Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test: expand s2n_record_read testing to both TLS.13 and TLS.12 #4903

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

toidiu
Copy link
Contributor

@toidiu toidiu commented Nov 18, 2024

Description of changes:

A test in s2n_record_read_test.c passes for TLS1.2 but fails when TLS1.3 protocol is negotiated. This is unexpected since record reading behavior should be protocol independent.

The test "corrupts" a payload by modifying the ContentType (first byte) and expects a decryption error. However, this doesn't work for TLS1.2 since ConentType is not used in decryption in TLS1.3.

The fix in this PR is to instead corrupt the 6th byte (the encrypted data), which should result in an error for both TLS1.2 and TLS1.3.

Testing:

Expand test to both the TLS1.2 andTLS1.3 protocol.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@github-actions github-actions bot added the s2n-core team label Nov 18, 2024
@toidiu toidiu changed the title test: expand record read testing to both tls13 and tls12 test: expand s2n_record_read testing to both TLS.13 and TLS.12 Nov 18, 2024
tests/unit/s2n_record_read_test.c Outdated Show resolved Hide resolved
Comment on lines 167 to 172
const char *security_policy_test_cases[] = {
/* TLS 1.3 */
"20240503",
/* TLS 1.2 */
"20240501",
};
Copy link
Contributor

@lrstewart lrstewart Nov 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: You might want to assert that you really are negotiating the version you expect, so that you're not writing another test that will have an unpredictable version if assumptions change :) Which would mean you'd probably want something like this instead:

struct {
    const char *policy;
    uint8_t version;
} test_cases[] = {
    { .policy = 20240503, .version = S2N_TLS13 }
}

Comment on lines 209 to 211
/* Offset and corrupt the 6th byte, which is used by both TLS 1.2 and TLS 1.3
* during decryption
*/
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would the last byte be simpler / more obvious?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipping the last byte does work but I prefer skipping the header len amount since that is the reason why this currently doesnt work.

// skipping last byte tested via

int last_byte = s2n_stuffer_data_available(&invalidation_stuffer) - 1;    
...
EXPECT_SUCCESS(s2n_stuffer_skip_read(&invalidation_stuffer, last_byte)); 

@toidiu toidiu disabled auto-merge November 18, 2024 22:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants