crypto/tls: fix Config.Time in tests using expired certificates

Fixes #71077

Change-Id: I6a6a465685f3bd50a5bb35a160f87b59b74fa6af
Reviewed-on: https://go-review.googlesource.com/c/go/+/639655
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Damien Neil <dneil@google.com>
Reviewed-by: Joel Sing <joel@sing.id.au>
Reviewed-by: Ian Lance Taylor <iant@google.com>

diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go
index bb164bba553f43569f002f5bd51e291da746c1c7..bc54475fa4b6d261b6b2851f39b26b224ae52560 100644 (file)
--- a/src/crypto/tls/handshake_client_test.go
+++ b/src/crypto/tls/handshake_client_test.go
@@ -856,6 +856,7 @@ func testResumption(t *testing.T, version uint16) {
                MaxVersion:   version,
                CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384},
                Certificates: testCertificates,
+               Time:         testTime,
        }
 
        issuer, err := x509.ParseCertificate(testRSA2048CertificateIssuer)
@@ -872,6 +873,7 @@ func testResumption(t *testing.T, version uint16) {
                ClientSessionCache: NewLRUClientSessionCache(32),
                RootCAs:            rootCAs,
                ServerName:         "example.golang",
+               Time:               testTime,
        }
 
        testResumeState := func(test string, didResume bool) {
@@ -918,7 +920,7 @@ func testResumption(t *testing.T, version uint16) {
 
        // An old session ticket is replaced with a ticket encrypted with a fresh key.
        ticket = getTicket()
-       serverConfig.Time = func() time.Time { return time.Now().Add(24*time.Hour + time.Minute) }
+       serverConfig.Time = func() time.Time { return testTime().Add(24*time.Hour + time.Minute) }
        testResumeState("ResumeWithOldTicket", true)
        if bytes.Equal(ticket, getTicket()) {
                t.Fatal("old first ticket matches the fresh one")
@@ -926,13 +928,13 @@ func testResumption(t *testing.T, version uint16) {
 
        // Once the session master secret is expired, a full handshake should occur.
        ticket = getTicket()
-       serverConfig.Time = func() time.Time { return time.Now().Add(24*8*time.Hour + time.Minute) }
+       serverConfig.Time = func() time.Time { return testTime().Add(24*8*time.Hour + time.Minute) }
        testResumeState("ResumeWithExpiredTicket", false)
        if bytes.Equal(ticket, getTicket()) {
                t.Fatal("expired first ticket matches the fresh one")
        }
 
-       serverConfig.Time = func() time.Time { return time.Now() } // reset the time back
+       serverConfig.Time = testTime // reset the time back
        key1 := randomKey()
        serverConfig.SetSessionTicketKeys([][32]byte{key1})
 
@@ -949,11 +951,11 @@ func testResumption(t *testing.T, version uint16) {
        testResumeState("KeyChangeFinish", true)
 
        // Age the session ticket a bit, but not yet expired.
-       serverConfig.Time = func() time.Time { return time.Now().Add(24*time.Hour + time.Minute) }
+       serverConfig.Time = func() time.Time { return testTime().Add(24*time.Hour + time.Minute) }
        testResumeState("OldSessionTicket", true)
        ticket = getTicket()
        // Expire the session ticket, which would force a full handshake.
-       serverConfig.Time = func() time.Time { return time.Now().Add(24*8*time.Hour + time.Minute) }
+       serverConfig.Time = func() time.Time { return testTime().Add(24*8*time.Hour + 2*time.Minute) }
        testResumeState("ExpiredSessionTicket", false)
        if bytes.Equal(ticket, getTicket()) {
                t.Fatal("new ticket wasn't provided after old ticket expired")
@@ -961,7 +963,7 @@ func testResumption(t *testing.T, version uint16) {
 
        // Age the session ticket a bit at a time, but don't expire it.
        d := 0 * time.Hour
-       serverConfig.Time = func() time.Time { return time.Now().Add(d) }
+       serverConfig.Time = func() time.Time { return testTime().Add(d) }
        deleteTicket()
        testResumeState("GetFreshSessionTicket", false)
        for i := 0; i < 13; i++ {
@@ -972,7 +974,7 @@ func testResumption(t *testing.T, version uint16) {
        // handshake occurs for TLS 1.2. Resumption should still occur for
        // TLS 1.3 since the client should be using a fresh ticket sent over
        // by the server.
-       d += 12 * time.Hour
+       d += 12*time.Hour + time.Minute
        if version == VersionTLS13 {
                testResumeState("ExpiredSessionTicket", true)
        } else {
@@ -988,6 +990,7 @@ func testResumption(t *testing.T, version uint16) {
                MaxVersion:   version,
                CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384},
                Certificates: testCertificates,
+               Time:         testTime,
        }
        serverConfig.SetSessionTicketKeys([][32]byte{key2})
 
