You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As a modern TLS library, s2n-tls aims to provide sane and safe default. The goal of this task is to add TLS1.3 support to the "default" and "default_fips" policies.
Solution: add a TLS 1.2 CI job
To de-risk the loss of TLS 1.2 coverage, this solution will add a new TLS 1.2 test to our CI. This new job will toggle the default policy to TLS 1.2 and execute all unit tests. Since this will be a single job, we will lose some coverage (platform, feature probing, libcrypto), but we expect this to be an acceptable risk.
Project plan:
Set up a single GeneralBatch job which tests with a default TLS 1.2 policy. This will preserve majority of the current testing behavior when TLS 1.3 becomes the default. However, due to conditional compilation/feature probing (libcrypto, platform), this does sacrifice some code coverage. We consider this an acceptable risk.
Add TLS1.3 support to the "default" and "default_fips" policies
Solution not implemented due to new findings
This solution was attempting to pin TLS-1.2-tests to the numbered equivalent "20240501". However, we also have tests that actually want to test the "default" policy. ("default"-policy-tests), and should not be pinned. There is no easy way to detect "default"-policy-tests vs TLS-1.2-tests, which means so we cannot implement this solution.
Pin tests to the old "default" and "default_fips" policies to prevent regression
Security issue notifications
As a modern TLS library, s2n-tls aims to provide sane and safe default. The goal of this task is to add TLS1.3 support to the "default" and "default_fips" policies.
Solution: add a TLS 1.2 CI job
To de-risk the loss of TLS 1.2 coverage, this solution will add a new TLS 1.2 test to our CI. This new job will toggle the default policy to TLS 1.2 and execute all unit tests. Since this will be a single job, we will lose some coverage (platform, feature probing, libcrypto), but we expect this to be an acceptable risk.
Project plan:
security_policy_selection
directly and a single static configPost MVP:
s2n_config_set_cipher_preferences
after auto gen scriptSolution: Pin to number policy:
Solution not implemented due to new findings
This solution was attempting to pin TLS-1.2-tests to the numbered equivalent "20240501". However, we also have tests that actually want to test the "default" policy. ("default"-policy-tests), and should not be pinned. There is no easy way to detect "default"-policy-tests vs TLS-1.2-tests, which means so we cannot implement this solution.
Disallow explicit use of the "default" policy test: disallow explict use of "default" policy in tests #4750The text was updated successfully, but these errors were encountered: