Improve TLS 1.3 resumption/version tests.
Some version mismatch cases were not being covered due to TLS 1.2 and
TLS 1.3 having very different spellings for tickets resumption. Also
explicitly test that TLS 1.2 tickets aren't offered in the TLS 1.3 slot
and vice versa.
Change-Id: Ibe58386ea2004fb3c1af19342b8d808f13f737a9
Reviewed-on: https://boringssl-review.googlesource.com/10183
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index d064919..75b421e 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -4884,17 +4884,23 @@
config: Config{
MaxVersion: sessionVers.version,
CipherSuites: []uint16{cipher},
+ Bugs: ProtocolBugs{
+ ExpectNoTLS12Session: sessionVers.version >= VersionTLS13,
+ ExpectNoTLS13PSK: sessionVers.version < VersionTLS13,
+ },
},
expectedVersion: sessionVers.version,
expectedResumeVersion: resumeVers.version,
})
} else {
- var localError, error string
- if (resumeVers.version >= VersionTLS13) != (sessionVers.version >= VersionTLS13) {
- // TLS 1.3 sessions are incompatible with TLS 1.2 sessions.
- localError = "didResume is false, but we expected the opposite"
- } else {
- error = ":OLD_SESSION_VERSION_NOT_RETURNED:"
+ error := ":OLD_SESSION_VERSION_NOT_RETURNED:"
+
+ // Offering a TLS 1.3 session sends an empty session ID, so
+ // there is no way to convince a non-lookahead client the
+ // session was resumed. It will appear to the client that a
+ // stray ChangeCipherSpec was sent.
+ if resumeVers.version < VersionTLS13 && sessionVers.version >= VersionTLS13 {
+ error = ":UNEXPECTED_RECORD:"
}
testCases = append(testCases, testCase{
@@ -4910,12 +4916,11 @@
MaxVersion: resumeVers.version,
CipherSuites: []uint16{cipher},
Bugs: ProtocolBugs{
- AllowSessionVersionMismatch: true,
+ AcceptAnySession: true,
},
},
expectedResumeVersion: resumeVers.version,
shouldFail: true,
- expectedLocalError: localError,
expectedError: error,
})
}
@@ -4952,6 +4957,9 @@
resumeConfig: &Config{
MaxVersion: resumeVers.version,
CipherSuites: []uint16{cipher},
+ Bugs: ProtocolBugs{
+ SendBothTickets: true,
+ },
},
expectedResumeVersion: resumeVers.version,
})