1#! /usr/bin/env perl
2# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License").  You may not use
5# this file except in compliance with the License.  You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9use strict;
10use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/;
11use OpenSSL::Test::Utils;
12use TLSProxy::Proxy;
13use File::Temp qw(tempfile);
14
15my $test_name = "test_sslsessiontick";
16setup($test_name);
17
18plan skip_all => "TLSProxy isn't usable on $^O"
19    if $^O =~ /^(VMS)$/;
20
21plan skip_all => "$test_name needs the dynamic engine feature enabled"
22    if disabled("engine") || disabled("dynamic-engine");
23
24plan skip_all => "$test_name needs the sock feature enabled"
25    if disabled("sock");
26
27plan skip_all => "$test_name needs SSLv3, TLSv1, TLSv1.1 or TLSv1.2 enabled"
28    if alldisabled(("ssl3", "tls1", "tls1_1", "tls1_2"));
29
30sub checkmessages($$$$$$);
31sub clearclient();
32sub clearall();
33
34my $chellotickext = 0;
35my $shellotickext = 0;
36my $fullhand = 0;
37my $ticketseen = 0;
38
39my $proxy = TLSProxy::Proxy->new(
40    undef,
41    cmdstr(app(["openssl"]), display => 1),
42    srctop_file("apps", "server.pem"),
43    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
44);
45
46#Test 1: By default with no existing session we should get a session ticket
47#Expected result: ClientHello extension seen; ServerHello extension seen
48#                 NewSessionTicket message seen; Full handshake
49$proxy->clientflags("-no_tls1_3");
50$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
51plan tests => 10;
52checkmessages(1, "Default session ticket test", 1, 1, 1, 1);
53
54#Test 2: If the server does not accept tickets we should get a normal handshake
55#with no session tickets
56#Expected result: ClientHello extension seen; ServerHello extension not seen
57#                 NewSessionTicket message not seen; Full handshake
58clearall();
59$proxy->clientflags("-no_tls1_3");
60$proxy->serverflags("-no_ticket");
61$proxy->start();
62checkmessages(2, "No server support session ticket test", 1, 0, 0, 1);
63
64#Test 3: If the client does not accept tickets we should get a normal handshake
65#with no session tickets
66#Expected result: ClientHello extension not seen; ServerHello extension not seen
67#                 NewSessionTicket message not seen; Full handshake
68clearall();
69$proxy->clientflags("-no_tls1_3 -no_ticket");
70$proxy->start();
71checkmessages(3, "No client support session ticket test", 0, 0, 0, 1);
72
73#Test 4: Test session resumption with session ticket
74#Expected result: ClientHello extension seen; ServerHello extension not seen
75#                 NewSessionTicket message not seen; Abbreviated handshake
76clearall();
77(undef, my $session) = tempfile();
78$proxy->serverconnects(2);
79$proxy->clientflags("-no_tls1_3 -sess_out ".$session);
80$proxy->start();
81$proxy->clearClient();
82$proxy->clientflags("-no_tls1_3 -sess_in ".$session);
83$proxy->clientstart();
84checkmessages(4, "Session resumption session ticket test", 1, 0, 0, 0);
85unlink $session;
86
87#Test 5: Test session resumption with ticket capable client without a ticket
88#Expected result: ClientHello extension seen; ServerHello extension seen
89#                 NewSessionTicket message seen; Abbreviated handshake
90clearall();
91(undef, $session) = tempfile();
92$proxy->serverconnects(2);
93$proxy->clientflags("-no_tls1_3 -sess_out ".$session." -no_ticket");
94$proxy->start();
95$proxy->clearClient();
96$proxy->clientflags("-no_tls1_3 -sess_in ".$session);
97$proxy->clientstart();
98checkmessages(5, "Session resumption with ticket capable client without a "
99                 ."ticket", 1, 1, 1, 0);
100unlink $session;
101
102#Test 6: Client accepts empty ticket.
103#Expected result: ClientHello extension seen; ServerHello extension seen;
104#                 NewSessionTicket message seen; Full handshake.
105clearall();
106$proxy->filter(\&ticket_filter);
107$proxy->clientflags("-no_tls1_3");
108$proxy->start();
109checkmessages(6, "Empty ticket test",  1, 1, 1, 1);
110
111#Test 7-8: Client keeps existing ticket on empty ticket.
112clearall();
113(undef, $session) = tempfile();
114$proxy->serverconnects(3);
115$proxy->filter(undef);
116$proxy->clientflags("-no_tls1_3 -sess_out ".$session);
117$proxy->start();
118$proxy->clearClient();
119$proxy->clientflags("-no_tls1_3 -sess_in ".$session." -sess_out ".$session);
120$proxy->filter(\&inject_empty_ticket_filter);
121$proxy->clientstart();
122#Expected result: ClientHello extension seen; ServerHello extension seen;
123#                 NewSessionTicket message seen; Abbreviated handshake.
