diff options
| -rwxr-xr-x | test/recipes/70-test_sslsessiontick.t | 25 | ||||
| -rw-r--r-- | util/TLSProxy/Message.pm | 9 | ||||
| -rw-r--r-- | util/TLSProxy/NewSessionTicket.pm | 125 | ||||
| -rw-r--r-- | util/TLSProxy/Proxy.pm | 1 |
4 files changed, 158 insertions, 2 deletions
diff --git a/test/recipes/70-test_sslsessiontick.t b/test/recipes/70-test_sslsessiontick.t index 7f90beae63..bf07fd1162 100755 --- a/test/recipes/70-test_sslsessiontick.t +++ b/test/recipes/70-test_sslsessiontick.t @@ -82,7 +82,7 @@ my $proxy = TLSProxy::Proxy->new( top_file("apps", "server.pem") ); -plan tests => 5; +plan tests => 6; #Test 1: By default with no existing session we should get a session ticket #Expected result: ClientHello extension seen; ServerHello extension seen @@ -135,6 +135,27 @@ $proxy->clientstart(); checkmessages(5, "Session resumption with ticket capable client without a " ."ticket", 1, 1, 1, 0); +#Test 6: Client accepts empty ticket. +#Expected result: ClientHello extension seen; ServerHello extension seen; +# NewSessionTicket message seen; Full handshake. +clearall(); +$proxy->filter(\&ticket_filter); +$proxy->start(); +checkmessages(6, "Empty ticket test", 1, 1, 1, 1); + + +sub ticket_filter +{ + my $proxy = shift; + + foreach my $message (@{$proxy->message_list}) { + if ($message->mt == TLSProxy::Message::MT_NEW_SESSION_TICKET) { + $message->ticket(""); + $message->repack(); + } + } +} + sub checkmessages($$$$$$) { my ($testno, $testname, $testch, $testsh, $testtickseen, $testhand) = @_; @@ -164,7 +185,7 @@ sub checkmessages($$$$$$) plan tests => 5; - ok(TLSProxy::Message->success, "Hanshake"); + ok(TLSProxy::Message->success, "Handshake"); ok(($testch && $chellotickext) || (!$testch && !$chellotickext), "ClientHello extension Session Ticket check"); ok(($testsh && $shellotickext) || (!$testsh && !$shellotickext), diff --git a/util/TLSProxy/Message.pm b/util/TLSProxy/Message.pm index 6376219d15..18e9277efa 100644 --- a/util/TLSProxy/Message.pm +++ b/util/TLSProxy/Message.pm @@ -282,6 +282,15 @@ sub create_message [@message_frag_lens] ); $message->parse(); + } elsif ($mt == MT_NEW_SESSION_TICKET) { + $message = TLSProxy::NewSessionTicket->new( + $server, + $data, + [@message_rec_list], + $startoffset, + [@message_frag_lens] + ); + $message->parse(); } else { #Unknown message type $message = TLSProxy::Message->new( diff --git a/util/TLSProxy/NewSessionTicket.pm b/util/TLSProxy/NewSessionTicket.pm new file mode 100644 index 0000000000..75dbf23234 --- /dev/null +++ b/util/TLSProxy/NewSessionTicket.pm @@ -0,0 +1,125 @@ +# ==================================================================== +# Copyright (c) 1998-2015 The OpenSSL Project. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in +# the documentation and/or other materials provided with the +# distribution. +# +# 3. All advertising materials mentioning features or use of this +# software must display the following acknowledgment: +# "This product includes software developed by the OpenSSL Project +# for use in the OpenSSL Toolkit. (http://www.openssl.org/)" +# +# 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to +# endorse or promote products derived from this software without +# prior written permission. For written permission, please contact +# openssl-core@openssl.org. +# +# 5. Products derived from this software may not be called "OpenSSL" +# nor may "OpenSSL" appear in their names without prior written +# permission of the OpenSSL Project. +# +# 6. Redistributions of any form whatsoever must retain the following +# acknowledgment: +# "This product includes software developed by the OpenSSL Project +# for use in the OpenSSL Toolkit (http://www.openssl.org/)" +# +# THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY +# EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR +# ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED +# OF THE POSSIBILITY OF SUCH DAMAGE. +# ==================================================================== +# +# This product includes cryptographic software written by Eric Young +# (eay@cryptsoft.com). This product includes software written by Tim +# Hudson (tjh@cryptsoft.com). + +use strict; + +package TLSProxy::NewSessionTicket; + +use parent 'TLSProxy::Message'; + +sub new +{ + my $class = shift; + my ($server, + $data, + $records, + $startoffset, + $message_frag_lens) = @_; + + my $self = $class->SUPER::new( + $server, + TLSProxy::Message::MT_NEW_SESSION_TICKET, + $data, + $records, + $startoffset, + $message_frag_lens); + + $self->{ticket_lifetime_hint} = 0; + $self->{ticket} = ""; + + return $self; +} + +sub parse +{ + my $self = shift; + + my $ticket_lifetime_hint = unpack('N', $self->data); + my $ticket_len = unpack('n', $self->data); + my $ticket = substr($self->data, 6, $ticket_len); + + $self->ticket_lifetime_hint($ticket_lifetime_hint); + $self->ticket($ticket); +} + + +#Reconstruct the on-the-wire message data following changes +sub set_message_contents +{ + my $self = shift; + my $data; + + $data = pack('N', $self->ticket_lifetime_hint); + $data .= pack('n', length($self->ticket)); + $data .= $self->ticket; + + $self->data($data); +} + +#Read/write accessors +sub ticket_lifetime_hint +{ + my $self = shift; + if (@_) { + $self->{ticket_lifetime_hint} = shift; + } + return $self->{ticket_lifetime_hint}; +} +sub ticket +{ + my $self = shift; + if (@_) { + $self->{ticket} = shift; + } + return $self->{ticket}; +} +1; diff --git a/util/TLSProxy/Proxy.pm b/util/TLSProxy/Proxy.pm index 6c1ea7780a..aaeea28c98 100644 --- a/util/TLSProxy/Proxy.pm +++ b/util/TLSProxy/Proxy.pm @@ -63,6 +63,7 @@ use TLSProxy::Message; use TLSProxy::ClientHello; use TLSProxy::ServerHello; use TLSProxy::ServerKeyExchange; +use TLSProxy::NewSessionTicket; sub new { |