diff options
author | Matt Caswell <matt@openssl.org> | 2017-03-15 20:35:23 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2017-03-16 14:20:38 +0000 |
commit | c35cb287cbda087cc203be86d74d35ea1b5eeac6 (patch) | |
tree | ebd8dcf3a36178a8a5fc3ec0ba10a6e22bfde502 /test/recipes | |
parent | 807551ac0dfe90c7953381df445205833ee7a1af (diff) |
Add some HRR tests
Check that we handle changes of ciphersuite between HRR and ServerHello
correctly.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)
Diffstat (limited to 'test/recipes')
-rw-r--r-- | test/recipes/70-test_tls13hrr.t | 94 |
1 files changed, 94 insertions, 0 deletions
diff --git a/test/recipes/70-test_tls13hrr.t b/test/recipes/70-test_tls13hrr.t new file mode 100644 index 0000000000..81301193f8 --- /dev/null +++ b/test/recipes/70-test_tls13hrr.t @@ -0,0 +1,94 @@ +#! /usr/bin/env perl +# Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the OpenSSL license (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + +use strict; +use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/; +use OpenSSL::Test::Utils; +use TLSProxy::Proxy; + +my $test_name = "test_tls13hrr"; +setup($test_name); + +plan skip_all => "TLSProxy isn't usable on $^O" + if $^O =~ /^(VMS|MSWin32)$/; + +plan skip_all => "$test_name needs the dynamic engine feature enabled" + if disabled("engine") || disabled("dynamic-engine"); + +plan skip_all => "$test_name needs the sock feature enabled" + if disabled("sock"); + +plan skip_all => "$test_name needs TLS1.3 enabled" + if disabled("tls1_3"); + +$ENV{OPENSSL_ia32cap} = '~0x200000200000000'; + +my $proxy = TLSProxy::Proxy->new( + undef, + cmdstr(app(["openssl"]), display => 1), + srctop_file("apps", "server.pem"), + (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}) +); + +use constant { + CHANGE_HRR_CIPHERSUITE => 0, + CHANGE_CH1_CIPHERSUITE => 1 +}; + +#Test 1: A client should fail if the server changes the ciphersuite between the +# HRR and the SH +$proxy->filter(\&hrr_filter); +$proxy->serverflags("-curves P-256"); +my $testtype = CHANGE_HRR_CIPHERSUITE; +$proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; +plan tests => 2; +ok(TLSProxy::Message->fail(), "Server ciphersuite changes"); + +#Test 2: It is an error if the client changes the offered ciphersuites so that +# we end up selecting a different ciphersuite between HRR and the SH +$proxy->clear(); +$proxy->serverflags("-curves P-256"); +$proxy->ciphers("TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384"); +$testtype = CHANGE_CH1_CIPHERSUITE; +$proxy->start(); +ok(TLSProxy::Message->fail(), "Client ciphersuite changes"); + +sub hrr_filter +{ + my $proxy = shift; + + if ($testtype == CHANGE_HRR_CIPHERSUITE) { + # We're only interested in the HRR + if ($proxy->flight != 1) { + return; + } + + my $hrr = ${$proxy->message_list}[1]; + + # We will normally only ever select CIPHER_TLS13_AES_128_GCM_SHA256 + # because that's what Proxy tells s_server to do. Setting as below means + # the ciphersuite will change will we get the ServerHello + $hrr->ciphersuite(TLSProxy::Message::CIPHER_TLS13_AES_256_GCM_SHA384); + $hrr->repack(); + return; + } + + # CHANGE_CH1_CIPHERSUITE + if ($proxy->flight != 0) { + return; + } + + my $ch1 = ${$proxy->message_list}[0]; + + # The server prefers TLS13-AES-256-GCM-SHA384 so it will pick that next + # time around + my @ciphersuites = (TLSProxy::Message::CIPHER_TLS13_AES_128_GCM_SHA256); + $ch1->ciphersuite_len(2 * scalar @ciphersuites); + $ch1->ciphersuites(\@ciphersuites); + $ch1->repack(); +} |