mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-07-09 21:10:51 +02:00
Juliusz Sosinowicz
2352d73f7f
The client's resumed-session EMS (F-5807) and cipher-suite (F-5811) checks were enforced in CompleteServerHello at ServerHello-parse time. For stateless ticket resumption the client sends an empty session ID and cannot yet tell whether the server accepted the ticket (RFC 5077 3.4): a server that declines the ticket falls back to a full handshake under a freshly negotiated suite/EMS state, which these checks wrongly aborted with MATCH_SUITE_ERROR, breaking the RFC 5077 ticket-decline fallback to a full handshake. Move both checks into CheckResumptionConsistency and run it only once resumption is confirmed - from whichever the server sends first in the abbreviated flight: a renewed NewSessionTicket (before SetupSession refreshes the cached suite/EMS to the current values) or its ChangeCipherSpec. By then the "Not resuming as thought" path has cleared 'resuming' for any ticket decline, so the full-handshake fallback proceeds. Add test_tls12_resume_ticket_decline_fallback (ticket declined by a fresh server CTX, full handshake under a different suite must succeed) and gate test_tls12_resume_ticket_wrong_suite on WOLFSSL_NO_DEF_TICKET_ENC_CB so it skips rather than fails in builds without the default ticket encryption callback.
77 lines
3.9 KiB
C
77 lines
3.9 KiB
C
/* test_tls.h
|
|
*
|
|
* Copyright (C) 2006-2026 wolfSSL Inc.
|
|
*
|
|
* This file is part of wolfSSL.
|
|
*
|
|
* wolfSSL is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* wolfSSL is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
|
*/
|
|
|
|
#ifndef TESTS_API_TEST_TLS_H
|
|
#define TESTS_API_TEST_TLS_H
|
|
|
|
int test_utils_memio_move_message(void);
|
|
int test_tls12_unexpected_ccs(void);
|
|
int test_tls13_unexpected_ccs(void);
|
|
int test_tls12_curve_intersection(void);
|
|
int test_tls12_dhe_rsa_pss_sigalg(void);
|
|
int test_tls13_curve_intersection(void);
|
|
int test_tls_certreq_order(void);
|
|
int test_tls12_bad_cv_sig_alg(void);
|
|
int test_tls12_no_null_compression(void);
|
|
int test_tls12_etm_failed_resumption(void);
|
|
int test_tls12_resume_ticket_wrong_suite(void);
|
|
int test_tls12_resume_ticket_decline_fallback(void);
|
|
int test_tls_set_session_min_downgrade(void);
|
|
int test_tls12_session_id_resumption_sni_mismatch(void);
|
|
int test_tls13_session_resumption_sni_mismatch(void);
|
|
int test_tls13_resumption_with_alpn(void);
|
|
int test_tls_set_curves_list_ecc_fallback(void);
|
|
int test_tls12_corrupted_finished(void);
|
|
int test_tls12_peerauth_failsafe(void);
|
|
int test_wolfSSL_alert_type_string(void);
|
|
int test_wolfSSL_alert_desc_string(void);
|
|
int test_record_size_matches_build_message(void);
|
|
int test_record_size_cache_invalidated_on_renegotiation(void);
|
|
|
|
#define TEST_TLS_DECLS \
|
|
TEST_DECL_GROUP("tls", test_utils_memio_move_message), \
|
|
TEST_DECL_GROUP("tls", test_tls12_unexpected_ccs), \
|
|
TEST_DECL_GROUP("tls", test_tls13_unexpected_ccs), \
|
|
TEST_DECL_GROUP("tls", test_tls12_curve_intersection), \
|
|
TEST_DECL_GROUP("tls", test_tls12_dhe_rsa_pss_sigalg), \
|
|
TEST_DECL_GROUP("tls", test_tls13_curve_intersection), \
|
|
TEST_DECL_GROUP("tls", test_tls_certreq_order), \
|
|
TEST_DECL_GROUP("tls", test_tls12_bad_cv_sig_alg), \
|
|
TEST_DECL_GROUP("tls", test_tls12_no_null_compression), \
|
|
TEST_DECL_GROUP("tls", test_tls12_etm_failed_resumption), \
|
|
TEST_DECL_GROUP("tls", test_tls12_resume_ticket_wrong_suite), \
|
|
TEST_DECL_GROUP("tls", test_tls12_resume_ticket_decline_fallback), \
|
|
TEST_DECL_GROUP("tls", test_tls_set_session_min_downgrade), \
|
|
TEST_DECL_GROUP("tls", test_tls12_session_id_resumption_sni_mismatch), \
|
|
TEST_DECL_GROUP("tls", test_tls13_session_resumption_sni_mismatch), \
|
|
TEST_DECL_GROUP("tls", test_tls13_resumption_with_alpn), \
|
|
TEST_DECL_GROUP("tls", test_tls_set_curves_list_ecc_fallback), \
|
|
TEST_DECL_GROUP("tls", test_tls12_corrupted_finished), \
|
|
TEST_DECL_GROUP("tls", test_tls12_peerauth_failsafe), \
|
|
TEST_DECL_GROUP("tls", test_wolfSSL_alert_type_string), \
|
|
TEST_DECL_GROUP("tls", test_wolfSSL_alert_desc_string), \
|
|
TEST_DECL_GROUP("tls", test_tls12_peerauth_failsafe), \
|
|
TEST_DECL_GROUP("tls", test_record_size_matches_build_message), \
|
|
TEST_DECL_GROUP("tls", \
|
|
test_record_size_cache_invalidated_on_renegotiation)
|
|
|
|
#endif /* TESTS_API_TEST_TLS_H */
|