Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add pq-tls interop test with BoringSSL #2199

Merged
merged 3 commits into from
Feb 19, 2025
Merged

Add pq-tls interop test with BoringSSL #2199

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
75b559b
Add pq-tls integration test with BoringSSL
Feb 17, 2025
75ed6aa
fix boring-ssl build failure
Feb 18, 2025
71ed17d
Updated build type, and suppressed build stdout
Feb 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion tests/ci/cdk/cdk/codebuild/github_ci_integration_omnibus.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,7 +256,7 @@ batch:
env:
type: LINUX_CONTAINER
privileged-mode: false
compute-type: BUILD_GENERAL1_SMALL
compute-type: BUILD_GENERAL1_MEDIUM
image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:ubuntu-22.04_gcc-12x_latest
variables:
AWS_LC_CI_TARGET: "tests/ci/integration/run_pq_tls_integration.sh"
Expand Down
69 changes: 62 additions & 7 deletions tests/ci/integration/run_pq_tls_integration.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,27 +15,34 @@ S2N_BRANCH='main'
S2N_TLS_SRC_FOLDER="${SCRATCH_FOLDER}/s2n-tls"
S2N_TLS_BUILD_FOLDER="${SCRATCH_FOLDER}/s2n-tls-build"

BSSL_URL='https://github.com/google/boringssl.git'
BSSL_BRANCH='main'
BSSL_SRC_FOLDER="${SCRATCH_FOLDER}/boring-ssl"
BSSL_BUILD_FOLDER="${SCRATCH_FOLDER}/boring-ssl-build"

rm -rf "${SCRATCH_FOLDER:?}"
mkdir -p "$SCRATCH_FOLDER"

echo "build and install aws-lc"
aws_lc_build "$SRC_ROOT" "$AWS_LC_BUILD_FOLDER" "$AWS_LC_INSTALL_FOLDER" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_TESTING=OFF
# Using Debug build as it uses the '-g' compiler flag with gcc without any optimization
aws_lc_build "$SRC_ROOT" "$AWS_LC_BUILD_FOLDER" "$AWS_LC_INSTALL_FOLDER" -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=OFF

echo "clone s2n_tls"
echo "clone s2n-tls"
git clone --depth 1 --branch "$S2N_BRANCH" "$S2N_URL" "$S2N_TLS_SRC_FOLDER"

echo "build s2n_tls with aws-lc"
echo "build s2n-tls with aws-lc"
cd "$S2N_TLS_SRC_FOLDER"
cmake . "-B$S2N_TLS_BUILD_FOLDER" -GNinja \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_PREFIX_PATH="$AWS_LC_INSTALL_FOLDER"
ninja -C "$S2N_TLS_BUILD_FOLDER" -j "$NUM_CPU_THREADS"
# Suppress stdout for build
ninja -C "$S2N_TLS_BUILD_FOLDER" -j "$NUM_CPU_THREADS" > /dev/null

for GROUP in X25519MLKEM768 SecP256r1MLKEM768; do
echo "TLS Handshake: aws-lc server (bssl) with s2n-tls client (s2nc) for group $GROUP"
"$AWS_LC_BUILD_FOLDER"/tool/bssl s_server -curves $GROUP -accept 45000 -debug \
&> "$AWS_LC_BUILD_FOLDER"/s_server_out &
sleep 2 # to allow for the server to startup in the background thread
sleep 5 # to allow for the server to startup in the background thread
S_PID=$!
# Relying on s2nc behavior that it exits after the first handshake
"$S2N_TLS_BUILD_FOLDER"/bin/s2nc -c default_pq -i localhost 45000 &> "$S2N_TLS_BUILD_FOLDER"/s2nc_out
Expand All @@ -48,7 +55,7 @@ for GROUP in X25519MLKEM768 SecP256r1MLKEM768; do

echo "TLS Handshake: s2n-tls server (s2nd) with aws-lc client (bssl) for group $GROUP"
"$S2N_TLS_BUILD_FOLDER"/bin/s2nd -c default_pq -i localhost 45000 &> "$S2N_TLS_BUILD_FOLDER"/s2nd_out &
sleep 2 # to allow for the server to startup in the background thread
sleep 5 # to allow for the server to startup in the background thread
S_PID=$!
# bssl s_client normally does not exit after a handshake, but when run as a background process
# seems to exit by closing the connection after the first handshake. Relying on that behavior here.
Expand All @@ -62,4 +69,52 @@ for GROUP in X25519MLKEM768 SecP256r1MLKEM768; do
grep "KEM Group" "$S2N_TLS_BUILD_FOLDER"/s2nd_out | grep "$GROUP"
done

