1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
|
import socket
import pytest
from OpenSSL.SSL import (
TLSv1_2_METHOD,
Context,
Connection,
Session,
_lib,
)
from unit.applications.tls import TestApplicationTLS
from unit.option import option
class TestTLSTicket(TestApplicationTLS):
prerequisites = {'modules': {'openssl': 'any'}}
ticket = 'U1oDTh11mMxODuw12gS0EXX1E/PkZG13cJNQ6m5+6BGlfPTjNlIEw7PSVU3X1gTE'
ticket2 = (
'5AV0DSYIYbZWZQB7fCnTHZmMxtotb/aXjam+n2XS79lTvX3Tq9xGqpC8XKNEF2lt'
)
ticket80 = '6Pfil8lv/k8zf8MndPpfXaO5EAV6dhME6zs6CfUyq2yziynQwSywtKQMqHGnJ2HR\
49TZXi/Y4/8RSIO7QPsU51/HLR1gWIMhVM2m9yh93Bw='
@pytest.fixture(autouse=True)
def setup_method_fixture(self, request):
self.certificate()
listener_conf = {
"pass": "routes",
"tls": {
"certificate": "default",
"session": {"cache_size": 0, "tickets": True},
},
}
assert 'success' in self.conf(
{
"listeners": {
"*:7080": listener_conf,
"*:7081": listener_conf,
"*:7082": listener_conf,
},
"routes": [{"action": {"return": 200}}],
"applications": {},
}
), 'load application configuration'
def set_tickets(self, tickets=True, port=7080):
assert 'success' in self.conf(
{"cache_size": 0, "tickets": tickets},
'listeners/*:' + str(port) + '/tls/session',
)
def connect(self, ctx=None, session=None, port=7080):
sock = socket.create_connection(('127.0.0.1', port))
if ctx is None:
ctx = Context(TLSv1_2_METHOD)
client = Connection(ctx, sock)
client.set_connect_state()
if session is not None:
client.set_session(session)
client.do_handshake()
client.shutdown()
return (
client.get_session(),
ctx,
_lib.SSL_session_reused(client._ssl),
)
def has_ticket(self, sess):
return _lib.SSL_SESSION_has_ticket(sess._session)
@pytest.mark.skipif(
not hasattr(_lib, 'SSL_SESSION_has_ticket'),
reason='ticket check is not supported',
)
def test_tls_ticket(self):
sess, ctx, reused = self.connect()
assert self.has_ticket(sess), 'tickets True'
assert not reused, 'tickets True not reused'
sess, ctx, reused = self.connect(ctx, sess)
assert self.has_ticket(sess), 'tickets True reconnect'
assert reused, 'tickets True reused'
self.set_tickets(tickets=False)
sess, _, _ = self.connect()
assert not self.has_ticket(sess), 'tickets False'
assert 'success' in self.conf_delete(
'listeners/*:7080/tls/session/tickets'
), 'tickets default configure'
sess, _, _ = self.connect()
assert not self.has_ticket(sess), 'tickets default (false)'
@pytest.mark.skipif(
not hasattr(_lib, 'SSL_SESSION_has_ticket'),
reason='ticket check is not supported',
)
def test_tls_ticket_string(self):
self.set_tickets(self.ticket)
sess, ctx, _ = self.connect()
assert self.has_ticket(sess), 'tickets string'
sess2, _, reused = self.connect(ctx, sess)
assert self.has_ticket(sess2), 'tickets string reconnect'
assert reused, 'tickets string reused'
sess2, _, reused = self.connect(ctx, sess, port=7081)
assert self.has_ticket(sess2), 'connect True'
assert not reused, 'connect True not reused'
self.set_tickets(self.ticket2, port=7081)
sess2, _, reused = self.connect(ctx, sess, port=7081)
assert self.has_ticket(sess2), 'wrong ticket'
assert not reused, 'wrong ticket not reused'
self.set_tickets(self.ticket80)
sess, ctx, _ = self.connect()
assert self.has_ticket(sess), 'tickets string 80'
sess2, _, reused = self.connect(ctx, sess)
assert self.has_ticket(sess2), 'tickets string 80 reconnect'
assert reused, 'tickets string 80 reused'
sess2, _, reused = self.connect(ctx, sess, port=7081)
assert self.has_ticket(sess2), 'wrong ticket 80'
assert not reused, 'wrong ticket 80 not reused'
@pytest.mark.skipif(
not hasattr(_lib, 'SSL_SESSION_has_ticket'),
reason='ticket check is not supported',
)
def test_tls_ticket_array(self):
self.set_tickets([])
sess, ctx, _ = self.connect()
assert not self.has_ticket(sess), 'tickets array empty'
self.set_tickets([self.ticket, self.ticket2])
self.set_tickets(self.ticket, port=7081)
self.set_tickets(self.ticket2, port=7082)
sess, ctx, _ = self.connect()
_, _, reused = self.connect(ctx, sess, port=7081)
assert not reused, 'not last ticket'
_, _, reused = self.connect(ctx, sess, port=7082)
assert reused, 'last ticket'
sess, ctx, _ = self.connect(port=7081)
_, _, reused = self.connect(ctx, sess)
assert reused, 'first ticket'
sess, ctx, _ = self.connect(port=7082)
_, _, reused = self.connect(ctx, sess)
assert reused, 'second ticket'
assert 'success' in self.conf_delete(
'listeners/*:7080/tls/session/tickets/0'
), 'removed first ticket'
assert 'success' in self.conf_post(
'"' + self.ticket + '"', 'listeners/*:7080/tls/session/tickets'
), 'add new ticket to the end of array'
sess, ctx, _ = self.connect()
_, _, reused = self.connect(ctx, sess, port=7082)
assert not reused, 'not last ticket 2'
_, _, reused = self.connect(ctx, sess, port=7081)
assert reused, 'last ticket 2'
def test_tls_ticket_invalid(self):
def check_tickets(tickets):
assert 'error' in self.conf(
{"tickets": tickets}, 'listeners/*:7080/tls/session',
)
check_tickets({})
check_tickets('!?&^' * 16)
check_tickets(self.ticket[:-2] + '!' + self.ticket[3:])
check_tickets(self.ticket[:-1])
check_tickets(self.ticket + 'b')
check_tickets(self.ticket + 'blah')
check_tickets([True, self.ticket, self.ticket2])
check_tickets([self.ticket, 'blah', self.ticket2])
check_tickets([self.ticket, self.ticket2, []])
|
