Add basic handshake defragmentation tests in ssl-opt #9989

minosgalanakis · 2025-02-17T14:53:30Z

Description

Implements a portion of the testing needed for #9872. This pr extends #9928 and resolves #9887

PR checklist

Please remove the segment/s on either side of the | symbol as appropriate, and add any relevant link/s to the end of the line.
If the provided content is part of the present PR remove the # symbol.

changelog provided.
development PR provided
TF-PSA-Crypto PR not required because: ssl-opt testing changes only
framework PR not required
3.6 PR provided [3.6 Backport] Add basic handshake defragmentation tests in ssl-opt #10016
2.28 PR not required because: Not backported to 2.28
tests provided

mpg

(Posting partial early review.)

tests/ssl-opt.sh

minosgalanakis · 2025-02-23T23:45:59Z

Quick update:

I have addressed all the comments, cleaned up the commit history to make it easier to review, and increased coverage.

I will be sharing a table with what is covered for design review purposes.

mpg · 2025-02-24T08:36:00Z

Thanks! Now that #9872 is merged, can you rebase on top of it?

Also, can you add a commit disabling (by prepending skip_next_test) the failings tests (TLS 1.2 with < 16 fragments) temporarily, just to make it easier to check that those are the only failures (ie, the CI should come back green with those disabled).

Once we've agreed on a solution to the underlying problem, we'll re-enable those tests in some form (probably just assert failure when using 1.2 and with fragment length < 16, but we can't do that right now, as the handshake succeeds with ChachaPoly).

Tests uses openssl s_server with a mix of max_send_frag and split_send_frag options. Signed-off-by: Waleed Elmelegy <[email protected]>

* Add tests for the server side. * Remove restriction for TLS 1.2 so that we can test TLS 1.2 & 1.3. * Use latest version of openSSL to make sure -max_send_frag & -split_send_frag flags are supported. Signed-off-by: Waleed Elmelegy <[email protected]>

Signed-off-by: Waleed Elmelegy <[email protected]>

…entation tests Signed-off-by: Waleed Elmelegy <[email protected]>

Signed-off-by: Waleed Elmelegy <[email protected]>

…on tests. Signed-off-by: Minos Galanakis <[email protected]>

Signed-off-by: Minos Galanakis <[email protected]>

gilles-peskine-arm

There's still one spurious dependency on requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3: #9989 (comment) . Other than that LGTM

gilles-peskine-arm · 2025-02-27T16:58:49Z

tests/ssl-opt.sh

+
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+requires_certificate_authentication
+requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED


I had missed this spurious dependency, good call for removing it from the backport: the negative test for handshake too small doesn't require ECDSA support. In fact it doesn't need certificate authentication at all. We can fix this later.

Signed-off-by: Minos Galanakis <[email protected]>

gilles-peskine-arm

LGTM

minosgalanakis · 2025-02-27T22:38:35Z

One test failedin all_u16-test_tls13_only_psk, because I removed the certifcate requirement for the negative testing. Re-introduced that and should be green.

Signed-off-by: Minos Galanakis <[email protected]>

mpg

LGTM, thanks!

mpg · 2025-02-28T09:20:14Z

tests/ssl-opt.sh

@@ -14220,12 +14217,12 @@ run_test    "Handshake defragmentation on server: len=128, TLS 1.3" \
            -s "handshake fragment: 0 \\.\\. 128 of [0-9]\\+ msglen 128" \
            -s "waiting for more fragments (128"

-# Server-side ClientHello degfragmentation is only supported for MBEDTLS_SSL_PROTO_TLS1_3. For TLS 1.2 testing
+# Server-side ClientHello defragmentationis only supported for MBEDTLS_SSL_PROTO_TLS1_3. For TLS 1.2 testing


Introducing a typo: missing space defragmentationis (no need to fix if there's nothing else).

gilles-peskine-arm

We'll need to have some tests around fragmentation that run with PSK, but ok for now.