echo "clone boring-ssl"
git clone --depth 1 --branch "$BSSL_BRANCH" "$BSSL_URL" "$BSSL_SRC_FOLDER"

echo "build boring-ssl with aws-lc"
cd "$BSSL_SRC_FOLDER"
# BoringSSL build fails with -DCMAKE_BUILD_TYPE=Release, when built in x86 ubuntu-22.04_gcc-12x container.
# Release builds use gcc optimization level 3 '-O3' which fails in the above linux container build.
# Optimizations are not required for this test, and it increases build time as well.
# Using Debug build that only uses the '-g' compiler flag with gcc without any optimization.
cmake . "-B$BSSL_BUILD_FOLDER" -GNinja -DCMAKE_BUILD_TYPE=Debug
# Suppress stdout for build
ninja -C "$BSSL_BUILD_FOLDER" -j "$NUM_CPU_THREADS" >/dev/null

# BoringSSL supports only X25519MLKEM768 but not SecP256r1MLKEM768 for key exchange
for GROUP in X25519MLKEM768; do
echo "TLS Handshake: aws-lc server (bssl) with boring-ssl client (bssl) for group $GROUP"
"$AWS_LC_BUILD_FOLDER"/tool/bssl s_server -curves $GROUP -accept 45000 -debug \
&> "$AWS_LC_BUILD_FOLDER"/s_server_out &
sleep 5 # to allow for the server to startup in the background thread
S_PID=$!
"$BSSL_BUILD_FOLDER"/tool/bssl s_client -curves $GROUP -connect localhost:45000 -debug \
&> "$BSSL_BUILD_FOLDER"/s_client_out &
wait $S_PID || true
cat "$AWS_LC_BUILD_FOLDER"/s_server_out
cat "$BSSL_BUILD_FOLDER"/s_client_out
grep "Connected" "$AWS_LC_BUILD_FOLDER"/s_server_out
grep "ECDHE group" "$AWS_LC_BUILD_FOLDER"/s_server_out | grep "$GROUP"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Why'd you switch to calling this an ECDHE group here? Earlier you used KEM groups. More generally, we should use the more generic "TLS group" terminology.

Copy link
Contributor Author

@chockalingamc chockalingamc Feb 18, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test is just validating what the tool prints in its server/client logs.
s2n-tls tool used the term KEM group. bssl tool uses ECDHE group. If either tool is updated to use the generic term, we need to update the test at that time.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reg log output, we could perhaps not log the build output (suppress stdout while keeping stderr logs).
The current output is around 3K lines most of which is the lc/s2n/bssl build stdout logs.

grep "Connected" "$BSSL_BUILD_FOLDER"/s_client_out
grep "ECDHE group" "$BSSL_BUILD_FOLDER"/s_client_out | grep "$GROUP"
grep "subject" "$BSSL_BUILD_FOLDER"/s_client_out | grep "BoringSSL"

echo "TLS Handshake: boring-ssl server (bssl) with aws-lc client (bssl) for group $GROUP"
"$BSSL_BUILD_FOLDER"/tool/bssl s_server -curves $GROUP -accept 45000 -debug \
&> "$BSSL_BUILD_FOLDER"/s_server_out &
sleep 5 # to allow for the server to startup in the background thread
S_PID=$!
"$AWS_LC_BUILD_FOLDER"/tool/bssl s_client -curves $GROUP -connect localhost:45000 -debug \
&> "$AWS_LC_BUILD_FOLDER"/s_client_out &
wait $S_PID || true
cat "$BSSL_BUILD_FOLDER"/s_server_out
cat "$AWS_LC_BUILD_FOLDER"/s_client_out
grep "Connected" "$BSSL_BUILD_FOLDER"/s_server_out
grep "ECDHE group" "$BSSL_BUILD_FOLDER"/s_server_out | grep "$GROUP"
grep "Connected" "$AWS_LC_BUILD_FOLDER"/s_client_out
grep "ECDHE group" "$AWS_LC_BUILD_FOLDER"/s_client_out | grep "$GROUP"
grep "subject" "$AWS_LC_BUILD_FOLDER"/s_client_out | grep "BoringSSL"
done

rm -rf "${SCRATCH_FOLDER:?}"
Loading