Regress client and server can do session reuse now. Test this with

all combinations of LibreSSL, OpenSSL 1.0.2, and OpenSSL 1.1.  It
is currently disabled for TLS 1.3 as this needs more setup.

6 files changed, 220 insertions, 129 deletions

diff --git a/src/regress/lib/libssl/interop/Makefile b/src/regress/lib/libssl/interop/Makefile
index 0226cae4ab..f538f87366 100644
--- a/src/regress/lib/libssl/interop/Makefile
+++ b/src/regress/lib/libssl/interop/Makefile
@@ -1,5 +1,8 @@
-# $OpenBSD: Makefile,v 1.3 2018/11/09 06:30:41 bluhm Exp $
+# $OpenBSD: Makefile,v 1.4 2018/11/10 08:33:45 bluhm Exp $
 
-SUBDIR =        libressl openssl openssl11 cert
+SUBDIR =        libressl openssl openssl11
+# the above binaries must have been built before we can continue
+SUBDIR +=       session
+SUBDIR +=       cert
 
 .include <bsd.subdir.mk>
diff --git a/src/regress/lib/libssl/interop/client.c b/src/regress/lib/libssl/interop/client.c
index c312d7ae8a..0b5827c447 100644
--- a/src/regress/lib/libssl/interop/client.c
+++ b/src/regress/lib/libssl/interop/client.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: client.c,v 1.4 2018/11/09 06:30:41 bluhm Exp $        */
+/*      $OpenBSD: client.c,v 1.5 2018/11/10 08:33:45 bluhm Exp $        */
 /*
  * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org>
  *
@@ -35,7 +35,7 @@ void __dead
 usage(void)
 {
         fprintf(stderr,
-            "usage: client [-c] [-C CA] [-c crt -k key] host port");
+            "usage: client [-sv] [-C CA] [-c crt -k key] host port");
         exit(2);
 }
 
@@ -46,13 +46,13 @@ main(int argc, char *argv[])
         SSL_CTX *ctx;
         SSL *ssl;
         BIO *bio;
-        SSL_SESSION *session;
-        int error, verify = 0;
+        SSL_SESSION *session = NULL;
+        int error, sessionreuse = 0, verify = 0;
         char buf[256], ch;
         char *ca = NULL, *crt = NULL, *key = NULL;
         char *host_port, *host, *port;
 
-        while ((ch = getopt(argc, argv, "C:c:k:v")) != -1) {
+        while ((ch = getopt(argc, argv, "C:c:k:sv")) != -1) {
                 switch (ch) {
                 case 'C':
                         ca = optarg;
@@ -63,6 +63,10 @@ main(int argc, char *argv[])
                 case 'k':
                         key = optarg;
                         break;
+                case 's':
+                        /* multiple reueses are possible */
+                        sessionreuse++;
+                        break;
                 case 'v':
                         verify = 1;
                         break;
@@ -122,63 +126,85 @@ main(int argc, char *argv[])
         SSL_CTX_set_verify(ctx, verify ? SSL_VERIFY_PEER : SSL_VERIFY_NONE,
             verify_callback);
 