minosgalanakis mentioned this pull request Feb 17, 2025

Issue9887 extend add basic defragmentation tests #9990

Closed

6 tasks

minosgalanakis changed the base branch from development to features/tls-defragmentation/development February 17, 2025 14:59

mpg reviewed Feb 18, 2025

View reviewed changes

tests/ssl-opt.sh Show resolved Hide resolved

tests/ssl-opt.sh Show resolved Hide resolved

tests/ssl-opt.sh Outdated Show resolved Hide resolved

tests/ssl-opt.sh Show resolved Hide resolved

minosgalanakis force-pushed the issue9887_add_basic_defragmentation_tests branch from 6e261a1 to aeba05a Compare February 18, 2025 20:59

mpg reviewed Feb 19, 2025

View reviewed changes

tests/ssl-opt.sh Outdated Show resolved Hide resolved

mpg reviewed Feb 19, 2025

View reviewed changes

tests/ssl-opt.sh Outdated Show resolved Hide resolved

mpg reviewed Feb 19, 2025

View reviewed changes

tests/ssl-opt.sh Outdated Show resolved Hide resolved

tests/ssl-opt.sh Show resolved Hide resolved

tests/ssl-opt.sh Show resolved Hide resolved

tests/ssl-opt.sh Show resolved Hide resolved

minosgalanakis force-pushed the issue9887_add_basic_defragmentation_tests branch 2 times, most recently from 5bf1ff3 to 5c8cbb2 Compare February 20, 2025 09:44

mpg reviewed Feb 20, 2025

View reviewed changes

tests/ssl-opt.sh Outdated Show resolved Hide resolved

minosgalanakis force-pushed the issue9887_add_basic_defragmentation_tests branch 5 times, most recently from aee03e9 to 765755a Compare February 23, 2025 23:43

waleed-elmelegy-arm and others added 13 commits February 24, 2025 09:16

Add TLS Hanshake defragmentation tests

79a8ded

Tests uses openssl s_server with a mix of max_send_frag and split_send_frag options. Signed-off-by: Waleed Elmelegy <[email protected]>

Fix typo in TLS Handshake defrafmentation tests

c0118d8

Signed-off-by: Waleed Elmelegy <[email protected]>

Remove unnecessary string check in handshake defragmentation tests

fccd014

Signed-off-by: Waleed Elmelegy <[email protected]>

Require openssl to support TLS 1.3 in handshake defragmentation tests

f912031

Signed-off-by: Waleed Elmelegy <[email protected]>

Add client authentication to handshake defragmentation tests

48874b3

Signed-off-by: Waleed Elmelegy <[email protected]>

Remove unneeded mtu option from handshake fragmentation tests

39d83dd

Signed-off-by: Waleed Elmelegy <[email protected]>

Enforce client authentication in handshake fragmentation tests

61b8e2d

Signed-off-by: Waleed Elmelegy <[email protected]>

Add a comment to elaborate using split_send_frag in handshake defragm…

f162249

…entation tests Signed-off-by: Waleed Elmelegy <[email protected]>

Add guard to handshake defragmentation tests for client certificate

a75c7e0

Signed-off-by: Waleed Elmelegy <[email protected]>

Test Handshake defragmentation only for TLS 1.3 only for small values

5f21537

Signed-off-by: Waleed Elmelegy <[email protected]>

Add missing client certificate check in handshake defragmentation tests

4028cfd

Signed-off-by: Waleed Elmelegy <[email protected]>

ssl-opt: Updated the keywords to look up during handshake fragmentati…

270dd74

…on tests. Signed-off-by: Minos Galanakis <[email protected]>

gilles-peskine-arm added needs-work needs-backports Backports are missing or are pending review and approval. component-tls size-s Estimated task size: small (~2d) priority-high High priority - will be reviewed soon labels Feb 27, 2025

github-project-automation bot added this to Roadmap pull requests (new board) Feb 27, 2025

github-project-automation bot moved this to In Development in Roadmap pull requests (new board) Feb 27, 2025

minosgalanakis added 2 commits February 27, 2025 15:11

ssl-opt: Minor typos and documentation fixes.

