moonchen commented on code in PR #13306: URL: https://github.com/apache/trafficserver/pull/13306#discussion_r3448987681
########## tests/gold_tests/tls/tls_record_size_client.py: ########## @@ -0,0 +1,143 @@ +#!/usr/bin/env python3 +''' +Download an object from ATS over TLS and inspect the TLS records on the wire: +confirm the body arrives intact AND that every application-data record is no +larger than the configured proxy.config.ssl.max_record_size (plus AEAD overhead). + +A MemoryBIO drives the handshake so the raw ciphertext stream is visible; the +5-byte TLS record headers (type, version, length) are in cleartext, so record +sizes can be measured without decrypting. TLS 1.2 is pinned so that handshake +messages are their own record type (22) and only real application data is type 23. +''' +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import argparse +import socket +import ssl +import sys + +TLS_APPLICATION_DATA = 23 +# A clamped plaintext record becomes ciphertext of plaintext + per-record overhead +# (AEAD nonce/tag, or CBC IV/MAC/padding). 256 covers any cipher's overhead while +# staying far below an unclamped ~16 KB record, so the clamp check stays decisive. +RECORD_OVERHEAD = 256 Review Comment: Good catch — fixed in the latest push. The client now pins AEAD (GCM) suites, so the per-record overhead is a fixed 24 bytes (8-byte explicit nonce + 16-byte tag) rather than a CBC suite's variable IV/MAC/padding. Verified on the wire: clamped records measure 4120 bytes = 4096 clamp + 24, well within the 256 allowance. This also makes the docstring's "AEAD overhead" claim actually hold regardless of cipher negotiation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
