diff options
author | Matt Caswell <matt@openssl.org> | 2017-05-09 08:52:48 +0100 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2017-05-09 17:23:58 +0100 |
commit | c96ec6f8048c7c2210c5d45276000190051c229f (patch) | |
tree | 30539c091aa6d3836c21f0504f2f58bc1c6a5bf7 | |
parent | 7b1ec1cfb76dfd71519d4a1482be0355817b06fc (diff) |
More TLSv1.3 cookie tests
Test sending a cookie without a key_share
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3414)
-rw-r--r-- | test/recipes/70-test_tls13cookie.t | 70 |
1 files changed, 50 insertions, 20 deletions
diff --git a/test/recipes/70-test_tls13cookie.t b/test/recipes/70-test_tls13cookie.t index c263e0e3b8..3d3a10fcbf 100644 --- a/test/recipes/70-test_tls13cookie.t +++ b/test/recipes/70-test_tls13cookie.t @@ -28,6 +28,11 @@ plan skip_all => "$test_name needs TLS1.3 enabled" $ENV{OPENSSL_ia32cap} = '~0x200000200000000'; +use constant { + COOKIE_ONLY => 0, + COOKIE_AND_KEY_SHARE => 1 +}; + my $proxy = TLSProxy::Proxy->new( undef, cmdstr(app(["openssl"]), display => 1), @@ -36,22 +41,31 @@ my $proxy = TLSProxy::Proxy->new( ); my $cookieseen = 0; +my $testtype; #Test 1: Inserting a cookie into an HRR should see it echoed in the ClientHello +$testtype = COOKIE_ONLY; $proxy->filter(\&cookie_filter); -$proxy->serverflags("-curves P-256"); +$proxy->serverflags("-curves X25519"); $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; -plan tests => 1; +plan tests => 2; +ok(TLSProxy::Message->success() && $cookieseen == 1, "Cookie seen"); + +#Test 2: Same as test 1 but should also work where a new key_share is also +# required +$testtype = COOKIE_AND_KEY_SHARE; +$proxy->clear(); +$proxy->clientflags("-curves P-256:X25519"); +$proxy->serverflags("-curves X25519"); +$proxy->start(); ok(TLSProxy::Message->success() && $cookieseen == 1, "Cookie seen"); sub cookie_filter { my $proxy = shift; - # We're only interested in the HRR and subsequent ClientHello - if ($proxy->flight != 1 && $proxy->flight != 2) { - return; - } + # We're only interested in the HRR and both ClientHellos + return if ($proxy->flight > 2); my $ext = pack "C8", 0x00, 0x06, #Cookie Length @@ -60,22 +74,38 @@ sub cookie_filter 0x04, 0x05; foreach my $message (@{$proxy->message_list}) { - if ($message->mt == TLSProxy::Message::MT_HELLO_RETRY_REQUEST) { - + if ($message->mt == TLSProxy::Message::MT_HELLO_RETRY_REQUEST + && ${$message->records}[0]->flight == 1) { + $message->delete_extension(TLSProxy::Message::EXT_KEY_SHARE) + if ($testtype == COOKIE_ONLY); $message->set_extension(TLSProxy::Message::EXT_COOKIE, $ext); $message->repack(); - } elsif ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO - && ${$message->records}[0]->flight == 2) { - #cmp can behave differently dependent on locale - no locale; - my $cookie = - $message->extension_data->{TLSProxy::Message::EXT_COOKIE}; - - return if !defined($cookie); - - return if ($cookie cmp $ext) != 0; - - $cookieseen = 1; + } elsif ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) { + if (${$message->records}[0]->flight == 0) { + if ($testtype == COOKIE_ONLY) { + my $ext = pack "C7", + 0x00, 0x05, #List Length + 0x00, 0x17, #P-256 + 0x00, 0x01, #key_exchange data length + 0xff; #Dummy key_share data + # Trick the server into thinking we got an unacceptable + # key_share + $message->set_extension( + TLSProxy::Message::EXT_KEY_SHARE, $ext); + $message->repack(); + } + } else { + #cmp can behave differently dependent on locale + no locale; + my $cookie = + $message->extension_data->{TLSProxy::Message::EXT_COOKIE}; + + return if !defined($cookie); + + return if ($cookie cmp $ext) != 0; + + $cookieseen = 1; + } } } } |