Commit 9b287d53 authored by Matt Caswell's avatar Matt Caswell
Browse files

Add a test for TLSv1.3 fallback 



Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6894)
parent 5df22060

test/recipes/70-test_tls13downgrade.t

+31 −11
Original line number Diff line number Diff line
@@ -41,14 +41,15 @@ my $proxy = TLSProxy::Proxy->new( 


use constant {

    DOWNGRADE_TO_TLS_1_2 => 0,

    DOWNGRADE_TO_TLS_1_1 => 1

    DOWNGRADE_TO_TLS_1_1 => 1,

    FALLBACK_FROM_TLS_1_3 => 2,

};



#Test 1: Downgrade from TLSv1.3 to TLSv1.2

$proxy->filter(\&downgrade_filter);

my $testtype = DOWNGRADE_TO_TLS_1_2;

$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";

plan tests => 3;

plan tests => 4;

ok(TLSProxy::Message->fail(), "Downgrade TLSv1.3 to TLSv1.2");



#Test 2: Downgrade from TLSv1.3 to TLSv1.1
@@ -64,6 +65,18 @@ $proxy->serverflags("-no_tls1_3"); 
$proxy->start();

ok(TLSProxy::Message->fail(), "Downgrade TLSv1.2 to TLSv1.1");



#Test 4: Client falls back from TLSv1.3 (server does not support the fallback

#        SCSV)

$proxy->clear();

$testtype = FALLBACK_FROM_TLS_1_3;

$proxy->clientflags("-fallback_scsv -no_tls1_3");

$proxy->start();

my $alert = TLSProxy::Message->alert();

ok(TLSProxy::Message->fail()

   && !$alert->server()

   && $alert->description() == TLSProxy::Message::AL_DESC_ILLEGAL_PARAMETER,

   "Fallback from TLSv1.3");



sub downgrade_filter

{

    my $proxy = shift;
@@ -76,6 +89,12 @@ sub downgrade_filter 
    my $message = ${$proxy->message_list}[0];



    my $ext;

    if ($testtype == FALLBACK_FROM_TLS_1_3) {

        #The default ciphersuite we use for TLSv1.2 without any SCSV

        my @ciphersuites = (TLSProxy::Message::CIPHER_RSA_WITH_AES_128_CBC_SHA);

        $message->ciphersuite_len(2 * scalar @ciphersuites);

        $message->ciphersuites(\@ciphersuites);

    } else {

        if ($testtype == DOWNGRADE_TO_TLS_1_2) {

            $ext = pack "C3",

                0x02, # Length
@@ -87,6 +106,7 @@ sub downgrade_filter 
        }



        $message->set_extension(TLSProxy::Message::EXT_SUPPORTED_VERSIONS, $ext);

    }



    $message->repack();

}

util/perl/TLSProxy/Message.pm

+2 −0
Original line number Diff line number Diff line
@@ -41,6 +41,7 @@ use constant { 
use constant {

    AL_DESC_CLOSE_NOTIFY => 0,

    AL_DESC_UNEXPECTED_MESSAGE => 10,

    AL_DESC_ILLEGAL_PARAMETER => 47,

    AL_DESC_NO_RENEGOTIATION => 100

};
@@ -125,6 +126,7 @@ use constant { 
};



use constant {

    CIPHER_RSA_WITH_AES_128_CBC_SHA => 0x002f,

    CIPHER_DHE_RSA_AES_128_SHA => 0x0033,

    CIPHER_ADH_AES_128_SHA => 0x0034,

    CIPHER_TLS13_AES_128_GCM_SHA256 => 0x1301,