-        /* setup ssl and bio for socket operations */
-        ssl = SSL_new(ctx);
-        if (ssl == NULL)
-                err_ssl(1, "SSL_new");
-        bio = BIO_new_connect(host_port);
-        if (bio == NULL)
-                err_ssl(1, "BIO_new_connect");
-        print_ciphers(SSL_get_ciphers(ssl));
-
-        /* connect */
-        if (BIO_do_connect(bio) <= 0)
-                err_ssl(1, "BIO_do_connect");
-        printf("connect ");
-        print_sockname(bio);
-        printf("connect ");
-        print_peername(bio);
-
-        /* do ssl client handshake */
-        SSL_set_bio(ssl, bio, bio);
-        if ((error = SSL_connect(ssl)) <= 0)
-                err_ssl(1, "SSL_connect %d", error);
-
-        /* print session statistics */
-        session = SSL_get_session(ssl);
-        if (session == NULL)
-                err_ssl(1, "SSL_get_session");
-        if (SSL_SESSION_print_fp(stdout, session) <= 0)
-                err_ssl(1, "SSL_SESSION_print_fp");
-
-        /* read server greeting and write client hello over TLS connection */
-        if ((error = SSL_read(ssl, buf, 9)) <= 0)
-                err_ssl(1, "SSL_read %d", error);
-        if (error != 9)
-                errx(1, "read not 9 bytes greeting: %d", error);
-        buf[9] = '\0';
-        printf("<<< %s", buf);
-        if (fflush(stdout) != 0)
-                err(1, "fflush stdout");
-        strlcpy(buf, "hello\n", sizeof(buf));
-        printf(">>> %s", buf);
-        if (fflush(stdout) != 0)
-                err(1, "fflush stdout");
-        if ((error = SSL_write(ssl, buf, 6)) <= 0)
-                err_ssl(1, "SSL_write %d", error);
-        if (error != 6)
-                errx(1, "write not 6 bytes hello: %d", error);
-
-        /* shutdown connection */
-        if ((error = SSL_shutdown(ssl)) < 0)
-                err_ssl(1, "SSL_shutdown unidirectional %d", error);
-        if (error <= 0) {
-                if ((error = SSL_shutdown(ssl)) <= 0)
-                        err_ssl(1, "SSL_shutdown bidirectional %d", error);
+        if (sessionreuse) {
+                SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT);
         }
 
-        /* cleanup and free resources */
-        SSL_free(ssl);
+        do {
+                /* setup bio for socket operations */
+                bio = BIO_new_connect(host_port);
+                if (bio == NULL)
+                        err_ssl(1, "BIO_new_connect");
+
+                /* connect */
+                if (BIO_do_connect(bio) <= 0)
+                        err_ssl(1, "BIO_do_connect");
+                printf("connect ");
+                print_sockname(bio);
+                printf("connect ");
+                print_peername(bio);
+
+                /* do ssl client handshake */
+                ssl = SSL_new(ctx);
+                if (ssl == NULL)
+                        err_ssl(1, "SSL_new");
+                print_ciphers(SSL_get_ciphers(ssl));
+                SSL_set_bio(ssl, bio, bio);
+                /* resuse session if possible */
+                if (session != NULL) {
+                        if (SSL_set_session(ssl, session) <= 0)
+                                err_ssl(1, "SSL_set_session");
+                }
+                if ((error = SSL_connect(ssl)) <= 0)
+                        err_ssl(1, "SSL_connect %d", error);
+                printf("session %d: %s\n", sessionreuse,
+                    SSL_session_reused(ssl) ? "reuse" : "new");
+                if (fflush(stdout) != 0)
+                        err(1, "fflush stdout");
+
+                /* print session statistics */
+                if (sessionreuse) {
+                        session = SSL_get1_session(ssl);
+                        if (session == NULL)
+                                err_ssl(1, "SSL1_get_session");
+                } else {
+                        session = SSL_get_session(ssl);
+                        if (session == NULL)
+                                err_ssl(1, "SSL_get_session");
+                }
+                if (SSL_SESSION_print_fp(stdout, session) <= 0)
+                        err_ssl(1, "SSL_SESSION_print_fp");
+
+                /* read server greeting and write client hello over TLS */
+                if ((error = SSL_read(ssl, buf, 9)) <= 0)
+                        err_ssl(1, "SSL_read %d", error);
+                if (error != 9)
+                        errx(1, "read not 9 bytes greeting: %d", error);
+                buf[9] = '\0';
+                printf("<<< %s", buf);
+                if (fflush(stdout) != 0)
+                        err(1, "fflush stdout");
+                strlcpy(buf, "hello\n", sizeof(buf));
+                printf(">>> %s", buf);
+                if (fflush(stdout) != 0)
+                        err(1, "fflush stdout");
+                if ((error = SSL_write(ssl, buf, 6)) <= 0)
+                        err_ssl(1, "SSL_write %d", error);
+                if (error != 6)
+                        errx(1, "write not 6 bytes hello: %d", error);
+
+                /* shutdown connection */
+                if ((error = SSL_shutdown(ssl)) < 0)
+                        err_ssl(1, "SSL_shutdown unidirectional %d", error);
+                if (error <= 0) {
+                        if ((error = SSL_shutdown(ssl)) <= 0)
+                                err_ssl(1, "SSL_shutdown bidirectional %d",
+                                    error);
+                }
+
+                SSL_free(ssl);
+        } while (sessionreuse--);
+
         SSL_CTX_free(ctx);
 
