Commit d7254e38 authored by Neil Fuller's avatar Neil Fuller
Browse files

Improve tests for TLS fallback.

This is a small improvement over the changes that were submitted to
Android when TLS_FALLBACK_SCSV was introduced.

Previously the tests would cripple the server to use a low quality
protocol so the TLS_FALLBACK_SCSV check would pass for all connection
attempts.

Some tests for APIs not used in Android were suppressed.

This change modifies that approach. Instead it:

1) Introduces a test client socket factory that ignores any attempt
to set the TLS_FALLBACK_SCSV cipher. This means that the server will
not attempt to enforce the fallback check.
2) Pulls out some test infrastructure for use across tests.
3) Re-enables / modifies the tests that were suppressed.

The ideal solution would be to disable TLS_FALLBACK_SCSV checks in
the MockWebServer for the tests that are supposed to simulate servers
that do not perform TLS_FALLBACK_SCSV checks. However, we do not
currently have a mechanism to do this.

This change also adjusts tests that test fallback to explicitly
enable SSLv3 for server-side socket factories. The Android default
was changed to disable SSLv3 (though it is still supported). An
up-coming change should remove the need for this.

Change-Id: Ib4a57bc106928c0dd0653376341527fba7a8a00c
parent 08d4640f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment