Skip to content

Commit bec3471

Browse files
filipecosta90filipecosta90
authored
Enable specifying the tls protocol version to use via --tls-protocols argument (#234)
* Enable specifying the tls protocol version to use via --tls-protocols argument * Added tls-protocols tlsv1.2 and tlsv1.3 tests to CI * Removed spurious comment on tls protocol parsing * Updated comment on TLS_PROTOCOLS env variable usage on tests
1 parent 4203084 commit bec3471

File tree

4 files changed

+82
-0
lines changed

4 files changed

+82
-0
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,18 @@ jobs:
5050
run: |
5151
TLS=1 ./tests/run_tests.sh
5252
53+
- name: Test OSS TCP TLS v1.2
54+
if: matrix.platform == 'ubuntu-latest'
55+
timeout-minutes: 10
56+
run: |
57+
TLS_PROTOCOLS="tlsv1.2" TLS=1 ./tests/run_tests.sh
58+
59+
- name: Test OSS TCP TLS v1.3
60+
if: matrix.platform == 'ubuntu-latest'
61+
timeout-minutes: 10
62+
run: |
63+
TLS_PROTOCOLS="tlsv1.3" TLS=1 ./tests/run_tests.sh
64+
5365
- name: Test OSS-CLUSTER TCP
5466
timeout-minutes: 10
5567
run: |

‎memtier_benchmark.cpp‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,19 @@
3939
#include <openssl/ssl.h>
4040
#include <openssl/err.h>
4141
#include <openssl/rand.h>
42+
43+
#define REDIS_TLS_PROTO_TLSv1 (1<<0)
44+
#define REDIS_TLS_PROTO_TLSv1_1 (1<<1)
45+
#define REDIS_TLS_PROTO_TLSv1_2 (1<<2)
46+
#define REDIS_TLS_PROTO_TLSv1_3 (1<<3)
47+
48+
/* Use safe defaults */
49+
#ifdef TLS1_3_VERSION
50+
#define REDIS_TLS_PROTO_DEFAULT (REDIS_TLS_PROTO_TLSv1_2|REDIS_TLS_PROTO_TLSv1_3)
51+
#else
52+
#define REDIS_TLS_PROTO_DEFAULT (REDIS_TLS_PROTO_TLSv1_2)
53+
#endif
54+
4255
#endif
4356

4457
#include <stdexcept>
@@ -296,6 +309,8 @@ static void config_init_defaults(struct benchmark_config *cfg)
296309
cfg->hdr_prefix = "";
297310
if (!cfg->print_percentiles.is_defined())
298311
cfg->print_percentiles = config_quantiles("50,99,99.9");
312+
if (!cfg->tls_protocols)
313+
cfg->tls_protocols = REDIS_TLS_PROTO_DEFAULT;
299314
}
300315

301316
static int generate_random_seed()
@@ -404,6 +419,7 @@ static int config_parse_args(int argc, char *argv[], struct benchmark_config *cf
404419
o_tls_cacert,
405420
o_tls_skip_verify,
406421
o_tls_sni,
422+
o_tls_protocols,
407423
o_hdr_file_prefix,
408424
o_help
409425
};
@@ -423,6 +439,7 @@ static int config_parse_args(int argc, char *argv[], struct benchmark_config *cf
423439
{ "cacert", 1, 0, o_tls_cacert },
424440
{ "tls-skip-verify", 0, 0, o_tls_skip_verify },
425441
{ "sni", 1, 0, o_tls_sni },
442+
{ "tls-protocols", 1, 0, o_tls_protocols },
426443
#endif
427444
{ "out-file", 1, 0, 'o' },
428445
{ "hdr-file-prefix", 1, 0, o_hdr_file_prefix },
@@ -863,6 +880,34 @@ static int config_parse_args(int argc, char *argv[], struct benchmark_config *cf
863880
case o_tls_sni:
864881
cfg->tls_sni = optarg;
865882
break;
883+
case o_tls_protocols:
884+
{
885+
const char tls_delimiter = ',';
886+
char* tls_token = strtok(optarg, &tls_delimiter);
887+
while (tls_token != nullptr) {
888+
if (!strcasecmp(tls_token, "tlsv1"))
889+
cfg->tls_protocols |= REDIS_TLS_PROTO_TLSv1;
890+
else if (!strcasecmp(tls_token, "tlsv1.1"))
891+
cfg->tls_protocols |= REDIS_TLS_PROTO_TLSv1_1;
892+
else if (!strcasecmp(tls_token, "tlsv1.2"))
893+
cfg->tls_protocols |= REDIS_TLS_PROTO_TLSv1_2;
894+
else if (!strcasecmp(tls_token, "tlsv1.3")) {
895+
#ifdef TLS1_3_VERSION
896+
cfg->tls_protocols |= REDIS_TLS_PROTO_TLSv1_3;
897+
#else
898+
fprintf(stderr, "TLSv1.3 is specified in tls-protocols but not supported by OpenSSL.");
899+
return -1;
900+
#endif
901+
} else {
902+
fprintf(stderr, "Invalid tls-protocols specified. "
903+
"Use a combination of 'TLSv1', 'TLSv1.1', 'TLSv1.2' and 'TLSv1.3'.");
904+
return -1;
905+
break;
906+
}
907+
tls_token = strtok(nullptr, &tls_delimiter);
908+
}
909+
break;
910+
}
866911
#endif
867912
default:
868913
return -1;
@@ -903,6 +948,7 @@ void usage() {
903948
" --key=FILE Use specified private key for TLS\n"
904949
" --cacert=FILE Use specified CA certs bundle for TLS\n"
905950
" --tls-skip-verify Skip verification of server certificate\n"
951+
" --tls-protocols Specify the tls protocol version to use, comma delemited. Use a combination of 'TLSv1', 'TLSv1.1', 'TLSv1.2' and 'TLSv1.3'"
906952
" --sni=STRING Add an SNI header\n"
907953
#endif
908954
" -x, --run-count=NUMBER Number of full-test iterations to perform\n"
@@ -1311,6 +1357,15 @@ int main(int argc, char *argv[])
13111357
cfg.openssl_ctx = SSL_CTX_new(SSLv23_client_method());
13121358
SSL_CTX_set_options(cfg.openssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
13131359

1360+
if (!(cfg.tls_protocols & REDIS_TLS_PROTO_TLSv1))
1361+
SSL_CTX_set_options(cfg.openssl_ctx, SSL_OP_NO_TLSv1);
1362+
if (!(cfg.tls_protocols & REDIS_TLS_PROTO_TLSv1_1))
1363+
SSL_CTX_set_options(cfg.openssl_ctx, SSL_OP_NO_TLSv1_1);
1364+
if (!(cfg.tls_protocols & REDIS_TLS_PROTO_TLSv1_2))
1365+
SSL_CTX_set_options(cfg.openssl_ctx, SSL_OP_NO_TLSv1_2);
1366+
if (!(cfg.tls_protocols & REDIS_TLS_PROTO_TLSv1_3))
1367+
SSL_CTX_set_options(cfg.openssl_ctx, SSL_OP_NO_TLSv1_3);
1368+
13141369
if (cfg.tls_cert) {
13151370
if (!SSL_CTX_use_certificate_chain_file(cfg.openssl_ctx, cfg.tls_cert)) {
13161371
ERR_print_errors_fp(stderr);

‎memtier_benchmark.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ struct benchmark_config {
111111
const char *tls_cacert;
112112
bool tls_skip_verify;
113113
const char *tls_sni;
114+
int tls_protocols;
114115
SSL_CTX *openssl_ctx;
115116
#endif
116117
};

‎tests/include.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@
55
TLS_CERT = os.environ.get("TLS_CERT", "")
66
TLS_KEY = os.environ.get("TLS_KEY", "")
77
TLS_CACERT = os.environ.get("TLS_CACERT", "")
8+
TLS_PROTOCOLS = os.environ.get("TLS_PROTOCOLS", "")
9+
10+
11+
def ensure_tls_protocols(master_nodes_connections):
12+
if TLS_PROTOCOLS != "":
13+
# if we've specified the TLS_PROTOCOLS env variable ensure the server enforces thos protocol versions
14+
for master_connection in master_nodes_connections:
15+
master_connection.execute_command("CONFIG", "SET", "tls-protocols", TLS_PROTOCOLS)
816

917

1018
def assert_minimum_memtier_outcomes(config, env, memtier_ok, overall_expected_request_count,
@@ -24,6 +32,10 @@ def assert_minimum_memtier_outcomes(config, env, memtier_ok, overall_expected_re
2432
debugPrintMemtierOnError(config, env)
2533

2634
def add_required_env_arguments(benchmark_specs, config, env, master_nodes_list):
35+
# if we've specified TLS_PROTOCOLS ensure we configure it on redis
36+
master_nodes_connections = env.getOSSMasterNodesConnectionList()
37+
ensure_tls_protocols(master_nodes_connections)
38+
2739
# check if environment is cluster
2840
if env.isCluster():
2941
benchmark_specs["args"].append("--cluster-mode")
@@ -91,6 +103,8 @@ def addTLSArgs(benchmark_specs, env):
91103
benchmark_specs['args'].append('--key={}'.format(TLS_KEY))
92104
else:
93105
benchmark_specs['args'].append('--tls-skip-verify')
106+
if TLS_PROTOCOLS != "":
107+
benchmark_specs['args'].append('--tls-protocols={}'.format(TLS_PROTOCOLS))
94108

95109

96110

0 commit comments

Comments
 (0)