Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

test: Adds SSLv3 integ test #4372

Merged
merged 9 commits into from
Jan 26, 2024
Merged

test: Adds SSLv3 integ test #4372

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
4ea0db1
Adds SSLv3 integ test
maddeleine Jan 22, 2024
b67852e
autopep8
maddeleine Jan 22, 2024
a7ffcbd
Reorganizes changes
maddeleine Jan 23, 2024
99dc800
Added S2N back
maddeleine Jan 23, 2024
4b5275d
Added fips exception
maddeleine Jan 23, 2024
1e9e0d0
autopep8
maddeleine Jan 23, 2024
ad709e6
Improves comment
maddeleine Jan 25, 2024
2a6d708
autopep8
maddeleine Jan 25, 2024
80b56c6
Merge branch 'main' into sslv3
maddeleine Jan 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions tests/integrationv2/common.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,8 +348,11 @@ class Curves(object):
"""
X25519 = Curve("X25519", Protocols.TLS13)
P256 = Curve("P-256")
P384 = Curve("P-384")
P521 = Curve("P-521")
# Our only SSLv3 provider doesn't support extensions
# so there is no way to negotiate a curve other than the
# default P-256 in SSLv3.
P384 = Curve("P-384", Protocols.TLS10)
P521 = Curve("P-521", Protocols.TLS10)
goatgoose marked this conversation as resolved.
Show resolved Hide resolved
SecP256r1Kyber768Draft00 = Curve("SecP256r1Kyber768Draft00")
X25519Kyber768Draft00 = Curve("X25519Kyber768Draft00")

Expand Down
1 change: 1 addition & 0 deletions tests/integrationv2/configuration.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
Protocols.TLS12,
Protocols.TLS11,
Protocols.TLS10,
Protocols.SSLv3,
]


Expand Down
34 changes: 33 additions & 1 deletion tests/integrationv2/providers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,11 @@ def supports_protocol(cls, protocol, with_cert=None):
# e.g. "openssl-1.0" in "openssl-1.0.2-fips"
if unsupported_lc in current_libcrypto:
return False

# s2n-tls will not negotiate SSLv3 if in fips mode
if protocol == Protocols.SSLv3 and get_flag(S2N_FIPS_MODE):
return False

return True

@classmethod
Expand Down Expand Up @@ -468,6 +473,9 @@ def get_version(cls):

@classmethod
def supports_protocol(cls, protocol, with_cert=None):
if protocol is Protocols.SSLv3:
return False

return True

@classmethod
Expand Down Expand Up @@ -507,6 +515,8 @@ def setup_client(self):
cmd_line.append('-tls1_1')
elif self.options.protocol == Protocols.TLS10:
cmd_line.append('-tls1')
elif self.options.protocol == Protocols.SSLv3:
cmd_line.append('-ssl3')

if self.options.cipher is not None:
cmd_line.extend(self._cipher_to_cmdline(self.options.cipher))
Expand Down Expand Up @@ -582,6 +592,8 @@ def setup_server(self):
cmd_line.append('-tls1_1')
elif self.options.protocol == Protocols.TLS10:
cmd_line.append('-tls1')
elif self.options.protocol == Protocols.SSLv3:
cmd_line.append('-ssl3')

if self.options.cipher is not None:
cmd_line.extend(self._cipher_to_cmdline(self.options.cipher))
Expand All @@ -607,6 +619,26 @@ def setup_server(self):
return cmd_line


class SSLv3Provider(OpenSSL):
Fixed Show fixed Hide fixed
def __init__(self, options: ProviderOptions):
OpenSSL.__init__(self, options)
self._override_libssl(options)

def _override_libssl(self, options: ProviderOptions):
install_dir = os.environ["OPENSSL_1_0_2_INSTALL_DIR"]

override_env_vars = dict()
override_env_vars["PATH"] = install_dir + "/bin"
override_env_vars["LD_LIBRARY_PATH"] = install_dir + "/lib"
Copy link
Contributor

@dougch dougch Jan 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Normally over-writing this is fraught with peril, but it looks like the framework gets away with it, so long as the process/ManagedProcess code only runs one binary and doesn't mess with the top level environment.