@@ -1013,6 +1016,7 @@ func testResumption(t *testing.T, version uint16) {
                        CurvePreferences: []CurveID{CurveP521, CurveP384, CurveP256},
                        MaxVersion:       version,
                        Certificates:     testCertificates,
+                       Time:             testTime,
                }
                testResumeState("InitialHandshake", false)
                testResumeState("WithHelloRetryRequest", true)
@@ -1022,6 +1026,7 @@ func testResumption(t *testing.T, version uint16) {
                        MaxVersion:   version,
                        CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384},
                        Certificates: testCertificates,
+                       Time:         testTime,
                }
        }
 
@@ -1743,6 +1748,7 @@ func testVerifyConnection(t *testing.T, version uint16) {
                serverConfig := &Config{
                        MaxVersion:   version,
                        Certificates: testCertificates,
+                       Time:         testTime,
                        ClientCAs:    rootCAs,
                        NextProtos:   []string{"protocol1"},
                }
@@ -1756,6 +1762,7 @@ func testVerifyConnection(t *testing.T, version uint16) {
                        RootCAs:            rootCAs,
                        ServerName:         "example.golang",
                        Certificates:       testCertificates,
+                       Time:               testTime,
                        NextProtos:         []string{"protocol1"},
                }
                test.configureClient(clientConfig, &clientCalled)
@@ -1799,8 +1806,6 @@ func testVerifyPeerCertificate(t *testing.T, version uint16) {
        rootCAs := x509.NewCertPool()
        rootCAs.AddCert(issuer)
 
-       now := func() time.Time { return time.Unix(1476984729, 0) }
-
        sentinelErr := errors.New("TestVerifyPeerCertificate")
 
        verifyPeerCertificateCallback := func(called *bool, rawCerts [][]byte, validatedChains [][]*x509.Certificate) error {
@@ -2046,7 +2051,7 @@ func testVerifyPeerCertificate(t *testing.T, version uint16) {
                        config.ServerName = "example.golang"
                        config.ClientAuth = RequireAndVerifyClientCert
                        config.ClientCAs = rootCAs
-                       config.Time = now
+                       config.Time = testTime
                        config.MaxVersion = version
                        config.Certificates = make([]Certificate, 1)
                        config.Certificates[0].Certificate = [][]byte{testRSA2048Certificate}
@@ -2064,7 +2069,7 @@ func testVerifyPeerCertificate(t *testing.T, version uint16) {
                config.Certificates = []Certificate{{Certificate: [][]byte{testRSA2048Certificate}, PrivateKey: testRSA2048PrivateKey}}
                config.ServerName = "example.golang"
                config.RootCAs = rootCAs
-               config.Time = now
+               config.Time = testTime
                config.MaxVersion = version
                test.configureClient(config, &clientCalled)
                clientErr := Client(c, config).Handshake()
@@ -2379,7 +2384,7 @@ func testGetClientCertificate(t *testing.T, version uint16) {
                serverConfig.RootCAs = x509.NewCertPool()
                serverConfig.RootCAs.AddCert(issuer)
                serverConfig.ClientCAs = serverConfig.RootCAs
-               serverConfig.Time = func() time.Time { return time.Unix(1476984729, 0) }
+               serverConfig.Time = testTime
                serverConfig.MaxVersion = version
 
                clientConfig := testConfig.Clone()
@@ -2562,6 +2567,7 @@ func testResumptionKeepsOCSPAndSCT(t *testing.T, ver uint16) {
                ClientSessionCache: NewLRUClientSessionCache(32),
                ServerName:         "example.golang",
                RootCAs:            roots,
+               Time:               testTime,
        }
        serverConfig := testConfig.Clone()
        serverConfig.Certificates = []Certificate{{Certificate: [][]byte{testRSA2048Certificate}, PrivateKey: testRSA2048PrivateKey}}

diff --git a/src/crypto/tls/handshake_server_test.go b/src/crypto/tls/handshake_server_test.go
index 29a802d54b2ddac0a179663b049d4e93b862dd00..f533023afba5b991e68eb3c15c9a70046c0faf98 100644 (file)
--- a/src/crypto/tls/handshake_server_test.go
+++ b/src/crypto/tls/handshake_server_test.go
@@ -519,6 +519,7 @@ func testCrossVersionResume(t *testing.T, version uint16) {
        serverConfig := &Config{
                CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
                Certificates: testConfig.Certificates,
+               Time:         testTime,
        }
        clientConfig := &Config{
                CipherSuites:       []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
@@ -526,6 +527,7 @@ func testCrossVersionResume(t *testing.T, version uint16) {
                ClientSessionCache: NewLRUClientSessionCache(1),
                ServerName:         "servername",
                MinVersion:         VersionTLS12,
+               Time:               testTime,
        }
 
        // Establish a session at TLS 1.3.

diff --git a/src/crypto/tls/handshake_test.go b/src/crypto/tls/handshake_test.go
index 5a9c24fb83ee6a26842aca91b70abb6e51b0292f..ea8ac6fc837ae780329472c0412d15e6f0dfbaec 100644 (file)
--- a/src/crypto/tls/handshake_test.go
+++ b/src/crypto/tls/handshake_test.go
@@ -522,6 +522,11 @@ func fromHex(s string) []byte {
        return b
 }
 
