aws / aws/s2n-tls

tests: Integrationv2 Openssl provider might need versioning

Open
#3,963 1 comment 0 reactions 0 assignees View on GitHub
priority/low s2n-core size/large type/ci
Dominant language
C
Stars
4.8k
Forks
802
Avg merge
5d 22h
Merged PRs (30d)
33

Description

### Security issue notifications

If you discover a potential security issue in s2n we ask that you notify
AWS Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.

### Problem:

While adding Openssl3 libcrypto to the nix devShell, observed that many integration tests, and happy_path specifically, fail under nix, while passing on our standard Ubuntu18 image.

On ubuntu18, even when we build s2n-tls against openssl3, we're testing using the openssl 1.1.1 binary for s_client. Testing under nix with the openssl3 binary for s_client fails. We may need to create a new test provider for openssl3 and make sure our flags and interaction with s_client are version aware.

```
246: [gw0] [ 2%] FAILED test_happy_path.py::test_s2n_server_happy_path[RSA_1024_SHA256-TLS1.1-P-256-S2N-OpenSSL-DHE-RSA-AES128-SHA]
```

s2nd launched with:
```
246: Command line: s2nd -X --self-service-blinding --non-blocking --key ../pems/rsa_1024_sha256_client_key.pem --cert ../pems/rsa_1024_sha256_client_cert.pem --insecure -c test_all_tls12 -T localhost 8216openssl: stdout available
246:
246: Exit code: 255
246: Stdout: Listening on localhost:8216
```

s_client launched with:
```
246: Command line: openssl s_client -connect localhost:8216 -debug -tlsextdebug -state -tls1_1 -cipher DHE-RSA-AES128-SHA -curves P-256
246: Exit code: 1
```

### Solution:

WIP

* **Does this change what S2N sends over the wire?** If yes, explain.
* **Does this change any public APIs?** If yes, explain.
* **Which versions of TLS will this impact?**

### Requirements / Acceptance Criteria:

What must a solution address in order to solve the problem? How do we know the solution is complete?

* **RFC links:** Links to relevant RFC(s)
* **Related Issues:** Link any relevant issues
* **Will the Usage Guide or other documentation need to be updated?**
* **Testing:** How will this change be tested? Call out new integration tests, functional tests, or particularly interesting/important unit tests.
* **Will this change trigger SAW changes?** Changes to the state machine, the s2n_handshake_io code that controls state transitions, the DRBG, or the corking/uncorking logic could trigger SAW failures.
* **Should this change be fuzz tested?** Will it handle untrusted input? Create a separate issue to track the fuzzing work.

### Out of scope:

Is there anything the solution will intentionally NOT address?

[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

Contributor guide

Open the contributing guide

Research direction

Start with test_happy_path.py::test_s2n_server_happy_path and reproduce the failure in the Nix devShell using the OpenSSL 3 s_client command shown. Compare the integration test provider and its flags with the Ubuntu 18 setup; done means the relevant tests pass with the supported OpenSSL versions.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, python
Domain
testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.