]> git.ipfire.org Git - thirdparty/haproxy.git/commit
REGTESTS: ssl: add basic 0rtt tests for TLSv1.2, TLSv1.3 and QUIC
authorWilly Tarreau <w@1wt.eu>
Wed, 19 Nov 2025 10:58:21 +0000 (11:58 +0100)
committerWilly Tarreau <w@1wt.eu>
Wed, 19 Nov 2025 21:30:21 +0000 (22:30 +0100)
commit2dc4d99cd2ae001b23138420408562845561de82
tree815f962c2fa64c75ac845f3fbd7fb5848793b66d
parentf6373a6ca841ea579b494cfd0b737956358b9ed5
REGTESTS: ssl: add basic 0rtt tests for TLSv1.2, TLSv1.3 and QUIC

These tests try all the combinations of {0,1}rtt <-> {0,1}rtt with
stateless and stateful tickets. They take into consideration the TLS
version to decide whether or not 0rtt should work. Since we cannot
use environment variables in the client, the tests are run in haproxy
itself where the frontends set a "x-early-rcvd-test" response header
that the client checks. At this stage, the test only verifies that
*some* early data were received.

Note that the tests are a bit complex because we need 4 listeners
for the various combinations of 0rtt/tickets, then we have to set
expectations based on the TLS version (1.2 vs 1.3), as well as the
session resumption status.

We have to set alpn on the server lines because currently our frontends
expect it for 0-rtt to work.
reg-tests/quic/tls13_0rtt.vtc [new file with mode: 0644]
reg-tests/ssl/ssl-0rtt.vtci [new file with mode: 0644]
reg-tests/ssl/tls12_0rtt.vtc [new file with mode: 0644]
reg-tests/ssl/tls13_0rtt.vtc [new file with mode: 0644]