• Mingtao Yang's avatar
    Fix SSL tests due to verifier behavior changes in OpenSSL 1.1.1i · 0ab97552
    Mingtao Yang authored
    Summary:
    Some tests were relying on internal OpenSSL behavior that changed in OpenSSL
    1.1.1i.
    
    OpenSSL commit [2e06150e](https://github.com/openssl/openssl/commit/2e06150e3928daa06d5ff70c32bffad8088ebe58)
    causes additional `handshakeVer` callback invocations. If an UNABLE_TO_VERIFY_LEAF_SIGNATURE handshakeVer
    callback overrides the result to *true*, OpenSSL will now continue to perform certificate
    verifications **as if the overriden cert was the properly found root**. This means:
    
    * It is subject to certificate expiration checks, and,
    * A final `handshakeVer` callback is invoked with `preverifyOk=1` when it passes the expiration checks.
    
    Several of our tests that relied on `handshakeVer` only being called *once* broke. Since the tests
    are testing a different, higher level aspect of verification (i.e. it is not actually trying to
    test how many times `handshakeVer` is being called), I've relaxed some of the expectations to allow
    for multiple invocations.
    
    CertificateVerifier semantics were also affected. Because there is a final
    successful `handshakeVer` callback that is issued, it is not just sufficient
    to check for depth and preverifyOk before invoking the CertificateVerifier.
    
    Reviewed By: pixelb
    
    Differential Revision: D25775429
    
    fbshipit-source-id: 98d35249a623307fb1de366c498b1dbae4fabf82
    0ab97552
AsyncSSLSocketTest.h 44.8 KB