Skip to content

Add basic handshake defragmentation tests in ssl-opt #9989

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 33 commits into from
Feb 28, 2025
Merged

Add basic handshake defragmentation tests in ssl-opt #9989

Changes from 1 commit
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
79a8ded
Add TLS Hanshake defragmentation tests
waleed-elmelegy-arm Jan 24, 2025
0e0d5d4
Improve TLS handshake defragmentation tests
waleed-elmelegy-arm Jan 28, 2025
c0118d8
Fix typo in TLS Handshake defrafmentation tests
waleed-elmelegy-arm Jan 29, 2025
fccd014
Remove unnecessary string check in handshake defragmentation tests
waleed-elmelegy-arm Jan 29, 2025
f912031
Require openssl to support TLS 1.3 in handshake defragmentation tests
waleed-elmelegy-arm Jan 29, 2025
48874b3
Add client authentication to handshake defragmentation tests
waleed-elmelegy-arm Jan 29, 2025
39d83dd
Remove unneeded mtu option from handshake fragmentation tests
waleed-elmelegy-arm Jan 29, 2025
61b8e2d
Enforce client authentication in handshake fragmentation tests
waleed-elmelegy-arm Jan 30, 2025
f162249
Add a comment to elaborate using split_send_frag in handshake defragm…
waleed-elmelegy-arm Jan 30, 2025
a75c7e0
Add guard to handshake defragmentation tests for client certificate
waleed-elmelegy-arm Jan 31, 2025
5f21537
Test Handshake defragmentation only for TLS 1.3 only for small values
waleed-elmelegy-arm Jan 31, 2025
4028cfd
Add missing client certificate check in handshake defragmentation tests
waleed-elmelegy-arm Jan 31, 2025
270dd74
ssl-opt: Updated the keywords to look up during handshake fragmentati…
minosgalanakis Feb 5, 2025
a1b9117
ssl-opt: Added requires_openssl_3_x to defragmentation tests.
minosgalanakis Feb 7, 2025
a8a298c
ssl-opt: Adjusted the wording on handshake fragmentation tests.
minosgalanakis Feb 7, 2025
a4dde77
ssl-opt: Dependency resolving set to use to requires_protocol_version…
minosgalanakis Feb 8, 2025
85fe73d
ssl-opt: Added tls 1.2 tests for HS defragmentation.
minosgalanakis Feb 9, 2025
41782a9
ssl-opt: Added negative-assertion testing, (HS Fragmentation disabled)
minosgalanakis Feb 18, 2025
1c106af
ssl-opt: Added handshake fragmentation tests for 4 byte fragments.
minosgalanakis Feb 18, 2025
74ce749
ssl-opt: Added negative tests for handshake fragmentation.
minosgalanakis Feb 18, 2025
36c81f5
ssl-opt: Added DSA-RSA dependency on TLS1.2 defragmentation testing.
minosgalanakis Feb 20, 2025
d708a63
ssl-opt: Updated documentation.
minosgalanakis Feb 18, 2025
eddbb5a
ChangeLog: Updated the entry for tls-hs-defragmentation
minosgalanakis Feb 19, 2025
a5a8c9f
ssl-opt: Added coverage for hs defragmentation TLS 1.2 tests.
minosgalanakis Feb 20, 2025
99ca668
ssl-opt: Replaced max_send_frag with split_send_frag
minosgalanakis Feb 20, 2025
cd6a24b
ssl-opt.sh: Disabled HS Defrag Tests for TLS1.2 where len < 16
minosgalanakis Feb 24, 2025
c8709c6
ssl-opt: Removed redundant dependencies: requires_openssl_3_x
minosgalanakis Feb 24, 2025
17170a5
ssl-opt: Updated documentation of HS-Defrag tests.
minosgalanakis Feb 27, 2025
19dbbe0
analyze_outcomes: Temporary disabled 3 HS Degragmentation tests.
minosgalanakis Feb 27, 2025
76957cc
ssl-opt: Minor typos and documentation fixes.
minosgalanakis Feb 27, 2025
d01ac30
ssl-opt: Adjusted reference hs defragmentation tests.
minosgalanakis Feb 27, 2025
0dd57a9
ssl-opt: Removed dependencies for HS defrag negative tests.
minosgalanakis Feb 27, 2025
4354dc6
ssl-opt: Re-introduce certificate dependency for HS negative tests.
minosgalanakis Feb 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 14 additions & 17 deletions tests/ssl-opt.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13874,10 +13874,9 @@ run_test "TLS 1.2 ClientHello indicating support for deflate compression meth

