aws / aws/s2n-tls

Add LibreSSL/BoringSSL to integration test PR batches

Open
#3,953 0 comments 0 reactions 0 assignees View on GitHub
priority/low s2n-core size/small
Dominant language
C
Stars
4.8k
Forks
802
Avg merge
5d 22h
Merged PRs (30d)
33

Description

### Security issue notifications

If you discover a potential security issue in s2n we ask that you notify
AWS Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.

### Problem:

https://github.com/aws/s2n-tls/pull/3939 added an integration test that failed when s2n-tls was linked with BoringSSL and LibreSSL: https://github.com/aws/s2n-tls/pull/3951. The integration test batch for PRs doesn't build s2n-tls with BoringSSL or LibreSSL, so this failure was caught during the release. We should consider adding BoringSSL and/or LibreSSL as s2n-tls libcrypto targets in the integration PR batch to catch failures like these earlier.

### Solution:

Add BoringSSL/LibreSSL to the integration PR CodeBuild batch.

* **Does this change what S2N sends over the wire?** If yes, explain.
* **Does this change any public APIs?** If yes, explain.
* **Which versions of TLS will this impact?**

### Requirements / Acceptance Criteria:

What must a solution address in order to solve the problem? How do we know the solution is complete?

* **RFC links:** Links to relevant RFC(s)
* **Related Issues:** Link any relevant issues
* **Will the Usage Guide or other documentation need to be updated?**
* **Testing:** How will this change be tested? Call out new integration tests, functional tests, or particularly interesting/important unit tests.
* **Will this change trigger SAW changes?** Changes to the state machine, the s2n_handshake_io code that controls state transitions, the DRBG, or the corking/uncorking logic could trigger SAW failures.
* **Should this change be fuzz tested?** Will it handle untrusted input? Create a separate issue to track the fuzzing work.

### Out of scope:

Is there anything the solution will intentionally NOT address?

[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

Contributor guide

Open the contributing guide

Research direction

Review the integration PR CodeBuild batch configuration and the failures described in pull requests #3939 and #3951. Add BoringSSL and LibreSSL as targets, then confirm the batch builds and runs the integration tests against both libraries.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
build-system, ci-cd, testing-qa
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.