mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-15 06:01:37 +08:00
Code Issues Packages Projects Releases Wiki Activity
2cdce3e32f
openssl/test/ssl-tests/06-sni-ticket.conf

600 lines
15 KiB
Plaintext
Raw Normal View History

Fix session ticket and SNI When session tickets are used, it's possible that SNI might swtich the SSL_CTX on an SSL. Normally, this is not a problem, because the initial_ctx/session_ctx are used for all session ticket/id processes. However, when the SNI callback occurs, it's possible that the callback may update the options in the SSL from the SSL_CTX, and this could cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things can happen: 1. The session ticket TLSEXT may not be written when the ticket expected flag is set. The state machine transistions to writing the ticket, and the client responds with an error as its not expecting a ticket. 2. When creating the session ticket, if the ticket key cb returns 0 the crypto/hmac contexts are not initialized, and the code crashes when trying to encrypt the session ticket. To fix 1, if the ticket TLSEXT is not written out, clear the expected ticket flag. To fix 2, consider a return of 0 from the ticket key cb a recoverable error, and write a 0 length ticket and continue. The client-side code can explicitly handle this case. Fix these two cases, and add unit test code to validate ticket behavior. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
# Generated with generate_ssl_tests.pl
num_tests = 17
test-0 = 0-sni-session-ticket
test-1 = 1-sni-session-ticket
test-2 = 2-sni-session-ticket
test-3 = 3-sni-session-ticket
test-4 = 4-sni-session-ticket
test-5 = 5-sni-session-ticket
test-6 = 6-sni-session-ticket
test-7 = 7-sni-session-ticket
test-8 = 8-sni-session-ticket
test-9 = 9-sni-session-ticket
test-10 = 10-sni-session-ticket
test-11 = 11-sni-session-ticket
test-12 = 12-sni-session-ticket
test-13 = 13-sni-session-ticket
test-14 = 14-sni-session-ticket
test-15 = 15-sni-session-ticket
test-16 = 16-sni-session-ticket
# ===========================================================
[0-sni-session-ticket]
ssl_conf = 0-sni-session-ticket-ssl
[0-sni-session-ticket-ssl]
server = 0-sni-session-ticket-server
server2 = 0-sni-session-ticket-server2
client = 0-sni-session-ticket-client
[0-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = Broken
# ===========================================================
[1-sni-session-ticket]
ssl_conf = 1-sni-session-ticket-ssl
[1-sni-session-ticket-ssl]
server = 1-sni-session-ticket-server
server2 = 1-sni-session-ticket-server2
client = 1-sni-session-ticket-client
[1-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = Yes
# ===========================================================
[2-sni-session-ticket]
ssl_conf = 2-sni-session-ticket-ssl
[2-sni-session-ticket-ssl]
server = 2-sni-session-ticket-server
server2 = 2-sni-session-ticket-server2
client = 2-sni-session-ticket-client
[2-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = Success
ServerName = server2
SessionTicketExpected = Yes
# ===========================================================
[3-sni-session-ticket]
ssl_conf = 3-sni-session-ticket-ssl
[3-sni-session-ticket-ssl]
server = 3-sni-session-ticket-server
server2 = 3-sni-session-ticket-server2
client = 3-sni-session-ticket-client
[3-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = Yes
# ===========================================================
[4-sni-session-ticket]
ssl_conf = 4-sni-session-ticket-ssl
[4-sni-session-ticket-ssl]
server = 4-sni-session-ticket-server
server2 = 4-sni-session-ticket-server2
client = 4-sni-session-ticket-client
[4-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-4]
ExpectedResult = Success
ServerName = server2
SessionTicketExpected = No
# ===========================================================
[5-sni-session-ticket]
ssl_conf = 5-sni-session-ticket-ssl
[5-sni-session-ticket-ssl]
server = 5-sni-session-ticket-server
server2 = 5-sni-session-ticket-server2
client = 5-sni-session-ticket-client
[5-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = No
# ===========================================================
[6-sni-session-ticket]
ssl_conf = 6-sni-session-ticket-ssl
[6-sni-session-ticket-ssl]
server = 6-sni-session-ticket-server
server2 = 6-sni-session-ticket-server2
client = 6-sni-session-ticket-client
[6-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
ExpectedResult = Success
ServerName = server2
SessionTicketExpected = No
# ===========================================================
[7-sni-session-ticket]
ssl_conf = 7-sni-session-ticket-ssl
[7-sni-session-ticket-ssl]
server = 7-sni-session-ticket-server
server2 = 7-sni-session-ticket-server2
