[DPP-572] Add ledger API test case for verifying conformance to --min-tls-version flag.

[pbatko-da]

Pull Request Checklist

• Read and understand the contribution guidelines
• Include appropriate tests
• Set a descriptive title and thorough description
• Add a reference to the issue this PR will solve, if appropriate
• Include changelog additions in one or more commit message bodies between the CHANGELOG_BEGIN and CHANGELOG_END tags
• Normal production system change, include purpose of change in description

NOTE: CI is not automatically run on non-members pull-requests for security
reasons. The reviewer will have to comment with /AzurePipelines run to
trigger the build.

[pbatko-da]

TLS1.3's testCase needs testContext to inspect it for participant hostname and port which are then used to construct a collection of gRPC channels each exercising different TLS version on the client side.

This seems like an abuse of test tool's framework where testCase's is already effectively a client over some/none TLS.
For the need of our new TLSv1.3 test case we effectively ignore that pre-made client. (We only care for it's TlsConfiguration to be able to create our own with only TLS version modified)

[mziolekda]

Maybe rather than wrapping it in test2, just use testGivenAllParticipants directly in TLSOnePointThreeIT. There is prior art with e.g. KVCommandDeduplicationBase

[pbatko-da]

Ok

[mziolekda]

Maybe rather than wrapping it in test2, just use testGivenAllParticipants directly in TLSOnePointThreeIT. There is prior art with e.g. KVCommandDeduplicationBase

[meiersi-da]

@mziolekda @pbatko-da : what do you think about also adding a test that ensures that by TLS 1.0 and TLS 1.1 connections are never allowed, which is the current recommendation. See e.g., https://docs.microsoft.com/en-us/lifecycle/announcements/transport-layer-security-1x-disablement

[pbatko-da]

This might be already covered by this test depending what exactly you have in mind.

To recap, this test checks that:

1. clients on TLSv1.3 succeed,
2. clients on TLS 1.2, 1.1 and 1.0 fail.
   (It follows that for this test to pass the server must be started in TLSv1.3 only mode.)

Do you possibly mean to add a test case that only ensures that clients on TLS 1.0 and 1.1 always fail? This would partially duplicate this test case but having just these two cases separate would mean it could be a default test case of Ledger AP Test Tool (as opposed to being optional that needs to be explicitly --included or --additionaled) .

[mziolekda]

Simon, we have decided to create a test that verifies minimum client version of 1.3. We felt that it is the only one that makes sense. If one is serious about security, should set the server to a minimum of 1.3 and that's what this test asserts.

[meiersi-da]

@mziolekda : TLS 1.3 was defined in August 2018, so is very recent in enterprise terms. TLS 1.2 has not been deprecated. I would thus not be surprised that there are users of our software that want to use TLS 1.2 instead of TLS 1.3. For these, it is very important that the actually deprecated TLS 1.0 and 1.1 versions are not accepted. See https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2 for background.

So, I believe we either decide to not support TLS 1.2 at all, or we do test that if TLS 1.2 is used, the 1.0 and 1.1 versions are not supported.

@mziolekda : how would you like to proceed?

[mziolekda]

Nice work @pbatko-da. I like it how you managed to wean the PR from the original heavy changes.