[glib-networking/mcatanzaro/session-resumption: 10/17] Disable session resumption when running tests

[Michael Catanzaro <mcatanzaro src gnome org>]

commit eff6aa2d7c4b796a627c819cce3b3ed7c3632a1e
Author: Michael Catanzaro <mcatanzaro gnome org>
Date:   Sun Aug 18 21:07:28 2019 -0500

    Disable session resumption when running tests
    
    For several months, I've been stumped as to why our testsuite is so
    reliable when running with TLS 1.3, but flaky when running with TLS 1.2.
    The answer is session resumption. When running the tests many times
    simultaneously with 'meson test --repeat=500', the same port number may
    be reused for the server's socket within a single run of the testsuite,
    and we'll have an unexpected session resumption that causes the normal
    handshake to be skipped. This is how we wind up with certificates being
    accepted even in the garbage database test where the only trusted CA is
    an ASCII Golbat.
    
    So yeah, that's bad. I can't think of any easy way to solve this other
    than to disable session resumption when running tests. Better be really
    careful when touching the session resumption code!
    
    Because our GTlsServerConnectionGnutls only supports database storage
    for session identifiers, not session tickets, it's incompatible with TLS
    1.3, and therefore we don't have any session resumption when running the
    TLS 1.3 tests, which is why this isn't a problem in the usual case.
    (Our CI currently only tests TLS 1.3.)
    
    Note that a couple of our rehandshake tests actually do test to ensure
    session resumption occurs, though whether this is intentional or not I'm
    not sure. It's a shame to remove, because it's a nice check to have, but
    I don't see how to keep it.

 tls/gnutls/gtlsclientconnection-gnutls.c | 17 ++++++++++++++++-
 tls/tests/connection.c                   |  1 -
 2 files changed, 16 insertions(+), 2 deletions(-)
---
diff --git a/tls/gnutls/gtlsclientconnection-gnutls.c b/tls/gnutls/gtlsclientconnection-gnutls.c
index 86a4f19..31104f1 100644
--- a/tls/gnutls/gtlsclientconnection-gnutls.c
+++ b/tls/gnutls/gtlsclientconnection-gnutls.c
@@ -123,6 +123,20 @@ g_tls_client_connection_gnutls_compute_session_id (GTlsClientConnectionGnutls *g
   GInetAddress *iaddr;
   guint port;
 
+  /* The testsuite expects handshakes to actually happen. E.g. a test might
+   * check to see that a handshake succeeds and then later check that a new
+   * handshake fails. If we get really unlucky and the same port number is
+   * reused for the server socket between connections, then we'll accidentally
+   * resume the old session and skip certificate verification. Such failures
+   * are difficult to debug because they require running the tests hundreds of
+   * times simultaneously to reproduce (the port number does not get reused
+   * quickly enough if the tests are run sequentially).
+   *
+   * So session resumption will just need to be tested manually.
+   */
+  if (g_test_initialized ())
+    return;
+
   /* Create a TLS session ID. We base it on the IP address since
    * different hosts serving the same hostname/service will probably
    * not share the same session cache. We base it on the
@@ -150,7 +164,8 @@ g_tls_client_connection_gnutls_compute_session_id (GTlsClientConnectionGnutls *g
 
           /* If we have a certificate, make its hash part of the session ID, so
            * that different connections to the same server can use different
-           * certificates. */
+           * certificates.
+           */
           g_object_get (G_OBJECT (gnutls), "certificate", &cert, NULL);
           if (cert)
             {
diff --git a/tls/tests/connection.c b/tls/tests/connection.c
index 6b75aff..9cb34fb 100644
--- a/tls/tests/connection.c
+++ b/tls/tests/connection.c
@@ -971,7 +971,6 @@ on_notify_accepted_cas (GObject *obj,
                         gpointer user_data)
 {
   gboolean *changed = user_data;
-  g_assert_false (*changed);
   *changed = TRUE;
 }