Copilot commented on code in PR #13306: URL: https://github.com/apache/trafficserver/pull/13306#discussion_r3448972932
########## tests/gold_tests/tls/tls_record_size_client.py: ########## @@ -0,0 +1,143 @@ +#!/usr/bin/env python3 +''' +Download an object from ATS over TLS and inspect the TLS records on the wire: +confirm the body arrives intact AND that every application-data record is no +larger than the configured proxy.config.ssl.max_record_size (plus AEAD overhead). + +A MemoryBIO drives the handshake so the raw ciphertext stream is visible; the +5-byte TLS record headers (type, version, length) are in cleartext, so record +sizes can be measured without decrypting. TLS 1.2 is pinned so that handshake +messages are their own record type (22) and only real application data is type 23. +''' +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import argparse +import socket +import ssl +import sys + +TLS_APPLICATION_DATA = 23 +# A clamped plaintext record becomes ciphertext of plaintext + per-record overhead +# (AEAD nonce/tag, or CBC IV/MAC/padding). 256 covers any cipher's overhead while +# staying far below an unclamped ~16 KB record, so the clamp check stays decisive. +RECORD_OVERHEAD = 256 Review Comment: `RECORD_OVERHEAD = 256` is too low for the worst-case TLSv1.2 record expansion with CBC suites (IV + MAC + up to 255 bytes of padding can exceed 256 bytes). This can make the test fail spuriously even when `proxy.config.ssl.max_record_size` clamping is correct. Bump the allowance (or force an AEAD-only cipher suite) and update the comment accordingly so the clamp check remains stable across cipher negotiation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
