tests: Integrationv2 Openssl provider might need versioning
- Dominant language
- C
- Stars
- 4.8k
- Forks
- 802
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 33
Description
### Security issue notifications
If you discover a potential security issue in s2n we ask that you notify
AWS Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.
### Problem:
While adding Openssl3 libcrypto to the nix devShell, observed that many integration tests, and happy_path specifically, fail under nix, while passing on our standard Ubuntu18 image.
On ubuntu18, even when we build s2n-tls against openssl3, we're testing using the openssl 1.1.1 binary for s_client. Testing under nix with the openssl3 binary for s_client fails. We may need to create a new test provider for openssl3 and make sure our flags and interaction with s_client are version aware.
```
246: [gw0] [ 2%] FAILED test_happy_path.py::test_s2n_server_happy_path[RSA_1024_SHA256-TLS1.1-P-256-S2N-OpenSSL-DHE-RSA-AES128-SHA]
```
s2nd launched with:
```
246: Command line: s2nd -X --self-service-blinding --non-blocking --key ../pems/rsa_1024_sha256_client_key.pem --cert ../pems/rsa_1024_sha256_client_cert.pem --insecure -c test_all_tls12 -T localhost 8216openssl: stdout available
246:
246: Exit code: 255
246: Stdout: Listening on localhost:8216
```
s_client launched with:
```
246: Command line: openssl s_client -connect localhost:8216 -debug -tlsextdebug -state -tls1_1 -cipher DHE-RSA-AES128-SHA -curves P-256
246: Exit code: 1
```
### Solution:
WIP
* **Does this change what S2N sends over the wire?** If yes, explain.
* **Does this change any public APIs?** If yes, explain.
* **Which versions of TLS will this impact?**
### Requirements / Acceptance Criteria:
What must a solution address in order to solve the problem? How do we know the solution is complete?
* **RFC links:** Links to relevant RFC(s)
* **Related Issues:** Link any relevant issues
* **Will the Usage Guide or other documentation need to be updated?**
* **Testing:** How will this change be tested? Call out new integration tests, functional tests, or particularly interesting/important unit tests.
* **Will this change trigger SAW changes?** Changes to the state machine, the s2n_handshake_io code that controls state transitions, the DRBG, or the corking/uncorking logic could trigger SAW failures.
* **Should this change be fuzz tested?** Will it handle untrusted input? Create a separate issue to track the fuzzing work.
### Out of scope:
Is there anything the solution will intentionally NOT address?
[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )
Contributor guide
Research direction
Start with test_happy_path.py::test_s2n_server_happy_path and reproduce the failure in the Nix devShell using the OpenSSL 3 s_client command shown. Compare the integration test provider and its flags with the Ubuntu 18 setup; done means the relevant tests pass with the supported OpenSSL versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, python
- Domain
- testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100