TLS_1_2
,
557 push @
{$proxy->record_list}, $record;
559 $fraglen = length $frag2;
561 if ($sslv2testtype == FRAGMENTED_IN_SSLV2
) {
566 $record = TLSProxy
::Record
->new(
568 TLSProxy
::Record
::RT_HANDSHAKE
,
569 TLSProxy
::Record
::VERS_TLS_1_2
,
577 push @
{$proxy->record_list}, $record;
579 $fraglen = length $frag3;
580 $record = TLSProxy
::Record
->new(
582 TLSProxy
::Record
::RT_HANDSHAKE
,
583 TLSProxy
::Record
::VERS_TLS_1_2
,
591 push @
{$proxy->record_list}, $record;
596 sub add_unknown_record_type
599 my $records = $proxy->record_list;
600 my $isdtls = $proxy->isdtls;
603 # We'll change a record after the initial version neg has taken place
604 if ($proxy->flight == 0) {
607 } elsif ($proxy->flight != 1 || $added_record) {
608 $fatal_alert = 1 if @
{$records}[-1]->is_fatal_alert(0) == TLSProxy
::Message
::AL_DESC_UNEXPECTED_MESSAGE
;
615 $record = TLSProxy
::Record
->new_dtls(
617 TLSProxy
::Record
::RT_UNKNOWN
,
618 @
{$records}[-1]->version(),
619 @
{$records}[-1]->epoch(),
620 @
{$records}[-1]->seq() +1,
629 $record = TLSProxy
::Record
->new(
631 TLSProxy
::Record
::RT_UNKNOWN
,
632 @
{$records}[-1]->version(),
642 #Find ServerHello record and insert after that
644 for ($i = 0; ${$proxy->record_list}[$i]->flight() < 1; $i++) {
649 splice @
{$proxy->record_list}, $i, 0, $record;
656 my $records = $proxy->record_list;
658 # We'll change a version after the initial version neg has taken place
659 if ($proxy->flight != 1) {
660 $fatal_alert = 1 if @
{$records}[-1]->is_fatal_alert(0) == TLSProxy
::Message
::AL_DESC_PROTOCOL_VERSION
;
664 if ($#{$records} > 1) {
665 # ... typically in ServerHelloDone
666 @
{$records}[-1]->version(TLSProxy
::Record
::VERS_TLS_1_1
);
670 sub change_server_hello_version
673 my $records = $proxy->record_list;
675 # We're only interested in changing the ServerHello after an HRR
676 if ($proxy->flight != 3) {
680 # The ServerHello has index 5
687 @
{$records}[5]->version(TLSProxy
::Record
::VERS_TLS_1_0
);
690 sub change_outer_record_type
693 my $records = $proxy->record_list;
695 # We'll change a record after the initial version neg has taken place
696 if ($proxy->flight != 1) {
697 $fatal_alert = 1 if @
{$records}[-1]->is_fatal_alert(0) == TLSProxy
::Message
::AL_DESC_UNEXPECTED_MESSAGE
;
701 # Find CCS record and change record after that
703 foreach my $record (@
{$records}) {
704 last if $record->content_type == TLSProxy
::Record
::RT_CCS
;
707 if (defined(${$records}[++$i])) {
708 ${$records}[$i]->outer_content_type(TLSProxy
::Record
::RT_HANDSHAKE
);
712 sub not_on_record_boundary
715 my $records = $proxy->record_list;
718 #Find server's first flight
719 if ($proxy->flight != 1) {
720 $fatal_alert = 1 if @
{$records}[-1]->is_fatal_alert(0) == TLSProxy
::Message
::AL_DESC_UNEXPECTED_MESSAGE
;
724 if ($boundary_test_type == DATA_AFTER_SERVER_HELLO
) {
725 #Merge the ServerHello and EncryptedExtensions records into one
727 foreach my $record (@
{$records}) {
728 if ($record->content_type == TLSProxy
::Record
::RT_HANDSHAKE
) {
729 $record->{sent
