1#! /usr/bin/env perl 2# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. 3# 4# Licensed under the Apache License 2.0 (the "License"). You may not use 5# this file except in compliance with the License. You can obtain a copy 6# in the file LICENSE in the source distribution or at 7# https://www.openssl.org/source/license.html 8 9use strict; 10use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/; 11use OpenSSL::Test::Utils; 12use TLSProxy::Proxy; 13use File::Temp qw(tempfile); 14 15my $test_name = "test_tlsextms"; 16setup($test_name); 17 18plan skip_all => "TLSProxy isn't usable on $^O" 19 if $^O =~ /^(VMS)$/; 20 21plan skip_all => "$test_name needs the dynamic engine feature enabled" 22 if disabled("engine") || disabled("dynamic-engine"); 23 24plan skip_all => "$test_name needs the sock feature enabled" 25 if disabled("sock"); 26 27plan skip_all => "$test_name needs TLSv1.0, TLSv1.1 or TLSv1.2 enabled" 28 if disabled("tls1") && disabled("tls1_1") && disabled("tls1_2"); 29 30sub checkmessages($$$$$); 31sub setrmextms($$); 32sub clearall(); 33 34my $crmextms = 0; 35my $srmextms = 0; 36my $cextms = 0; 37my $sextms = 0; 38my $fullhand = 0; 39 40my $proxy = TLSProxy::Proxy->new( 41 \&extms_filter, 42 cmdstr(app(["openssl"]), display => 1), 43 srctop_file("apps", "server.pem"), 44 (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) 45); 46 47#Note that EXTMS is only relevant for <TLS1.3 48 49#Test 1: By default server and client should send extended master secret 50# extension. 51#Expected result: ClientHello extension seen; ServerHello extension seen 52# Full handshake 53 54setrmextms(0, 0); 55$proxy->clientflags("-no_tls1_3"); 56$proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; 57plan tests => 10; 58checkmessages(1, "Default extended master secret test", 1, 1, 1); 59 60#Test 2: If client omits extended master secret extension, server should too. 61#Expected result: ClientHello extension not seen; ServerHello extension not seen 62# Full handshake 63 64clearall(); 65setrmextms(1, 0); 66$proxy->clientflags("-no_tls1_3"); 67$proxy->start(); 68checkmessages(2, "No client extension extended master secret test", 0, 0, 1); 69 70# Test 3: same as 1 but with session tickets disabled. 71# Expected result: same as test 1. 72 73clearall(); 74$proxy->clientflags("-no_ticket -no_tls1_3"); 75setrmextms(0, 0); 76$proxy->start(); 77checkmessages(3, "No ticket extended master secret test", 1, 1, 1); 78 79# Test 4: same as 2 but with session tickets disabled. 80# Expected result: same as test 2. 81 82clearall(); 83$proxy->clientflags("-no_ticket -no_tls1_3"); 84setrmextms(1, 0); 85$proxy->start(); 86checkmessages(4, "No ticket, no client extension extended master secret test", 0, 0, 1); 87 88#Test 5: Session resumption extended master secret test 89# 90#Expected result: ClientHello extension seen; ServerHello extension seen 91# Abbreviated handshake 92 93clearall(); 94setrmextms(0, 0); 95(undef, my $session) = tempfile(); 96$proxy->serverconnects(2); 97$proxy->clientflags("-no_tls1_3 -sess_out ".$session); 98$proxy->start(); 99$proxy->clearClient(); 100$proxy->clientflags("-no_tls1_3 -sess_in ".$session); 101$proxy->clientstart(); 102checkmessages(5, "Session resumption extended master secret test", 1, 1, 0); 103unlink $session; 104 105#Test 6: Session resumption extended master secret test original session 106# omits extension. Server must not resume session. 107#Expected result: ClientHello extension seen; ServerHello extension seen 108# Full handshake 109 110clearall(); 111setrmextms(1, 0); 112(undef, $session) = tempfile(); 113$proxy->serverconnects(2); 114$proxy->clientflags("-no_tls1_3 -sess_out ".$session); 115$proxy->start(); 116$proxy->clearClient(); 117$proxy->clientflags("-no_tls1_3 -sess_in ".$session); 118setrmextms(0, 0); 119$proxy->clientstart(); 120checkmessages(6, "Session resumption extended master secret test", 1, 1, 1); 121unlink $session; 122 123#Test 7: Session resumption extended master secret test resumed session 124# omits client extension. Server must abort connection. 