runner: Test session IDs over 32 bytes.
The session ID field cannot exceed 32 bytes, and we size various buffers
based on this. Test that our parsers correctly handle this.
Also fix the -wait-for-debugger flag. I broke it recently by removing
the statusShimStarted message.
Change-Id: I29bb177f29a79bb4904fb5ba3cedfb0b6b856061
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/48907
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/ssl/test/runner/common.go b/ssl/test/runner/common.go
index 782eb36..809ed1f 100644
--- a/ssl/test/runner/common.go
+++ b/ssl/test/runner/common.go
@@ -1011,6 +1011,10 @@
// normally expected to look ahead for ChangeCipherSpec.)
EmptyTicketSessionID bool
+ // NewSessionIDLength, if non-zero is the length of the session ID to use
+ // when issung new sessions.
+ NewSessionIDLength int
+
// SendClientHelloSessionID, if not nil, is the session ID sent in the
// ClientHello.
SendClientHelloSessionID []byte
diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go
index b9d7667..1464944 100644
--- a/ssl/test/runner/handshake_server.go
+++ b/ssl/test/runner/handshake_server.go
@@ -1849,7 +1849,11 @@
// Generate a session ID if we're to save the session.
if !hs.hello.extensions.ticketSupported && config.ServerSessionCache != nil {
- hs.hello.sessionID = make([]byte, 32)
+ l := config.Bugs.NewSessionIDLength
+ if l == 0 {
+ l = 32
+ }
+ hs.hello.sessionID = make([]byte, l)
if _, err := io.ReadFull(config.rand(), hs.hello.sessionID); err != nil {
c.sendAlert(alertInternalError)
return errors.New("tls: short read from Rand: " + err.Error())
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 3306c88..03dcbf1 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -1636,6 +1636,7 @@
if err != nil {
return err
}
+ statusChan <- statusMsg{test: test, statusType: statusShimStarted, pid: shim.cmd.Process.Pid}
defer shim.close()
localErr := doExchanges(test, shim, resumeCount, &transcripts)
@@ -13277,7 +13278,7 @@
testCases = append(testCases, testCase{
testType: serverTest,
- name: "ShortSessionID-TLS13",
+ name: "Server-ShortSessionID-TLS13",
config: Config{
MaxVersion: VersionTLS13,
Bugs: ProtocolBugs{
@@ -13288,7 +13289,7 @@
testCases = append(testCases, testCase{
testType: serverTest,
- name: "FullSessionID-TLS13",
+ name: "Server-FullSessionID-TLS13",
config: Config{
MaxVersion: VersionTLS13,
Bugs: ProtocolBugs{
@@ -13297,6 +13298,62 @@
},
})
+ // The server should reject ClientHellos whose session IDs are too long.
+ testCases = append(testCases, testCase{
+ testType: serverTest,
+ name: "Server-TooLongSessionID-TLS13",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ Bugs: ProtocolBugs{
+ SendClientHelloSessionID: make([]byte, 33),
+ },
+ },
+ shouldFail: true,
+ expectedError: ":DECODE_ERROR:",
+ expectedLocalError: "remote error: error decoding message",
+ })
+ testCases = append(testCases, testCase{
+ testType: serverTest,
+ name: "Server-TooLongSessionID-TLS12",
+ config: Config{
+ MaxVersion: VersionTLS12,
+ Bugs: ProtocolBugs{
+ SendClientHelloSessionID: make([]byte, 33),
+ },
+ },
+ shouldFail: true,
+ expectedError: ":DECODE_ERROR:",
+ expectedLocalError: "remote error: error decoding message",
+ })
+
+ // Test that the client correctly accepts or rejects short session IDs from
+ // the server. Our tests use 32 bytes by default, so the boundary condition
+ // is already covered.
+ testCases = append(testCases, testCase{
+ name: "Client-ShortSessionID",
+ config: Config{
+ MaxVersion: VersionTLS12,
+ SessionTicketsDisabled: true,
+ Bugs: ProtocolBugs{
+ NewSessionIDLength: 1,
+ },
+ },
+ resumeSession: true,
+ })
+ testCases = append(testCases, testCase{
+ name: "Client-TooLongSessionID",
+ config: Config{
+ MaxVersion: VersionTLS12,
+ SessionTicketsDisabled: true,
+ Bugs: ProtocolBugs{
+ NewSessionIDLength: 33,
+ },
+ },
+ shouldFail: true,
+ expectedError: ":DECODE_ERROR:",
+ expectedLocalError: "remote error: error decoding message",
+ })
+
// Test that the client sends a fake session ID in TLS 1.3. We cover both
// normal and resumption handshakes to capture interactions with the
// session resumption path.
