TLS 1.3: Resumption and early data compatibility tests #8914

ronald-cron-arm · 2024-03-11T12:23:25Z

Description

Fix #6362

PR checklist

Please tick as appropriate and edit the reasons (e.g.: "backport: not needed because this is a new feature")

changelog not required, will add one for TLS 1.3 early data feature as a whole
backport not required, no TLS 1.3 support in 2.28
tests provided

programs/ssl/ssl_server2.c

…ting Signed-off-by: Ronald Cron <ronald.cron@arm.com>

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

Eventually we do not support early data with external PSK thus no point to do a positive test on that basis. Signed-off-by: Ronald Cron <ronald.cron@arm.com>

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

Move m->m resumption tests just before resumption and early data tests against GnuTLS and OpenSSL. Signed-off-by: Ronald Cron <ronald.cron@arm.com>

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ronald-cron-arm · 2024-03-15T09:32:04Z

Following the merge of #8913 yesterday I had to rebase. The rebase was quite painful but the diff between the previous head ed3916c and the new head dd2dc15 for the 3 files changed in this PR: tls13-misc.sh, ssl-opt.sh and ssl_server2.c are clean thus this should be okay.

tom-cosgrove-arm · 2024-03-15T11:51:10Z

Is the CI failure something to worry about? It's on the Internal CI only.

[2024-03-15T10:40:11.134Z] TLS 1.2: Check rsa_pss_rsae compatibility issue, m->O .................. tests/ssl-opt.sh: 1153: kill: No such process
[2024-03-15T10:40:11.134Z] 
[2024-03-15T10:40:11.134Z] RETRY(client-timeout) PASS
[2024-03-15T10:40:33.022Z] TLS 1.2: Check rsa_pss_rsae compatibility issue, m->G .................. tests/ssl-opt.sh: 1153: kill: No such process
[2024-03-15T10:40:33.022Z] 
[2024-03-15T10:40:33.022Z] RETRY(client-timeout) PASS
[2024-03-15T10:40:33.584Z] TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe3072,rsa_pss_rsae_sha256 ......... PASS
[2024-03-15T10:40:34.517Z] TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe3072,rsa_pss_rsae_sha256 ......... PASS
[2024-03-15T10:40:35.444Z] TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe4096,rsa_pss_rsae_sha256 ......... PASS
[2024-03-15T10:40:36.370Z] TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe4096,rsa_pss_rsae_sha256 ......... PASS
[2024-03-15T10:40:37.736Z] TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe6144,rsa_pss_rsae_sha256 ......... PASS
[2024-03-15T10:40:39.101Z] TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe6144,rsa_pss_rsae_sha256 ......... PASS
[2024-03-15T10:40:40.988Z] TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe8192,rsa_pss_rsae_sha256 ......... PASS
[2024-03-15T10:40:43.503Z] TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe8192,rsa_pss_rsae_sha256 ......... PASS
[2024-03-15T10:40:44.064Z] TLS 1.3: no HRR in case of PSK key exchange mode ....................... PASS
[2024-03-15T10:40:44.064Z] Handshake memory usage initial (MFL 16384 - default) ................... SKIP
[2024-03-15T10:40:44.064Z] Handshake memory usage (MFL 4096) ...................................... SKIP
[2024-03-15T10:40:44.064Z] Handshake memory usage (MFL 2048) ...................................... SKIP
[2024-03-15T10:40:44.064Z] Handshake memory usage (MFL 1024) ...................................... SKIP
[2024-03-15T10:40:44.064Z] Handshake memory usage (MFL 512) ....................................... SKIP
[2024-03-15T10:40:44.064Z] ------------------------------------------------------------------------
[2024-03-15T10:40:44.064Z] FAILED (1861 / 1862 tests (98 skipped))
[2024-03-15T10:40:44.320Z] ^^^^test_full_cmake_gcc_asan_new_bignum: test: ssl-opt.sh (full config, ASan build): tests/ssl-opt.sh -> 1^^^^

tom-cosgrove-arm

LGTM, as long as the CI failure is unrelated

waleed-elmelegy-arm

Is it worth adding negative testing for max_early_data_size and ALPN with GnuTLS or is it out of scope? otherwise LGTM.

waleed-elmelegy-arm

LGTM

ronald-cron-arm · 2024-03-15T12:17:39Z

LGTM, as long as the CI failure is unrelated

The test that failed is a DTLS test "Session resume using tickets, DTLS: openssl server", that has no relation with the changes in this PR. It passes on the open CI thus I do not think we have to worry about that.

ronald-cron-arm · 2024-03-15T12:21:40Z

Is it worth adding negative testing for max_early_data_size and ALPN with GnuTLS or is it out of scope? otherwise LGTM.