125#Expected result: aborted connection. 126 127clearall(); 128setrmextms(0, 0); 129(undef, $session) = tempfile(); 130$proxy->serverconnects(2); 131$proxy->clientflags("-no_tls1_3 -sess_out ".$session); 132$proxy->start(); 133$proxy->clearClient(); 134$proxy->clientflags("-no_tls1_3 -sess_in ".$session); 135setrmextms(1, 0); 136$proxy->clientstart(); 137ok(TLSProxy::Message->fail(), "Client inconsistent session resumption"); 138unlink $session; 139 140#Test 8: Session resumption extended master secret test resumed session 141# omits server extension. Client must abort connection. 142#Expected result: aborted connection. 143 144clearall(); 145setrmextms(0, 0); 146(undef, $session) = tempfile(); 147$proxy->serverconnects(2); 148$proxy->clientflags("-no_tls1_3 -sess_out ".$session); 149$proxy->start(); 150$proxy->clearClient(); 151$proxy->clientflags("-no_tls1_3 -sess_in ".$session); 152setrmextms(0, 1); 153$proxy->clientstart(); 154ok(TLSProxy::Message->fail(), "Server inconsistent session resumption 1"); 155unlink $session; 156 157#Test 9: Session resumption extended master secret test initial session 158# omits server extension. Client must abort connection. 159#Expected result: aborted connection. 160 161clearall(); 162setrmextms(0, 1); 163(undef, $session) = tempfile(); 164$proxy->serverconnects(2); 165$proxy->clientflags("-no_tls1_3 -sess_out ".$session); 166$proxy->start(); 167$proxy->clearClient(); 168$proxy->clientflags("-no_tls1_3 -sess_in ".$session); 169setrmextms(0, 0); 170$proxy->clientstart(); 171ok(TLSProxy::Message->fail(), "Server inconsistent session resumption 2"); 172unlink $session; 173 174SKIP: { 175 skip "TLS 1.3 disabled", 1 176 if disabled("tls1_3") || (disabled("ec") && disabled("dh")); 177 178 #Test 10: In TLS1.3 we should not negotiate extended master secret 179 #Expected result: ClientHello extension seen; ServerHello extension not seen 180 # TLS1.3 handshake (will appear as abbreviated handshake 181 # because of no CKE message) 182 clearall(); 183 setrmextms(0, 0); 184 $proxy->start(); 185 checkmessages(10, "TLS1.3 extended master secret test", 1, 0, 0); 186} 187 188 189sub extms_filter 190{ 191 my $proxy = shift; 192 193 foreach my $message (@{$proxy->message_list}) { 194 if ($crmextms && $message->mt == TLSProxy::Message::MT_CLIENT_HELLO) { 195 $message->delete_extension(TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET); 196 $message->repack(); 197 } 198 if ($srmextms && $message->mt == TLSProxy::Message::MT_SERVER_HELLO) { 199 $message->delete_extension(TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET); 200 $message->repack(); 201 } 202 } 203} 204 205sub checkmessages($$$$$) 206{ 207 my ($testno, $testname, $testcextms, $testsextms, $testhand) = @_; 208 209 subtest $testname => sub { 210 211 foreach my $message (@{$proxy->message_list}) { 212 if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO 213 || $message->mt == TLSProxy::Message::MT_SERVER_HELLO) { 214 #Get the extensions data 215 my %extensions = %{$message->extension_data}; 216 if (defined 217 $extensions{TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET}) { 218 if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) { 219 $cextms = 1; 220 } else { 221 $sextms = 1; 222 } 223 } 224 } elsif ($message->mt == TLSProxy::Message::MT_CLIENT_KEY_EXCHANGE) { 225 #Must be doing a full handshake 226 $fullhand = 1; 227 } 228 } 229 230 plan tests => 4; 231 232 ok(TLSProxy::Message->success, "Handshake"); 233 234 ok($testcextms == $cextms, 235 "ClientHello extension extended master secret check"); 236 ok($testsextms == $sextms, 237 "ServerHello extension extended master secret check"); 238 ok($testhand == $fullhand, 239 "Extended master secret full handshake check"); 240 241 } 242} 243 244sub setrmextms($$) 245{ 246 ($crmextms, $srmextms) = @_; 247} 248 249sub clearall() 250{ 251 $cextms = 0; 252 $sextms = 0; 253 $fullhand = 0; 254 $proxy->clear(); 255} 256
