3535
3636using testing::_;
3737using testing::DoAll;
38+ using testing::InSequence;
3839using testing::Invoke;
3940using testing::NiceMock;
4041using testing::Return;
@@ -2475,6 +2476,8 @@ TEST_P(SslSocketTest, ClientAuthCrossListenerSessionResumption) {
24752476void testClientSessionResumption (const std::string& server_ctx_yaml,
24762477 const std::string& client_ctx_yaml, bool expect_reuse,
24772478 const Network::Address::IpVersion version) {
2479+ InSequence s;
2480+
24782481 testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context;
24792482 Event::SimulatedTimeSystem time_system;
24802483 ContextManagerImpl manager (time_system);
@@ -2495,17 +2498,6 @@ void testClientSessionResumption(const std::string& server_ctx_yaml,
24952498
24962499 Network::ConnectionPtr server_connection;
24972500 Network::MockConnectionCallbacks server_connection_callbacks;
2498- EXPECT_CALL (callbacks, onAccept_ (_, _))
2499- .WillRepeatedly (Invoke ([&](Network::ConnectionSocketPtr& socket, bool ) -> void {
2500- Network::ConnectionPtr new_connection = dispatcher.createServerConnection (
2501- std::move (socket), server_ssl_socket_factory.createTransportSocket (nullptr ));
2502- callbacks.onNewConnection (std::move (new_connection));
2503- }));
2504- EXPECT_CALL (callbacks, onNewConnection_ (_))
2505- .WillRepeatedly (Invoke ([&](Network::ConnectionPtr& conn) -> void {
2506- server_connection = std::move (conn);
2507- server_connection->addConnectionCallbacks (server_connection_callbacks);
2508- }));
25092501
25102502 envoy::api::v2::auth::UpstreamTlsContext client_ctx_proto;
25112503 MessageUtil::loadFromYaml (TestEnvironment::substitute (client_ctx_yaml), client_ctx_proto);
@@ -2535,10 +2527,37 @@ void testClientSessionResumption(const std::string& server_ctx_yaml,
25352527 }
25362528 };
25372529
2538- EXPECT_CALL (client_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2539- .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2540- EXPECT_CALL (server_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2541- .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2530+ // WillRepeatedly doesn't work with InSequence.
2531+ EXPECT_CALL (callbacks, onAccept_ (_, _))
2532+ .WillOnce (Invoke ([&](Network::ConnectionSocketPtr& socket, bool ) -> void {
2533+ Network::ConnectionPtr new_connection = dispatcher.createServerConnection (
2534+ std::move (socket), server_ssl_socket_factory.createTransportSocket (nullptr ));
2535+ callbacks.onNewConnection (std::move (new_connection));
2536+ }));
2537+ EXPECT_CALL (callbacks, onNewConnection_ (_))
2538+ .WillOnce (Invoke ([&](Network::ConnectionPtr& conn) -> void {
2539+ server_connection = std::move (conn);
2540+ server_connection->addConnectionCallbacks (server_connection_callbacks);
2541+ }));
2542+
2543+ const bool expect_tls13 =
2544+ client_ctx_proto.common_tls_context ().tls_params ().tls_maximum_protocol_version () ==
2545+ envoy::api::v2::auth::TlsParameters::TLSv1_3 &&
2546+ server_ctx_proto.common_tls_context ().tls_params ().tls_maximum_protocol_version () ==
2547+ envoy::api::v2::auth::TlsParameters::TLSv1_3;
2548+
2549+ // The order of "Connected" events depends on the version of the TLS protocol (1.3 or older).
2550+ if (expect_tls13) {
2551+ EXPECT_CALL (client_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2552+ .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2553+ EXPECT_CALL (server_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2554+ .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2555+ } else {
2556+ EXPECT_CALL (server_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2557+ .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2558+ EXPECT_CALL (client_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2559+ .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2560+ }
25422561 EXPECT_CALL (server_connection_callbacks, onEvent (Network::ConnectionEvent::LocalClose))
25432562 .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { close_second_time (); }));
25442563 EXPECT_CALL (client_connection_callbacks, onEvent (Network::ConnectionEvent::RemoteClose))
@@ -2558,10 +2577,32 @@ void testClientSessionResumption(const std::string& server_ctx_yaml,
25582577 client_connection->addConnectionCallbacks (client_connection_callbacks);
25592578 client_connection->connect ();
25602579
2561- EXPECT_CALL (client_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2562- .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2563- EXPECT_CALL (server_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2564- .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2580+ // WillRepeatedly doesn't work with InSequence.
