diff options
author | Timur Pocheptsov <timur.pocheptsov@qt.io> | 2020-11-23 14:27:55 +0100 |
---|---|---|
committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2020-12-01 16:38:18 +0000 |
commit | 7c9cb19282cf48d81f316c0fb4650f0811deebc0 (patch) | |
tree | dc2a309cdabd1c655feb7fb5132e1b1a0e1fb4b6 /tests | |
parent | 94983639fc559fd57c6075b1323b28f034a49071 (diff) |
QDtls(cookie verifier): make sure a server can re-use 'Client Hello'
And extend an auto-test for this. When a cookie verification mechanism is
enabled, and verifier, indeed, verifies that some datagram is a 'Client Hello'
message with a proper cookie attached, we start a real DTLS handshake creating a
QDtls object and calling 'doHandshake'. In case cookie verification
was enabled, we need parameters from the verifier (it's a crypto-strong
'number' and hash algorithm) to 'lock and load' the TLS state machine in
a freshly created TLS session object. This code path previously was only
tested manually and was found by LCOV as untested.
Change-Id: Ieacb8c989997999ea10e15bda6ae106a0338b698
Reviewed-by: MÃ¥rten Nordheim <marten.nordheim@qt.io>
(cherry picked from commit 6a1d9f6fc1e46f7f0af7ec52dc5d6d415c918bf2)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
Diffstat (limited to 'tests')
-rw-r--r-- | tests/auto/network/ssl/qdtlscookie/tst_qdtlscookie.cpp | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/tests/auto/network/ssl/qdtlscookie/tst_qdtlscookie.cpp b/tests/auto/network/ssl/qdtlscookie/tst_qdtlscookie.cpp index a273ceaa17..00e4cfbe46 100644 --- a/tests/auto/network/ssl/qdtlscookie/tst_qdtlscookie.cpp +++ b/tests/auto/network/ssl/qdtlscookie/tst_qdtlscookie.cpp @@ -288,6 +288,20 @@ void tst_QDtlsCookie::verifyClient() clientPort), true); QCOMPARE(anotherListener.verifiedHello(), dgram); QCOMPARE(anotherListener.dtlsError(), QDtlsError::NoError); + + // Now, let's test if a DTLS server is able to create a new TLS session + // re-using the client's 'Hello' with a cookie inside: + QDtls session(QSslSocket::SslServerMode); + auto dtlsConf = QSslConfiguration::defaultDtlsConfiguration(); + dtlsConf.setDtlsCookieVerificationEnabled(true); + session.setDtlsConfiguration(dtlsConf); + session.setPeer(clientAddress, clientPort); + // Borrow a secret and hash algorithm: + session.setCookieGeneratorParameters(listener.cookieGeneratorParameters()); + // Trigger TLS state machine change to think it accepted a cookie and started + // a handshake: + QVERIFY(session.doHandshake(&serverSocket, dgram)); + // Now let's use a wrong port: QCOMPARE(listener.verifyClient(&serverSocket, dgram, clientAddress, serverPort), false); // Invalid cookie, no verified hello message: |