|
 |
9c6c51 |
From 1e693fc723a8309b243b74c5baa7b7f0682d52f7 Mon Sep 17 00:00:00 2001
|
|
|
9c6c51 |
Message-Id: <1e693fc723a8309b243b74c5baa7b7f0682d52f7@dist-git>
|
|
|
9c6c51 |
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
|
|
9c6c51 |
Date: Wed, 18 Jul 2018 19:21:06 +0100
|
|
|
9c6c51 |
Subject: [PATCH] tests: fix TLS handshake failure with TLS 1.3
|
|
|
9c6c51 |
MIME-Version: 1.0
|
|
|
9c6c51 |
Content-Type: text/plain; charset=UTF-8
|
|
|
9c6c51 |
Content-Transfer-Encoding: 8bit
|
|
|
9c6c51 |
|
|
|
9c6c51 |
When gnutls negotiates TLS 1.3 instead of 1.2, the order of messages
|
|
|
9c6c51 |
sent by the handshake changes. This exposed a logic bug in the test
|
|
|
9c6c51 |
suite which caused us to wait for the server to see handshake
|
|
|
9c6c51 |
completion, but not wait for the client to see completion. The result
|
|
|
9c6c51 |
was the client didn't receive the certificate for verification and the
|
|
|
9c6c51 |
test failed.
|
|
|
9c6c51 |
|
|
|
9c6c51 |
This is exposed in Fedora 29 rawhide which has just enabled TLS 1.3 in
|
|
|
9c6c51 |
its GNUTLS builds.
|
|
|
9c6c51 |
|
|
|
9c6c51 |
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
|
9c6c51 |
(cherry picked from commit cf92b90e3537631d5235a564f917a7a0fadac3e1)
|
|
|
9c6c51 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
9c6c51 |
---
|
|
|
9c6c51 |
tests/virnettlssessiontest.c | 2 +-
|
|
|
9c6c51 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
9c6c51 |
|
|
|
9c6c51 |
diff --git a/tests/virnettlssessiontest.c b/tests/virnettlssessiontest.c
|
|
|
9c6c51 |
index 7e85607181..375cc1bb02 100644
|
|
|
9c6c51 |
--- a/tests/virnettlssessiontest.c
|
|
|
9c6c51 |
+++ b/tests/virnettlssessiontest.c
|
|
|
9c6c51 |
@@ -180,7 +180,7 @@ static int testTLSSessionInit(const void *opaque)
|
|
|
9c6c51 |
if (rv == VIR_NET_TLS_HANDSHAKE_COMPLETE)
|
|
|
9c6c51 |
clientShake = true;
|
|
|
9c6c51 |
}
|
|
|
9c6c51 |
- } while (!clientShake && !serverShake);
|
|
|
9c6c51 |
+ } while (!clientShake || !serverShake);
|
|
|
9c6c51 |
|
|
|
9c6c51 |
|
|
|
9c6c51 |
/* Finally make sure the server validation does what
|
|
|
9c6c51 |
--
|
|
|
9c6c51 |
2.18.0
|
|
|
9c6c51 |
|