         printf("success\n");
diff --git a/src/regress/lib/libssl/interop/openssl/Makefile b/src/regress/lib/libssl/interop/openssl/Makefile
index 5c51c029ce..80f313da3e 100644
--- a/src/regress/lib/libssl/interop/openssl/Makefile
+++ b/src/regress/lib/libssl/interop/openssl/Makefile
@@ -1,8 +1,8 @@
-# $OpenBSD: Makefile,v 1.4 2018/11/09 06:30:41 bluhm Exp $
+# $OpenBSD: Makefile,v 1.5 2018/11/10 08:33:45 bluhm Exp $
 
 .if ! exists(/usr/local/bin/eopenssl)
 regress:
-        # install openssl-1.0.2p from ports for interop tests
+        # install openssl-1.0.2 from ports for interop tests
         @echo SKIPPED
 .endif
 
diff --git a/src/regress/lib/libssl/interop/openssl11/Makefile b/src/regress/lib/libssl/interop/openssl11/Makefile
index ec6f6db7ec..ef625dffb8 100644
--- a/src/regress/lib/libssl/interop/openssl11/Makefile
+++ b/src/regress/lib/libssl/interop/openssl11/Makefile
@@ -1,8 +1,8 @@
-# $OpenBSD: Makefile,v 1.3 2018/11/09 06:30:41 bluhm Exp $
+# $OpenBSD: Makefile,v 1.4 2018/11/10 08:33:45 bluhm Exp $
 
 .if ! exists(/usr/local/bin/eopenssl11)
 regress:
-        # install openssl-1.1.1 from ports for interop tests
+        # install openssl-1.1 from ports for interop tests
         @echo SKIPPED
 .endif
 
diff --git a/src/regress/lib/libssl/interop/server.c b/src/regress/lib/libssl/interop/server.c
index 6c0c720dfe..f50f368bb1 100644
--- a/src/regress/lib/libssl/interop/server.c
+++ b/src/regress/lib/libssl/interop/server.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: server.c,v 1.4 2018/11/09 06:30:41 bluhm Exp $        */
+/*      $OpenBSD: server.c,v 1.5 2018/11/10 08:33:45 bluhm Exp $        */
 /*
  * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org>
  *
@@ -21,6 +21,7 @@
 #include <err.h>
 #include <netdb.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
@@ -35,7 +36,7 @@ void __dead
 usage(void)
 {
         fprintf(stderr,
-            "usage: server [-vv] [-C CA] [-c crt -k key] [host port]");
+            "usage: server [-svv] [-C CA] [-c crt -k key] [host port]");
         exit(2);
 }
 
@@ -45,14 +46,14 @@ main(int argc, char *argv[])
         const SSL_METHOD *method;
         SSL_CTX *ctx;
         SSL *ssl;
-        BIO *bio;
+        BIO *abio, *cbio;
         SSL_SESSION *session;
-        int error, verify = 0;
+        int error, sessionreuse = 0, verify = 0;
         char buf[256], ch;
         char *ca = NULL, *crt = NULL, *key = NULL;
         char *host_port, *host = "127.0.0.1", *port = "0";
 
-        while ((ch = getopt(argc, argv, "C:c:k:v")) != -1) {
+        while ((ch = getopt(argc, argv, "C:c:k:sv")) != -1) {
                 switch (ch) {
                 case 'C':
                         ca = optarg;
@@ -63,6 +64,10 @@ main(int argc, char *argv[])
                 case 'k':
                         key = optarg;
                         break;
+                case 's':
+                        /* multiple reueses are possible */
+                        sessionreuse++;
+                        break;
                 case 'v':
                         /* use twice to force client cert */
                         verify++;
@@ -136,74 +141,94 @@ main(int argc, char *argv[])
             SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
             verify_callback);
 
