-
Notifications
You must be signed in to change notification settings - Fork 38
4.x: Introduce integration test for TLS session tickets #593
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: scylla-4.x
Are you sure you want to change the base?
4.x: Introduce integration test for TLS session tickets #593
Conversation
Adds isolated SessionTicketsIT which checks if session tickets mechanism behaves as expected. It does that by watching Java's SSL debug logs and ensuring that specific substrings appear in them. Since the server supports tickets with TLSv1.3, only that version is tested. In that version the session resumption without server-side state is done through pre-shared keys. The details are described in rfc8446 (see section 2.2).
Tested with Java 8, 11 and 17. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Way to test counters is prone to failure, if connection is re-estalished during the test (I have seen it happening), counters will drift and you going to get false-positive.
To test that TLS tickets work properly you need to establish connection, then break it and then check if ticket was reused, don't see it is happening here.
integration-tests/src/test/java/com/datastax/oss/driver/core/ssl/SessionTicketsIT.java
Show resolved
Hide resolved
I don't think the false positive (test passing when it should not) is possible here, but false negative is.
There are 5 resumptions and 6 handshakes happening in this test. I can make the checks more explicit by tracking the ticket data from the logs and match it against what is reported to be received through NewSessionTicket messages. |
https://en.wikipedia.org/wiki/False_positives_and_false_negatives :
I’m totally fine with it, unless there’s a better way—which there isn’t.
Given the fact that |
Adds isolated SessionTicketsIT which checks if session tickets mechanism behaves as expected. It does that by watching Java's SSL debug logs and ensuring that specific substrings appear in them.
Since the server supports tickets with TLSv1.3, only that version is tested. In that version the session resumption without server-side state is done through pre-shared keys. The details are described in rfc8446 (see section 2.2).