124checkmessages(7, "Empty ticket resumption test",  1, 1, 1, 0);
125clearclient();
126$proxy->clientflags("-no_tls1_3 -sess_in ".$session);
127$proxy->filter(undef);
128$proxy->clientstart();
129#Expected result: ClientHello extension seen; ServerHello extension not seen;
130#                 NewSessionTicket message not seen; Abbreviated handshake.
131checkmessages(8, "Empty ticket resumption test",  1, 0, 0, 0);
132unlink $session;
133
134#Test 9: Bad server sends the ServerHello extension but does not send a
135#NewSessionTicket
136#Expected result: Connection failure
137clearall();
138$proxy->clientflags("-no_tls1_3");
139$proxy->serverflags("-no_ticket");
140$proxy->filter(\&inject_ticket_extension_filter);
141$proxy->start();
142ok(TLSProxy::Message->fail, "Server sends ticket extension but no ticket test");
143
144#Test10: Bad server does not send the ServerHello extension but does send a
145#NewSessionTicket
146#Expected result: Connection failure
147clearall();
148$proxy->clientflags("-no_tls1_3");
149$proxy->serverflags("-no_ticket");
150$proxy->filter(\&inject_empty_ticket_filter);
151$proxy->start();
152ok(TLSProxy::Message->fail, "No server ticket extension but ticket sent test");
153
154sub ticket_filter
155{
156    my $proxy = shift;
157
158    foreach my $message (@{$proxy->message_list}) {
159        if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) {
160            $message->ticket("");
161            $message->repack();
162        }
163    }
164}
165
166sub inject_empty_ticket_filter {
167    my $proxy = shift;
168
169    foreach my $message (@{$proxy->message_list}) {
170        if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) {
171            # Only inject the message first time we're called.
172            return;
173        }
174    }
175
176    my @new_message_list = ();
177    foreach my $message (@{$proxy->message_list}) {
178        push @new_message_list, $message;
179        if ($message->mt == TLSProxy::Message::MT_SERVER_HELLO) {
180            $message->set_extension(TLSProxy::Message::EXT_SESSION_TICKET, "");
181            $message->repack();
182            # Tack NewSessionTicket onto the ServerHello record.
183            # This only works if the ServerHello is exactly one record.
184            my $record = ${$message->records}[0];
185
186            my $offset = $message->startoffset + $message->encoded_length;
187            my $newsessionticket = TLSProxy::NewSessionTicket->new(
188                1, "", [$record], $offset, []);
189            $newsessionticket->repack();
190            push @new_message_list, $newsessionticket;
191        }
192    }
193    $proxy->message_list([@new_message_list]);
194}
195
196sub inject_ticket_extension_filter
197{
198    my $proxy = shift;
199
200    # We're only interested in the initial ServerHello
201    if ($proxy->flight != 1) {
202        return;
203    }
204
205    foreach my $message (@{$proxy->message_list}) {
206        if ($message->mt == TLSProxy::Message::MT_SERVER_HELLO) {
207            #Add the session ticket extension to the ServerHello even though
208            #we are not going to send a NewSessionTicket message
209            $message->set_extension(TLSProxy::Message::EXT_SESSION_TICKET, "");
210
211            $message->repack();
212        }
213    }
214}
215
216sub checkmessages($$$$$$)
217{
218    my ($testno, $testname, $testch, $testsh, $testtickseen, $testhand) = @_;
219
220    subtest $testname => sub {
221
222        foreach my $message (@{$proxy->message_list}) {
223            if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO
224                || $message->mt == TLSProxy::Message::MT_SERVER_HELLO) {
225                #Get the extensions data
226                my %extensions = %{$message->extension_data};
227                if (defined
228                    $extensions{TLSProxy::Message::EXT_SESSION_TICKET}) {
229                    if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) {
230                        $chellotickext = 1;
231                    } else {
232                        $shellotickext = 1;
233                    }
234                }
235            } elsif ($message->mt == TLSProxy::Message::MT_CERTIFICATE) {
236                #Must be doing a full handshake
237                $fullhand = 1;
238            } elsif ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) {
239                $ticketseen = 1;
240            }
241        }
242
243        plan tests => 5;
244
245        ok(TLSProxy::Message->success, "Handshake");
246        ok(($testch && $chellotickext) || (!$testch && !$chellotickext),
247           "ClientHello extension Session Ticket check");
248        ok(($testsh && $shellotickext) || (!$testsh && !$shellotickext),
249           "ServerHello extension Session Ticket check");
250        ok(($testtickseen && $ticketseen) || (!$testtickseen && !$ticketseen),
251           "Session Ticket message presence check");
252        ok(($testhand && $fullhand) || (!$testhand && !$fullhand),
253           "Session Ticket full handshake check");
254    }
255}
256
257
258sub clearclient()
259{
260    $chellotickext = 0;
261    $shellotickext = 0;
262    $fullhand = 0;
263    $ticketseen = 0;
264    $proxy->clearClient();
265}
266
267sub clearall()
268{
269    clearclient();
270    $proxy->clear();
271}
272