client = 7-sni-session-ticket-client
[7-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = No
# ===========================================================
[8-sni-session-ticket]
ssl_conf = 8-sni-session-ticket-ssl
[8-sni-session-ticket-ssl]
server = 8-sni-session-ticket-server
server2 = 8-sni-session-ticket-server2
client = 8-sni-session-ticket-client
[8-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-sni-session-ticket-client]
CipherString = DEFAULT
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
ExpectedResult = Success
ServerName = server2
SessionTicketExpected = No
# ===========================================================
[9-sni-session-ticket]
ssl_conf = 9-sni-session-ticket-ssl
[9-sni-session-ticket-ssl]
server = 9-sni-session-ticket-server
server2 = 9-sni-session-ticket-server2
client = 9-sni-session-ticket-client
[9-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-sni-session-ticket-client]
CipherString = DEFAULT
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-9]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = No
# ===========================================================
[10-sni-session-ticket]
ssl_conf = 10-sni-session-ticket-ssl
[10-sni-session-ticket-ssl]
server = 10-sni-session-ticket-server
server2 = 10-sni-session-ticket-server2
client = 10-sni-session-ticket-client
[10-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-sni-session-ticket-client]
CipherString = DEFAULT
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-10]
ExpectedResult = Success
ServerName = server2
SessionTicketExpected = No
# ===========================================================
[11-sni-session-ticket]
ssl_conf = 11-sni-session-ticket-ssl
[11-sni-session-ticket-ssl]
server = 11-sni-session-ticket-server
server2 = 11-sni-session-ticket-server2
client = 11-sni-session-ticket-client
[11-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-sni-session-ticket-client]
CipherString = DEFAULT
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-11]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = No
# ===========================================================
[12-sni-session-ticket]
ssl_conf = 12-sni-session-ticket-ssl
[12-sni-session-ticket-ssl]
server = 12-sni-session-ticket-server
server2 = 12-sni-session-ticket-server2
client = 12-sni-session-ticket-client
[12-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-sni-session-ticket-client]
CipherString = DEFAULT
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-12]
ExpectedResult = Success
ServerName = server2
SessionTicketExpected = No
# ===========================================================
[13-sni-session-ticket]
ssl_conf = 13-sni-session-ticket-ssl
[13-sni-session-ticket-ssl]
server = 13-sni-session-ticket-server
server2 = 13-sni-session-ticket-server2
client = 13-sni-session-ticket-client
[13-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-sni-session-ticket-client]
CipherString = DEFAULT
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-13]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = No
# ===========================================================
[14-sni-session-ticket]
ssl_conf = 14-sni-session-ticket-ssl
[14-sni-session-ticket-ssl]
server = 14-sni-session-ticket-server
server2 = 14-sni-session-ticket-server2
client = 14-sni-session-ticket-client
[14-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-sni-session-ticket-client]
CipherString = DEFAULT
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-14]
ExpectedResult = Success
ServerName = server2
SessionTicketExpected = No
# ===========================================================
[15-sni-session-ticket]
ssl_conf = 15-sni-session-ticket-ssl
[15-sni-session-ticket-ssl]
server = 15-sni-session-ticket-server
server2 = 15-sni-session-ticket-server2
client = 15-sni-session-ticket-client
[15-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-sni-session-ticket-client]
CipherString = DEFAULT
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-15]
ExpectedResult = Success
ServerName = server1
SessionTicketExpected = No
# ===========================================================
[16-sni-session-ticket]
ssl_conf = 16-sni-session-ticket-ssl
[16-sni-session-ticket-ssl]
server = 16-sni-session-ticket-server
server2 = 16-sni-session-ticket-server2
client = 16-sni-session-ticket-client
[16-sni-session-ticket-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-sni-session-ticket-server2]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-sni-session-ticket-client]
CipherString = DEFAULT
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
ExpectedResult = Success
ServerName = server2
SessionTicketExpected = No
Reference in New Issue Copy Permalink