options.env_overrides = override_env_vars

@classmethod
def supports_protocol(cls, protocol, with_cert=None):
if protocol is Protocols.SSLv3:
return True
return False


class JavaSSL(Provider):
"""
NOTE: Only a Java SSL client has been set up. The server has not been
Expand All @@ -623,7 +655,7 @@ def get_send_marker(cls):
@classmethod
def supports_protocol(cls, protocol, with_cert=None):
# https://aws.amazon.com/blogs/opensource/tls-1-0-1-1-changes-in-openjdk-and-amazon-corretto/
if protocol is Protocols.TLS10 or protocol is Protocols.TLS11:
if protocol is Protocols.SSLv3 or protocol is Protocols.TLS10 or protocol is Protocols.TLS11:
return False

return True
Expand Down
12 changes: 5 additions & 7 deletions tests/integrationv2/test_happy_path.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,17 @@
from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS, PROTOCOLS
from common import ProviderOptions, data_bytes
from fixtures import managed_process # lgtm [py/unused-import]
from providers import Provider, S2N, OpenSSL, JavaSSL, GnuTLS
from providers import Provider, S2N, OpenSSL, JavaSSL, GnuTLS, SSLv3Provider
from utils import invalid_test_parameters, get_parameter_name, get_expected_s2n_version, to_bytes


@pytest.mark.uncollect_if(func=invalid_test_parameters)
@pytest.mark.parametrize("cipher", ALL_TEST_CIPHERS, ids=get_parameter_name)
@pytest.mark.parametrize("provider", [S2N, OpenSSL, GnuTLS, JavaSSL])
@pytest.mark.parametrize("other_provider", [S2N], ids=get_parameter_name)
@pytest.mark.parametrize("provider", [S2N, OpenSSL, GnuTLS, JavaSSL, SSLv3Provider])
@pytest.mark.parametrize("curve", ALL_TEST_CURVES, ids=get_parameter_name)
@pytest.mark.parametrize("protocol", PROTOCOLS, ids=get_parameter_name)
@pytest.mark.parametrize("certificate", ALL_TEST_CERTS, ids=get_parameter_name)
def test_s2n_server_happy_path(managed_process, cipher, provider, other_provider, curve, protocol, certificate):
def test_s2n_server_happy_path(managed_process, cipher, provider, curve, protocol, certificate):
port = next(available_ports)

# s2nd can receive large amounts of data because all the data is
Expand Down Expand Up @@ -69,12 +68,11 @@ def test_s2n_server_happy_path(managed_process, cipher, provider, other_provider

@pytest.mark.uncollect_if(func=invalid_test_parameters)
@pytest.mark.parametrize("cipher", ALL_TEST_CIPHERS, ids=get_parameter_name)
@pytest.mark.parametrize("provider", [S2N, OpenSSL, GnuTLS])
@pytest.mark.parametrize("other_provider", [S2N], ids=get_parameter_name)
@pytest.mark.parametrize("provider", [S2N, OpenSSL, GnuTLS, SSLv3Provider])
@pytest.mark.parametrize("curve", ALL_TEST_CURVES, ids=get_parameter_name)
@pytest.mark.parametrize("protocol", PROTOCOLS, ids=get_parameter_name)
@pytest.mark.parametrize("certificate", ALL_TEST_CERTS, ids=get_parameter_name)
def test_s2n_client_happy_path(managed_process, cipher, provider, other_provider, curve, protocol, certificate):
def test_s2n_client_happy_path(managed_process, cipher, provider, curve, protocol, certificate):
port = next(available_ports)

# We can only send 4096 - 1 (\n at the end) bytes here because of the
Expand Down
2 changes: 1 addition & 1 deletion tests/integrationv2/tox.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ skipsdist = True
[testenv]
# install pytest in the virtualenv where commands will be executed
setenv = S2N_INTEG_TEST = 1
passenv = DYLD_LIBRARY_PATH, LD_LIBRARY_PATH, OQS_OPENSSL_1_1_1_INSTALL_DIR, HOME, TOX_TEST_NAME
passenv = DYLD_LIBRARY_PATH, LD_LIBRARY_PATH, OQS_OPENSSL_1_1_1_INSTALL_DIR, OPENSSL_1_0_2_INSTALL_DIR, HOME, TOX_TEST_NAME
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The equivalent in nix will be an addition to the shellHook stanza, but let's do this as a future change.

ignore_errors=False
deps =
pytest==7
Expand Down
Loading