That would involve setting configuration for the first handshake and then changing them when we resume. That's not really in the scope of ssl-opt.sh to me (and we have done that in test_suite_ssl).

ronald-cron-arm added enhancement needs-ci Needs to pass CI tests component-tls13 labels Mar 11, 2024

daverodgman added the priority-very-high Highest priority - prioritise this over other review work label Mar 11, 2024

ronald-cron-arm added needs-review Every commit must be reviewed by at least two team members, needs-reviewer This PR needs someone to pick it up for review and removed needs-ci Needs to pass CI tests labels Mar 11, 2024

tom-cosgrove-arm requested review from tom-cosgrove-arm and waleed-elmelegy-arm March 12, 2024 11:15

tom-cosgrove-arm reviewed Mar 12, 2024

View reviewed changes

programs/ssl/ssl_server2.c Show resolved Hide resolved

ronald-cron-arm added 10 commits March 14, 2024 20:00

ssl_server2: Split early data enablement from max_early_data_size set…

74191a5

…ting Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Group TLS 1.3 resumption and early data compat tests

f1ad73f

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Group TLS 1.3 resumption and early data m->G tests

c8d604d

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Remove redundant early data test

c893779

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Expand m->G resumption and early data tests

0521008

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Remove m->O early data test based on external PSK

47d4a52

Eventually we do not support early data with external PSK thus no point to do a positive test on that basis. Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Rework m->O resumption and early data tests

00fa13b

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Group TLS 1.3 resumption and early data G->m tests

854df13

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssp-opt.sh: Expand G->m resumption and early data tests

1ccd7a7

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Rework O->m placeholder test

820199a

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

mpg removed the needs-reviewer This PR needs someone to pick it up for review label Mar 15, 2024

ronald-cron-arm added 3 commits March 15, 2024 09:41

ssl-opt.sh: Move m->m resumption tests

3cf4145

Move m->m resumption tests just before resumption and early data tests against GnuTLS and OpenSSL. Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Rework m->m resumption tests

e739892

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ssl-opt.sh: Add m->m resumption and early data tests

dd2dc15

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

ronald-cron-arm force-pushed the resumption-early-data-compat-tests branch from ed3916c to dd2dc15 Compare March 15, 2024 09:26

tom-cosgrove-arm approved these changes Mar 15, 2024

View reviewed changes

waleed-elmelegy-arm reviewed Mar 15, 2024

View reviewed changes

waleed-elmelegy-arm approved these changes Mar 15, 2024

View reviewed changes

ronald-cron-arm added this pull request to the merge queue Mar 15, 2024

waleed-elmelegy-arm added the approved Design and code approved - may be waiting for CI or backports label Mar 15, 2024

ronald-cron-arm removed the needs-review Every commit must be reviewed by at least two team members, label Mar 15, 2024

Merged via the queue into Mbed-TLS:development with commit 0edef1c Mar 15, 2024
5 of 6 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TLS 1.3: Resumption and early data compatibility tests #8914

TLS 1.3: Resumption and early data compatibility tests #8914

ronald-cron-arm commented Mar 11, 2024 •

edited

Loading

ronald-cron-arm commented Mar 15, 2024

tom-cosgrove-arm commented Mar 15, 2024 •

edited

Loading

tom-cosgrove-arm left a comment

waleed-elmelegy-arm left a comment

waleed-elmelegy-arm left a comment

ronald-cron-arm commented Mar 15, 2024

ronald-cron-arm commented Mar 15, 2024

TLS 1.3: Resumption and early data compatibility tests #8914

TLS 1.3: Resumption and early data compatibility tests #8914

Conversation

ronald-cron-arm commented Mar 11, 2024 • edited Loading

Description

PR checklist

ronald-cron-arm commented Mar 15, 2024

tom-cosgrove-arm commented Mar 15, 2024 • edited Loading

tom-cosgrove-arm left a comment

Choose a reason for hiding this comment

waleed-elmelegy-arm left a comment

Choose a reason for hiding this comment

waleed-elmelegy-arm left a comment

Choose a reason for hiding this comment

ronald-cron-arm commented Mar 15, 2024

ronald-cron-arm commented Mar 15, 2024

ronald-cron-arm commented Mar 11, 2024 •

edited

Loading

tom-cosgrove-arm commented Mar 15, 2024 •

edited

Loading