Git
/
testssl.sh
mirror of https://github.com/drwetter/testssl.sh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2106 from drwetter/fix_2096 

Fix "ID resumption test failed" under Darwin
This commit is contained in:
Dirk Wetter 2022-02-17 09:04:23 +01:00 committed by GitHub
parent ccef30ae8b e1711a7ccb
commit 7b38198ced
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
testssl.sh
View File

@ -6521,17 +6521,22 @@ sub_session_resumption() {
addcmd+=" $protocol"
fi
$OPENSSL s_client $(s_client_options "$STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI $addcmd -sess_out $sess_data") </dev/null &>/dev/null
$OPENSSL s_client $(s_client_options "$STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI $addcmd -sess_out $sess_data") </dev/null &>$tmpfile
ret1=$?
if [[ $ret1 -ne 0 ]]; then
debugme echo -n "Couldn't connect #1 "
return 7
# MacOS and LibreSSL return 1 here, that's why we need to check whether the handshake contains e.g. a certificate
if [[ ! $(<$tmpfile) =~ -----.*\ CERTIFICATE----- ]]; then
debugme echo -n "Couldn't connect #1 "
return 7
fi
fi
if "$byID" && [[ ! "$OSSL_NAME" =~ LibreSSL ]] && \
( [[ $OSSL_VER_MAJOR.$OSSL_VER_MINOR == 1.1.1* ]] || [[ $OSSL_VER_MAJOR == 3 ]] ) && \
[[ ! -s "$sess_data" ]]; then
# it seems OpenSSL indicates no Session ID resumption by just not generating output
debugme echo -n "No session resumption byID (empty file)"
# If we want to check the presence of session data:
# [[ ! $(<$sess_data) =~ -----.*\ SSL\ SESSION\ PARAMETERS----- ]]
ret=2
else
$OPENSSL s_client $(s_client_options "$STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI $addcmd -sess_in $sess_data") </dev/null >$tmpfile 2>$ERRFILE
@ -6541,8 +6546,10 @@ sub_session_resumption() {
[[ -s "$sess_data" ]] && echo "not empty" || echo "empty"
fi
if [[ $ret2 -ne 0 ]]; then
debugme echo -n "Couldn't connect #2 "
return 7
if [[ ! $(<$tmpfile) =~ -----.*\ CERTIFICATE----- ]]; then
debugme echo -n "Couldn't connect #2 "
return 7
fi
fi
# "Reused" indicates session material was reused, "New": not
if grep -aq "^Reused" "$tmpfile"; then
@ -6553,7 +6560,7 @@ sub_session_resumption() {
debugme echo -n "Problem with 2nd ServerHello "
fi
# Now get the line and compare the numbers "read" and "written" as a second criteria.
# If the "read" number is bigger: a new session ID was probably used
# If the "read" number is bigger: a new session ID was probably used.
rw_line="$(awk '/^SSL handshake has read/ { print $5" "$(NF-1) }' "$tmpfile" )"
rw_line=($rw_line)
if [[ "${rw_line[0]}" -gt "${rw_line[1]}" ]]; then