76957cc

Signed-off-by: Minos Galanakis <[email protected]>

ssl-opt: Adjusted reference hs defragmentation tests.

d01ac30

Signed-off-by: Minos Galanakis <[email protected]>

minosgalanakis mentioned this pull request Feb 27, 2025

[3.6 Backport] Add basic handshake defragmentation tests in ssl-opt #10016

Merged

6 tasks

gilles-peskine-arm requested changes Feb 27, 2025

View reviewed changes

gilles-peskine-arm reviewed Feb 27, 2025

View reviewed changes

ssl-opt: Removed dependencies for HS defrag negative tests.

0dd57a9

Signed-off-by: Minos Galanakis <[email protected]>

gilles-peskine-arm previously approved these changes Feb 27, 2025

View reviewed changes

gilles-peskine-arm added needs-review Every commit must be reviewed by at least two team members, and removed needs-work labels Feb 27, 2025

gilles-peskine-arm requested a review from mpg February 27, 2025 18:14

ssl-opt: Re-introduce certificate dependency for HS negative tests.

4354dc6

Signed-off-by: Minos Galanakis <[email protected]>

minosgalanakis dismissed gilles-peskine-arm’s stale review via 4354dc6 February 27, 2025 22:40

mpg approved these changes Feb 28, 2025

View reviewed changes

mpg requested a review from gilles-peskine-arm February 28, 2025 09:23

gilles-peskine-arm approved these changes Feb 28, 2025

View reviewed changes

github-project-automation bot moved this from In Development to Has Approval in Roadmap pull requests (new board) Feb 28, 2025

gilles-peskine-arm merged commit 6eabe58 into Mbed-TLS:features/tls-defragmentation/development Feb 28, 2025
6 checks passed

github-project-automation bot moved this from Has Approval to Done in Roadmap pull requests (new board) Feb 28, 2025

gilles-peskine-arm mentioned this pull request Mar 5, 2025

Defragment ext test 3.6 #9976

Merged

6 tasks

This was referenced Mar 25, 2025

Add TLS Handshake defragmentation tests #9928

Closed

Basic ssl-opt testing for TLS HS defragmentation #9887

Closed

minosgalanakis mentioned this pull request Apr 22, 2025

Properly support smaller fragment / record size #10099

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add basic handshake defragmentation tests in ssl-opt #9989

Add basic handshake defragmentation tests in ssl-opt #9989

minosgalanakis commented Feb 17, 2025 •

edited

Loading

mpg left a comment

minosgalanakis commented Feb 23, 2025

mpg commented Feb 24, 2025 •

edited

Loading

gilles-peskine-arm left a comment

gilles-peskine-arm Feb 27, 2025

gilles-peskine-arm left a comment

minosgalanakis commented Feb 27, 2025

mpg left a comment

mpg Feb 28, 2025 •

edited

Loading

gilles-peskine-arm left a comment

Add basic handshake defragmentation tests in ssl-opt #9989

Add basic handshake defragmentation tests in ssl-opt #9989

Conversation

minosgalanakis commented Feb 17, 2025 • edited Loading

Description

PR checklist

mpg left a comment

Choose a reason for hiding this comment

minosgalanakis commented Feb 23, 2025

mpg commented Feb 24, 2025 • edited Loading

gilles-peskine-arm left a comment

Choose a reason for hiding this comment

gilles-peskine-arm Feb 27, 2025

Choose a reason for hiding this comment

gilles-peskine-arm left a comment

Choose a reason for hiding this comment

minosgalanakis commented Feb 27, 2025

mpg left a comment

Choose a reason for hiding this comment

mpg Feb 28, 2025 • edited Loading

Choose a reason for hiding this comment

gilles-peskine-arm left a comment

Choose a reason for hiding this comment

minosgalanakis commented Feb 17, 2025 •

edited

Loading

mpg commented Feb 24, 2025 •

edited

Loading

mpg Feb 28, 2025 •

edited

Loading