+// testTime is 2016-10-20T17:32:09.000Z, which is within the validity period of
+// [testRSACertificate], [testRSACertificateIssuer], [testRSA2048Certificate],
+// [testRSA2048CertificateIssuer], and [testECDSACertificate].
+var testTime = func() time.Time { return time.Unix(1476984729, 0) }
+
 var testRSACertificate = fromHex("3082024b308201b4a003020102020900e8f09d3fe25beaa6300d06092a864886f70d01010b0500301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f74301e170d3136303130313030303030305a170d3235303130313030303030305a301a310b3009060355040a1302476f310b300906035504031302476f30819f300d06092a864886f70d010101050003818d0030818902818100db467d932e12270648bc062821ab7ec4b6a25dfe1e5245887a3647a5080d92425bc281c0be97799840fb4f6d14fd2b138bc2a52e67d8d4099ed62238b74a0b74732bc234f1d193e596d9747bf3589f6c613cc0b041d4d92b2b2423775b1c3bbd755dce2054cfa163871d1e24c4f31d1a508baab61443ed97a77562f414c852d70203010001a38193308190300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030106082b06010505070302300c0603551d130101ff0402300030190603551d0e041204109f91161f43433e49a6de6db680d79f60301b0603551d230414301280104813494d137e1631bba301d5acab6e7b30190603551d1104123010820e6578616d706c652e676f6c616e67300d06092a864886f70d01010b0500038181009d30cc402b5b50a061cbbae55358e1ed8328a9581aa938a495a1ac315a1a84663d43d32dd90bf297dfd320643892243a00bccf9c7db74020015faad3166109a276fd13c3cce10c5ceeb18782f16c04ed73bbb343778d0c1cf10fa1d8408361c94c722b9daedb4606064df4c1b33ec0d1bd42d4dbfe3d1360845c21d33be9fae7")
 
 var testRSACertificateIssuer = fromHex("3082021930820182a003020102020900ca5e4e811a965964300d06092a864886f70d01010b0500301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f74301e170d3136303130313030303030305a170d3235303130313030303030305a301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100d667b378bb22f34143b6cd2008236abefaf2852adf3ab05e01329e2c14834f5105df3f3073f99dab5442d45ee5f8f57b0111c8cb682fbb719a86944eebfffef3406206d898b8c1b1887797c9c5006547bb8f00e694b7a063f10839f269f2c34fff7a1f4b21fbcd6bfdfb13ac792d1d11f277b5c5b48600992203059f2a8f8cc50203010001a35d305b300e0603551d0f0101ff040403020204301d0603551d250416301406082b0601050507030106082b06010505070302300f0603551d130101ff040530030101ff30190603551d0e041204104813494d137e1631bba301d5acab6e7b300d06092a864886f70d01010b050003818100c1154b4bab5266221f293766ae4138899bd4c5e36b13cee670ceeaa4cbdf4f6679017e2fe649765af545749fe4249418a56bd38a04b81e261f5ce86b8d5c65413156a50d12449554748c59a30c515bc36a59d38bddf51173e899820b282e40aa78c806526fd184fb6b4cf186ec728edffa585440d2b3225325f7ab580e87dd76")

diff --git a/src/crypto/tls/tls_test.go b/src/crypto/tls/tls_test.go
index 51cd2b91bdb7545acf0aae5371e729bcdc965ef1..76a9a222a94bd74b5251e08fa72e0e0f28dfd3f6 100644 (file)
--- a/src/crypto/tls/tls_test.go
+++ b/src/crypto/tls/tls_test.go
@@ -1158,8 +1158,6 @@ func TestConnectionState(t *testing.T) {
        rootCAs := x509.NewCertPool()
        rootCAs.AddCert(issuer)
 
-       now := func() time.Time { return time.Unix(1476984729, 0) }
-
        const alpnProtocol = "golang"
        const serverName = "example.golang"
        var scts = [][]byte{[]byte("dummy sct 1"), []byte("dummy sct 2")}
@@ -1175,7 +1173,7 @@ func TestConnectionState(t *testing.T) {
                }
                t.Run(name, func(t *testing.T) {
                        config := &Config{
-                               Time:         now,
+                               Time:         testTime,
                                Rand:         zeroSource{},
                                Certificates: make([]Certificate, 1),
                                MaxVersion:   v,
@@ -1810,7 +1808,7 @@ func testVerifyCertificates(t *testing.T, version uint16) {
                        var serverVerifyPeerCertificates, clientVerifyPeerCertificates bool
 
                        clientConfig := testConfig.Clone()
-                       clientConfig.Time = func() time.Time { return time.Unix(1476984729, 0) }
+                       clientConfig.Time = testTime
                        clientConfig.MaxVersion = version
                        clientConfig.MinVersion = version
                        clientConfig.RootCAs = rootCAs