-        /* setup ssl and bio for socket operations */
-        ssl = SSL_new(ctx);
-        if (ssl == NULL)
-                err_ssl(1, "SSL_new");
-        bio = BIO_new_accept(host_port);
-        if (bio == NULL)
+        if (sessionreuse) {
+                uint32_t context;
+
+                SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER);
+                context = arc4random();
+                if (SSL_CTX_set_session_id_context(ctx,
+                    (unsigned char *)&context, sizeof(context)) <= 0)
+                        err_ssl(1, "SSL_CTX_set_session_id_context");
+        }
+
+        /* setup bio for socket operations */
+        abio = BIO_new_accept(host_port);
+        if (abio == NULL)
                 err_ssl(1, "BIO_new_accept");
-        print_ciphers(SSL_get_ciphers(ssl));
 
         /* bind, listen */
-        if (BIO_do_accept(bio) <= 0)
+        if (BIO_do_accept(abio) <= 0)
                 err_ssl(1, "BIO_do_accept setup");
         printf("listen ");
-        print_sockname(bio);
+        print_sockname(abio);
 
-        /* fork to background, set timeout, and accept */
+        /* fork to background and set timeout */
         if (daemon(1, 1) == -1)
                 err(1, "daemon");
-        if ((int)alarm(60) == -1)
+        if ((int)alarm(10) == -1)
                 err(1, "alarm");
-        if (BIO_do_accept(bio) <= 0)
-                err_ssl(1, "BIO_do_accept wait");
-        bio = BIO_pop(bio);
-        printf("accept ");
-        print_sockname(bio);
-        printf("accept ");
-        print_peername(bio);
-
-        /* do ssl server handshake */
-        SSL_set_bio(ssl, bio, bio);
-        if ((error = SSL_accept(ssl)) <= 0)
-                err_ssl(1, "SSL_accept %d", error);
-
-        /* print session statistics */
-        session = SSL_get_session(ssl);
-        if (session == NULL)
-                err_ssl(1, "SSL_get_session");
-        if (SSL_SESSION_print_fp(stdout, session) <= 0)
-                err_ssl(1, "SSL_SESSION_print_fp");
-
-        /* write server greeting and read client hello over TLS connection */
-        strlcpy(buf, "greeting\n", sizeof(buf));
-        printf(">>> %s", buf);
-        if (fflush(stdout) != 0)
-                err(1, "fflush stdout");
-        if ((error = SSL_write(ssl, buf, 9)) <= 0)
-                err_ssl(1, "SSL_write %d", error);
-        if (error != 9)
-                errx(1, "write not 9 bytes greeting: %d", error);
-        if ((error = SSL_read(ssl, buf, 6)) <= 0)
-                err_ssl(1, "SSL_read %d", error);
-        if (error != 6)
-                errx(1, "read not 6 bytes hello: %d", error);
-        buf[6] = '\0';
-        printf("<<< %s", buf);
-        if (fflush(stdout) != 0)
-                err(1, "fflush stdout");
-
-        /* shutdown connection */
-        if ((error = SSL_shutdown(ssl)) < 0)
-                err_ssl(1, "SSL_shutdown unidirectional %d", error);
-        if (error <= 0) {
-                if ((error = SSL_shutdown(ssl)) <= 0)
-                        err_ssl(1, "SSL_shutdown bidirectional %d", error);
-        }
 