# Handshake defragmentation testing

# To warrant that the handhake messages are large enough and need to be split
# To guarantee that the handhake messages are large enough and need to be split
# into fragments, the tests require certificate authentication. The party in control
# of the fragmentation operations is OpenSSL and will always use server5.crt (548 Bytes)
# either from O_NEXT_SRV or test data.
# of the fragmentation operations is OpenSSL and will always use server5.crt (548 Bytes).
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on client (no fragmentation, for reference)" \
Expand All @@ -13897,9 +13896,7 @@ run_test "Handshake defragmentation on client: len=512, TLS 1.3" \
-c "handshake fragment: 0 \\.\\. 512 of [0-9]\\+ msglen 512" \
-c "waiting for more fragments (512 of [0-9]\\+"

# Since the removal of the DHE-RSA key exchange, the default openssl server
# certificate does not match what is provided by the testing client. Those
# use-cases are out of scope for defregmentation testing, and should be skipped.
#The server uses an ECDSA cert, so make sure we have a compatible key exchange
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_certificate_authentication
requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
Expand Down Expand Up @@ -14220,12 +14217,12 @@ run_test "Handshake defragmentation on server: len=128, TLS 1.3" \
-s "handshake fragment: 0 \\.\\. 128 of [0-9]\\+ msglen 128" \
-s "waiting for more fragments (128"

# Server-side ClientHello degfragmentation is only supported for MBEDTLS_SSL_PROTO_TLS1_3. For TLS 1.2 testing
# Server-side ClientHello defragmentationis only supported for MBEDTLS_SSL_PROTO_TLS1_3. For TLS 1.2 testing
Copy link
Contributor

@mpg mpg Feb 28, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Introducing a typo: missing space defragmentationis (no need to fix if there's nothing else).

# the server should suport both protocols and downgrade to client-requested TL1.2 after proccessing the ClientHello.
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=128, TLS 1.2 TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=128, TLS 1.2 TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 128 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
Expand All @@ -14246,7 +14243,7 @@ run_test "Handshake defragmentation on server: len=64, TLS 1.3" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=64, TLS 1.2 TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=64, TLS 1.2 TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 64 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
Expand All @@ -14267,7 +14264,7 @@ run_test "Handshake defragmentation on server: len=36, TLS 1.3" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=36, TLS 1.2 TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=36, TLS 1.2 TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 36 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
Expand All @@ -14288,7 +14285,7 @@ run_test "Handshake defragmentation on server: len=32, TLS 1.3" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=32, TLS 1.2 TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=32, TLS 1.2 TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 32 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
Expand All @@ -14309,7 +14306,7 @@ run_test "Handshake defragmentation on server: len=16, TLS 1.3" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=16, TLS 1.2 TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=16, TLS 1.2 TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 16 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
Expand All @@ -14330,7 +14327,7 @@ run_test "Handshake defragmentation on server: len=13, TLS 1.3" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=13, TLS 1.2 TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=13, TLS 1.2 TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 13 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
Expand All @@ -14351,7 +14348,7 @@ run_test "Handshake defragmentation on server: len=5, TLS 1.3" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=5, TLS 1.2 TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=5, TLS 1.2 TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 5 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
Expand All @@ -14372,7 +14369,7 @@ run_test "Handshake defragmentation on server: len=4, TLS 1.3" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=4, TLS 1.2 TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=4, TLS 1.2 TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 4 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
0 \
Expand All @@ -14393,7 +14390,7 @@ run_test "Handshake defragmentation on server: len=3, TLS 1.3" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=3, TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=3, TLS 1.3 ClientHello -> 1.2 Handshake" \
"$P_SRV debug_level=4 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 3 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
1 \
Expand All @@ -14404,7 +14401,7 @@ run_test "Handshake defragmentation on server: len=3, TLS 1.3 Client-Hallo ->
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=32, TLS 1.3 Client-Hallo -> 1.2 Handhsake" \
run_test "Handshake defragmentation on server: len=32, TLS 1.2 ClientHello" \
"$P_SRV debug_level=4 force_version=tls12 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 32 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
1 \
Expand Down