diff options
Diffstat (limited to 'test/openssl/test_ssl_session.rb')
| -rw-r--r-- | test/openssl/test_ssl_session.rb | 96 |
1 files changed, 73 insertions, 23 deletions
diff --git a/test/openssl/test_ssl_session.rb b/test/openssl/test_ssl_session.rb index 89cf672a7b..37874ca273 100644 --- a/test/openssl/test_ssl_session.rb +++ b/test/openssl/test_ssl_session.rb @@ -5,7 +5,9 @@ if defined?(OpenSSL::SSL) class OpenSSL::TestSSLSession < OpenSSL::SSLTestCase def test_session - ctx_proc = proc { |ctx| ctx.ssl_version = :TLSv1_2 } + ctx_proc = proc { |ctx| + ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION + } start_server(ctx_proc: ctx_proc) do |port| server_connect_with_session(port, nil, nil) { |ssl| session = ssl.session @@ -28,9 +30,10 @@ class OpenSSL::TestSSLSession < OpenSSL::SSLTestCase end end + # PEM file updated to use TLS 1.2 with ECDHE-RSA-AES256-SHA. DUMMY_SESSION = <<__EOS__ -----BEGIN SSL SESSION PARAMETERS----- -MIIDzQIBAQICAwEEAgA5BCAF219w9ZEV8dNA60cpEGOI34hJtIFbf3bkfzSgMyad +MIIDzQIBAQICAwMEAsAUBCAF219w9ZEV8dNA60cpEGOI34hJtIFbf3bkfzSgMyad MQQwyGLbkCxE4OiMLdKKem+pyh8V7ifoP7tCxhdmwoDlJxI1v6nVCjai+FGYuncy NNSWoQYCBE4DDWuiAwIBCqOCAo4wggKKMIIBcqADAgECAgECMA0GCSqGSIb3DQEB BQUAMD0xEzARBgoJkiaJk/IsZAEZFgNvcmcxGTAXBgoJkiaJk/IsZAEZFglydWJ5 @@ -54,9 +57,10 @@ j+RBGfCFrrQbBdnkFI/ztgM= -----END SSL SESSION PARAMETERS----- __EOS__ + # PEM file updated to use TLS 1.1 with ECDHE-RSA-AES256-SHA. DUMMY_SESSION_NO_EXT = <<-__EOS__ -----BEGIN SSL SESSION PARAMETERS----- -MIIDCAIBAQICAwAEAgA5BCDyAW7rcpzMjDSosH+Tv6sukymeqgq3xQVVMez628A+ +MIIDCAIBAQICAwIEAsAUBCDyAW7rcpzMjDSosH+Tv6sukymeqgq3xQVVMez628A+ lAQw9TrKzrIqlHEh6ltuQaqv/Aq83AmaAlogYktZgXAjOGnhX7ifJDNLMuCfQq53 hPAaoQYCBE4iDeeiBAICASyjggKOMIICijCCAXKgAwIBAgIBAjANBgkqhkiG9w0B AQUFADA9MRMwEQYKCZImiZPyLGQBGRYDb3JnMRkwFwYKCZImiZPyLGQBGRYJcnVi @@ -120,7 +124,8 @@ __EOS__ ctx.options &= ~OpenSSL::SSL::OP_NO_TICKET # Disable server-side session cache which is enabled by default ctx.session_cache_mode = OpenSSL::SSL::SSLContext::SESSION_CACHE_OFF - ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION if libressl?(3, 2, 0) + # Session tickets must be retrieved via ctx.session_new_cb in TLS 1.3 in AWS-LC. + ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION if libressl? || aws_lc? } start_server(ctx_proc: ctx_proc) do |port| sess1 = server_connect_with_session(port, nil, nil) { |ssl| @@ -143,7 +148,7 @@ __EOS__ def test_server_session_cache ctx_proc = Proc.new do |ctx| - ctx.ssl_version = :TLSv1_2 + ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION ctx.options |= OpenSSL::SSL::OP_NO_TICKET end @@ -197,7 +202,7 @@ __EOS__ 10.times do |i| connections = i cctx = OpenSSL::SSL::SSLContext.new - cctx.ssl_version = :TLSv1_2 + cctx.max_version = OpenSSL::SSL::TLS1_2_VERSION server_connect_with_session(port, cctx, first_session) { |ssl| ssl.puts("abc"); assert_equal "abc\n", ssl.gets first_session ||= ssl.session @@ -217,13 +222,13 @@ __EOS__ # Skipping tests that use session_remove_cb by default because it may cause # deadlock. - TEST_SESSION_REMOVE_CB = ENV["OSSL_TEST_ALL"] == "1" + TEST_SESSION_REMOVE_CB = ENV["OSSL_TEST_UNSAFE"] == "1" - def test_ctx_client_session_cb - ctx_proc = proc { |ctx| ctx.ssl_version = :TLSv1_2 } - start_server(ctx_proc: ctx_proc) do |port| + def test_ctx_client_session_cb_tls12 + start_server do |port| called = {} ctx = OpenSSL::SSL::SSLContext.new + ctx.min_version = ctx.max_version = :TLS1_2 ctx.session_cache_mode = OpenSSL::SSL::SSLContext::SESSION_CACHE_CLIENT ctx.session_new_cb = lambda { |ary| sock, sess = ary @@ -233,19 +238,69 @@ __EOS__ ctx.session_remove_cb = lambda { |ary| ctx, sess = ary called[:remove] = [ctx, sess] - # any resulting value is OK (ignored) } end server_connect_with_session(port, ctx, nil) { |ssl| - assert_equal(1, ctx.session_cache_stats[:cache_num]) assert_equal(1, ctx.session_cache_stats[:connect_good]) assert_equal([ssl, ssl.session], called[:new]) - assert(ctx.session_remove(ssl.session)) - assert(!ctx.session_remove(ssl.session)) - if TEST_SESSION_REMOVE_CB - assert_equal([ctx, ssl.session], called[:remove]) + # AWS-LC doesn't support internal session caching on the client, but + # the callback is still enabled as expected. + unless aws_lc? + assert_equal(1, ctx.session_cache_stats[:cache_num]) + assert_equal(true, ctx.session_remove(ssl.session)) + if TEST_SESSION_REMOVE_CB + assert_equal([ctx, ssl.session], called[:remove]) + end end + assert_equal(false, ctx.session_remove(ssl.session)) + } + end + end + + def test_ctx_client_session_cb_tls13 + omit "LibreSSL does not call session_new_cb in TLS 1.3" if libressl? + omit "AWS-LC does not support internal session caching on the client" if aws_lc? + + start_server do |port| + called = {} + ctx = OpenSSL::SSL::SSLContext.new + ctx.min_version = :TLS1_3 + ctx.session_cache_mode = OpenSSL::SSL::SSLContext::SESSION_CACHE_CLIENT + ctx.session_new_cb = lambda { |ary| + sock, sess = ary + called[:new] = [sock, sess] + } + + server_connect_with_session(port, ctx, nil) { |ssl| + ssl.puts("abc"); assert_equal("abc\n", ssl.gets) + + assert_operator(1, :<=, ctx.session_cache_stats[:cache_num]) + assert_operator(1, :<=, ctx.session_cache_stats[:connect_good]) + assert_equal([ssl, ssl.session], called[:new]) + } + end + end + + def test_ctx_client_session_cb_tls13_exception + omit "LibreSSL does not call session_new_cb in TLS 1.3" if libressl? + + server_proc = lambda do |ctx, ssl| + readwrite_loop(ctx, ssl) + rescue SystemCallError, OpenSSL::SSL::SSLError + end + start_server(server_proc: server_proc) do |port| + ctx = OpenSSL::SSL::SSLContext.new + ctx.min_version = :TLS1_3 + ctx.session_cache_mode = OpenSSL::SSL::SSLContext::SESSION_CACHE_CLIENT + ctx.session_new_cb = lambda { |ary| + raise "in session_new_cb" + } + + server_connect_with_session(port, ctx, nil) { |ssl| + assert_raise_with_message(RuntimeError, /in session_new_cb/) { + ssl.puts("abc"); assert_equal("abc\n", ssl.gets) + } } end end @@ -254,11 +309,11 @@ __EOS__ connections = nil called = {} cctx = OpenSSL::SSL::SSLContext.new - cctx.ssl_version = :TLSv1_2 + cctx.max_version = OpenSSL::SSL::TLS1_2_VERSION sctx = nil ctx_proc = Proc.new { |ctx| sctx = ctx - ctx.ssl_version = :TLSv1_2 + ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION ctx.options |= OpenSSL::SSL::OP_NO_TICKET # get_cb is called whenever a client proposed to resume a session but @@ -328,11 +383,6 @@ __EOS__ connections = 2 sess2 = server_connect_with_session(port, cctx, sess0.dup) { |ssl| ssl.puts("abc"); assert_equal "abc\n", ssl.gets - if !ssl.session_reused? && openssl?(1, 1, 0) && !openssl?(1, 1, 0, 7) - # OpenSSL >= 1.1.0, < 1.1.0g - pend "External session cache is not working; " \ - "see https://github.com/openssl/openssl/pull/4014" - end assert_equal true, ssl.session_reused? ssl.session } |