} = 1; # pretend it's sent already
735 if (defined(${$records}[$i+1])) {
736 $data = ${$records}[$i]->data();
737 $data .= ${$records}[$i+1]->decrypt_data();
738 ${$records}[$i+1]->data($data);
739 ${$records}[$i+1]->len(length $data);
741 #Delete the old ServerHello record
742 splice @
{$records}, $i, 1;
744 } elsif ($boundary_test_type == DATA_AFTER_FINISHED
) {
745 return if @
{$proxy->{message_list
}}[-1]->{mt
}
746 != TLSProxy
::Message
::MT_FINISHED
;
748 my $last_record = @
{$records}[-1];
749 $data = $last_record->decrypt_data;
751 #Add a KeyUpdate message onto the end of the Finished record
752 my $keyupdate = pack "C5",
754 0x00, 0x00, 0x01, # Message length
755 0x00; # Update not requested
759 #Add content type and tag
760 $data .= pack("C", TLSProxy
::Record
::RT_HANDSHAKE
).("\0"x16
);
763 $last_record->data($data);
764 $last_record->len(length $data);
765 } elsif ($boundary_test_type == DATA_AFTER_KEY_UPDATE
) {
766 return if @
{$proxy->{message_list
}}[-1]->{mt
}
767 != TLSProxy
::Message
::MT_FINISHED
;
769 #KeyUpdates must end on a record boundary
771 my $record = TLSProxy
::Record
->new(
773 TLSProxy
::Record
::RT_APPLICATION_DATA
,
774 TLSProxy
::Record
::VERS_TLS_1_2
,
783 #Add two KeyUpdate messages into a single record
784 my $keyupdate = pack "C5",
786 0x00, 0x00, 0x01, # Message length
787 0x00; # Update not requested
789 $data = $keyupdate.$keyupdate;
791 #Add content type and tag
792 $data .= pack("C", TLSProxy
::Record
::RT_HANDSHAKE
).("\0"x16
);
794 $record->data($data);
795 $record->len(length $data);
796 push @
{$records}, $record;
798 return if @
{$proxy->{message_list
}}[-1]->{mt
}
799 != TLSProxy
::Message
::MT_FINISHED
;
801 my $record = TLSProxy
::Record
->new(
803 TLSProxy
::Record
::RT_APPLICATION_DATA
,
804 TLSProxy
::Record
::VERS_TLS_1_2
,
813 #Add a partial KeyUpdate message into the record
815 0x18; # KeyUpdate message type. Omit the rest of the message header
817 #Add content type and tag
818 $data .= pack("C", TLSProxy
::Record
::RT_HANDSHAKE
).("\0"x16
);
820 $record->data($data);
821 $record->len(length $data);
822 push @
{$records}, $record;
824 if ($boundary_test_type == DATA_BETWEEN_KEY_UPDATE
) {
825 #Now add an app data record
826 $record = TLSProxy
::Record
->new(
828 TLSProxy
::Record
::RT_APPLICATION_DATA
,
829 TLSProxy
::Record
::VERS_TLS_1_2
,
838 #Add an empty app data record (just content type and tag)
839 $data = pack("C", TLSProxy
::Record
::RT_APPLICATION_DATA
).("\0"x16
);
841 $record->data($data);
842 $record->len(length $data);
843 push @
{$records}, $record;
846 #Now add the rest of the KeyUpdate message
847 $record = TLSProxy
::Record
->new(
849 TLSProxy
::Record
::RT_APPLICATION_DATA
,
850 TLSProxy
::Record
::VERS_TLS_1_2
,
859 #Add the last 4 bytes of the KeyUpdate record
861 0x00, 0x00, 0x01, # Message length
862 0x00; # Update not requested
864 #Add content type and tag
865 $data .= pack("C", TLSProxy
::Record
::RT_HANDSHAKE
).("\0"x16
);
867 $record->data($data);
868 $record->len(length $data);
869 push @
{$records}, $record;