From 830407e88f9d40d954356c3754f2647f91d5c06a Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 17:26:00 +0200 Subject: Adding upstream version 5.6.0. Signed-off-by: Daniel Baumann --- tests/pytests/test_rehandshake.py | 52 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 tests/pytests/test_rehandshake.py (limited to 'tests/pytests/test_rehandshake.py') diff --git a/tests/pytests/test_rehandshake.py b/tests/pytests/test_rehandshake.py new file mode 100644 index 0000000..f07ba58 --- /dev/null +++ b/tests/pytests/test_rehandshake.py @@ -0,0 +1,52 @@ +# SPDX-License-Identifier: GPL-3.0-or-later +"""TLS rehandshake test + +Test is using TLS proxy with rehandshake. When queries are sent, they are +simply forwarded. When the responses are sent back, a rehandshake is performed +after every 8 bytes. + +It is expected the answer will be received by the source kresd instance +and sent back to the client (this test). +""" + +import re +import time + +import pytest + +from proxy import HINTS, kresd_tls_client, resolve_hint, TLSProxy + + +def verify_rehandshake(tmpdir, proxy): + with kresd_tls_client(str(tmpdir), proxy) as kresd: + sock2 = kresd.ip_tcp_socket() + try: + for hint in HINTS: + resolve_hint(sock2, hint) + time.sleep(0.1) + finally: + # verify log + n_connecting_to = 0 + n_rehandshake = 0 + partial_log = kresd.partial_log() + print(partial_log) + for line in partial_log.splitlines(): + if re.search(r"connecting to: .*", line) is not None: + n_connecting_to += 1 + elif re.search(r"TLS rehandshake .* has started", line) is not None: + n_rehandshake += 1 + assert n_connecting_to == 1 # should connect exactly once + assert n_rehandshake > 0 + + +def test_proxy_rehandshake_tls12(tmpdir): + proxy = TLSProxy(rehandshake=True) + verify_rehandshake(tmpdir, proxy) + + +# TODO fix TLS v1.3 proxy / kresd rehandshake +@pytest.mark.xfail( + reason="TLS 1.3 rehandshake isn't properly supported either in tlsproxy or in kresd") +def test_proxy_rehandshake_tls13(tmpdir): + proxy = TLSProxy(rehandshake=True, force_tls13=True) + verify_rehandshake(tmpdir, proxy) -- cgit v1.2.3