-        /* cleanup and free resources */
-        SSL_free(ssl);
+        do {
+                /* accept connection */
+                if (BIO_do_accept(abio) <= 0)
+                        err_ssl(1, "BIO_do_accept wait");
+                cbio = BIO_pop(abio);
+                printf("accept ");
+                print_sockname(cbio);
+                printf("accept ");
+                print_peername(cbio);
+
+                /* do ssl server handshake */
+                ssl = SSL_new(ctx);
+                if (ssl == NULL)
+                        err_ssl(1, "SSL_new");
+                print_ciphers(SSL_get_ciphers(ssl));
+                SSL_set_bio(ssl, cbio, cbio);
+                if ((error = SSL_accept(ssl)) <= 0)
+                        err_ssl(1, "SSL_accept %d", error);
+                printf("session %d: %s\n", sessionreuse,
+                    SSL_session_reused(ssl) ? "reuse" : "new");
+                if (fflush(stdout) != 0)
+                        err(1, "fflush stdout");
+
+
+                /* print session statistics */
+                session = SSL_get_session(ssl);
+                if (session == NULL)
+                        err_ssl(1, "SSL_get_session");
+                if (SSL_SESSION_print_fp(stdout, session) <= 0)
+                        err_ssl(1, "SSL_SESSION_print_fp");
+
+                /* write server greeting and read client hello over TLS */
+                strlcpy(buf, "greeting\n", sizeof(buf));
+                printf(">>> %s", buf);
+                if (fflush(stdout) != 0)
+                        err(1, "fflush stdout");
+                if ((error = SSL_write(ssl, buf, 9)) <= 0)
+                        err_ssl(1, "SSL_write %d", error);
+                if (error != 9)
+                        errx(1, "write not 9 bytes greeting: %d", error);
+                if ((error = SSL_read(ssl, buf, 6)) <= 0)
+                        err_ssl(1, "SSL_read %d", error);
+                if (error != 6)
+                        errx(1, "read not 6 bytes hello: %d", error);
+                buf[6] = '\0';
+                printf("<<< %s", buf);
+                if (fflush(stdout) != 0)
+                        err(1, "fflush stdout");
+
+                /* shutdown connection */
+                if ((error = SSL_shutdown(ssl)) < 0)
+                        err_ssl(1, "SSL_shutdown unidirectional %d", error);
+                if (error <= 0) {
+                        if ((error = SSL_shutdown(ssl)) <= 0)
+                                err_ssl(1, "SSL_shutdown bidirectional %d",
+                                    error);
+                }
+
+                SSL_free(ssl);
+        } while (sessionreuse--);
+
         SSL_CTX_free(ctx);
 
         printf("success\n");
diff --git a/src/regress/lib/libssl/interop/session/Makefile b/src/regress/lib/libssl/interop/session/Makefile
new file mode 100644
index 0000000000..a555f133fb
--- /dev/null
+++ b/src/regress/lib/libssl/interop/session/Makefile
@@ -0,0 +1,37 @@
+# $OpenBSD: Makefile,v 1.1 2018/11/10 08:33:45 bluhm Exp $
+
+run-client-openssl11-reuse-server-openssl11-reuse:
+        @echo '\n======== $@ ========'
+        # TLS 1.3 needs some extra setup for session reuse
+        @echo DISABLED
+
+CLEANFILES +=           *.out
+
+.for clib in libressl openssl openssl11
+.for slib in libressl openssl openssl11
+
+REGRESS_TARGETS +=      run-client-${clib}-reuse-server-${slib}-reuse
+
+run-client-${clib}-reuse-server-${slib}-reuse: 127.0.0.1.crt
+        @echo '\n======== $@ ========'
+        LD_LIBRARY_PATH=/usr/local/lib/e${slib} \
+            ../${slib}/server >server-${slib}-reuse.out \
+            -ss \
+            127.0.0.1 0
+        LD_LIBRARY_PATH=/usr/local/lib/e${clib} \
+            ../${clib}/client >client-${clib}-reuse.out \
+            -ss \
+            `sed -n 's/listen sock: //p' server-${slib}-reuse.out`
+        grep '^success$$' server-${slib}-reuse.out
+        grep '^success$$' client-${clib}-reuse.out
+        grep '^session 2: new$$' server-${slib}-reuse.out
+        grep '^session 2: new$$' client-${clib}-reuse.out
+        grep '^session 1: reuse$$' server-${slib}-reuse.out
+        grep '^session 1: reuse$$' client-${clib}-reuse.out
+        grep '^session 0: reuse$$' server-${slib}-reuse.out
+        grep '^session 0: reuse$$' client-${clib}-reuse.out
+
+.endfor
+.endfor
+
+.include <bsd.regress.mk>