kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

TLS 1.3 sessions should not be added to the server session cache.

Browse Source 
Fix this and add a test. Otherwise enabling TLS 1.3 will cause a server
to blow through its session cache.

Change-Id: I67edbc468faedfd94a6c30cf842af085a6543b50
Reviewed-on: https://boringssl-review.googlesource.com/13501
Reviewed-by: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
David Benjamin 2017-01-28 01:39:29 -05:00 committed by CQ bot account: commit-bot@chromium.org
parent c26692cfdd
commit b5c58db9ff
5 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ssl/ssl_session.c
View File

@ -493,7 +493,7 @@ int ssl_get_new_session(SSL_HANDSHAKE *hs, int is_server) {
session->timeout = ssl->session_timeout;
if (is_server) {
if (hs->ticket_expected) {
if (hs->ticket_expected || ssl3_protocol_version(ssl) >= TLS1_3_VERSION) {
/* Don't set session IDs for sessions resumed with tickets. This will keep
* them out of the session cache. */
session->session_id_length = 0;

11
ssl/test/bssl_shim.cc
View File

@ -1254,6 +1254,17 @@ static bool CheckHandshakeProperties(SSL *ssl, bool is_resume) {
}
}
if (!is_resume) {
if (config->expect_session_id && !GetTestState(ssl)->got_new_session) {
fprintf(stderr, "session was not cached on the server.\n");
return false;
}
if (config->expect_no_session_id && GetTestState(ssl)->got_new_session) {
fprintf(stderr, "session was unexpectedly cached on the server.\n");
return false;
}
}
if (config->is_server && !GetTestState(ssl)->early_callback_called) {
fprintf(stderr, "early callback not called\n");
return false;

5
ssl/test/runner/runner.go
View File

@ -3417,6 +3417,7 @@ func addStateMachineCoverageTests(config stateMachineTestConfig) {
},
},
resumeSession: true,
flags: []string{"-expect-no-session-id"},
})
tests = append(tests, testCase{
testType: serverTest,
@ -3426,6 +3427,7 @@ func addStateMachineCoverageTests(config stateMachineTestConfig) {
SessionTicketsDisabled: true,
},
resumeSession: true,
flags: []string{"-expect-session-id"},
})
tests = append(tests, testCase{
testType: serverTest,
@ -3467,6 +3469,9 @@ func addStateMachineCoverageTests(config stateMachineTestConfig) {
},
resumeSession: true,
resumeRenewedSession: true,
// TLS 1.3 uses tickets, so the session should not be
// cached statefully.
flags: []string{"-expect-no-session-id"},
})
tests = append(tests, testCase{

2
ssl/test/test_config.cc
View File

@ -123,6 +123,8 @@ const Flag<bool> kBoolFlags[] = {
&TestConfig::expect_secure_renegotiation },
{ "-expect-no-secure-renegotiation",
&TestConfig::expect_no_secure_renegotiation },
{ "-expect-session-id", &TestConfig::expect_session_id },
{ "-expect-no-session-id", &TestConfig::expect_no_session_id },
};
const Flag<std::string> kStringFlags[] = {

2
ssl/test/test_config.h
View File

@ -131,6 +131,8 @@ struct TestConfig {
bool expect_no_secure_renegotiation = false;
int max_send_fragment = 0;
int read_size = 0;
bool expect_session_id = false;
bool expect_no_session_id = false;
};
bool ParseConfig(int argc, char **argv, TestConfig *out_config);