2581+ EXPECT_CALL (callbacks, onAccept_ (_, _))
2582+ .WillOnce (Invoke ([&](Network::ConnectionSocketPtr& socket, bool ) -> void {
2583+ Network::ConnectionPtr new_connection = dispatcher.createServerConnection (
2584+ std::move (socket), server_ssl_socket_factory.createTransportSocket (nullptr ));
2585+ callbacks.onNewConnection (std::move (new_connection));
2586+ }));
2587+ EXPECT_CALL (callbacks, onNewConnection_ (_))
2588+ .WillOnce (Invoke ([&](Network::ConnectionPtr& conn) -> void {
2589+ server_connection = std::move (conn);
2590+ server_connection->addConnectionCallbacks (server_connection_callbacks);
2591+ }));
2592+
2593+ // The order of "Connected" events depends on the version of the TLS protocol (1.3 or older),
2594+ // and whether or not the session was successfully resumed.
2595+ if (expect_tls13 || expect_reuse) {
2596+ EXPECT_CALL (client_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2597+ .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2598+ EXPECT_CALL (server_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2599+ .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2600+ } else {
2601+ EXPECT_CALL (server_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2602+ .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2603+ EXPECT_CALL (client_connection_callbacks, onEvent (Network::ConnectionEvent::Connected))
2604+ .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { connect_second_time (); }));
2605+ }
25652606 EXPECT_CALL (server_connection_callbacks, onEvent (Network::ConnectionEvent::LocalClose))
25662607 .WillOnce (Invoke ([&](Network::ConnectionEvent) -> void { close_second_time (); }));
25672608 EXPECT_CALL (client_connection_callbacks, onEvent (Network::ConnectionEvent::RemoteClose))
@@ -2591,8 +2632,8 @@ TEST_P(SslSocketTest, ClientSessionResumptionDefault) {
25912632 testClientSessionResumption (server_ctx_yaml, client_ctx_yaml, true , GetParam ());
25922633}
25932634
2594- // Make sure client session resumption is not happening when it's disabled.
2595- TEST_P (SslSocketTest, ClientSessionResumptionDisabled ) {
2635+ // Make sure client session resumption is not happening with TLS 1.0-1.2 when it's disabled.
2636+ TEST_P (SslSocketTest, ClientSessionResumptionDisabledTls12 ) {
25962637 const std::string server_ctx_yaml = R"EOF(
25972638 common_tls_context:
25982639 tls_certificates:
@@ -2635,6 +2676,31 @@ TEST_P(SslSocketTest, ClientSessionResumptionEnabledTls12) {
26352676 testClientSessionResumption (server_ctx_yaml, client_ctx_yaml, true , GetParam ());
26362677}
26372678
2679+ // Make sure client session resumption is not happening with TLS 1.3 when it's disabled.
2680+ TEST_P (SslSocketTest, ClientSessionResumptionDisabledTls13) {
2681+ const std::string server_ctx_yaml = R"EOF(
2682+ common_tls_context:
2683+ tls_params:
2684+ tls_minimum_protocol_version: TLSv1_3
2685+ tls_maximum_protocol_version: TLSv1_3
2686+ tls_certificates:
2687+ certificate_chain:
2688+ filename: "{{ test_tmpdir }}/unittestcert.pem"
2689+ private_key:
2690+ filename: "{{ test_tmpdir }}/unittestkey.pem"
2691+ )EOF" ;
2692+
2693+ const std::string client_ctx_yaml = R"EOF(
2694+ common_tls_context:
2695+ tls_params:
2696+ tls_minimum_protocol_version: TLSv1_3
2697+ tls_maximum_protocol_version: TLSv1_3
2698+ max_session_keys: 0
2699+ )EOF" ;
2700+
2701+ testClientSessionResumption (server_ctx_yaml, client_ctx_yaml, false , GetParam ());
2702+ }
2703+
26382704// Test client session resumption with TLS 1.3 (it's different than in older versions of TLS).
26392705TEST_P (SslSocketTest, ClientSessionResumptionEnabledTls13) {
26402706 const std::string server_ctx_yaml = R"EOF(
0 commit comments