Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Tempesta TLS generates non optimal TCP segments #1325

Closed
krizhanovsky opened this issue Jul 25, 2019 · 2 comments · Fixed by tempesta-tech/tempesta-test#179
Closed

Tempesta TLS generates non optimal TCP segments #1325

krizhanovsky opened this issue Jul 25, 2019 · 2 comments · Fixed by tempesta-tech/tempesta-test#179
Assignees
@krizhanovsky
Labels
invalid performance question Questions and support tasks test TLS Tempesta TLS module and related issues
Milestone
0.7 - HTTP/2

Comments

@krizhanovsky
Copy link
Contributor

krizhanovsky commented Jul 25, 2019 •
edited
Loading

If you run the TLS test with debug mode at least 2 (default is 3) (note that I disabled the test in the suite, so fix tests_disabled.json before trying)

# ./run_tests.py -n tls.test_tls_integrity.Proxy.test_tcp_segs

, then you see output with sizes of TCP segments sent by deproxy server to Tempesta FW and Tempesta TLS to the deproxy client:

Tempesta segments: [44, 927, 95, 4251, 4153, 125]
Server segments: [44, 4140, 4140, 109]

It's possible that in some circumstances TCP stack generate non optimal skbs for transmission, but this test case is run with no load and should show reasonable TCP segment sizes.

Probably linked with extra skb fragmentation #1103. Note that 9f83f10 lightly reduces skb fragmentation.
@krizhanovsky krizhanovsky added this to the 0.8 TLS 1.3 milestone Jul 25, 2019
@krizhanovsky
Copy link
Contributor Author

krizhanovsky commented Jul 29, 2019 •
edited
Loading

Please address comment in AnalyzerTCPSegmentation testing class and corresponding review comment tempesta-tech/tempesta-test#103 (comment) : the test case probably should be relaxed, but the relaxation must have a solid ground.

Also check this behaviour against TLS tickets, #1430

@krizhanovsky krizhanovsky mentioned this issue Jul 29, 2019
Merged
@krizhanovsky krizhanovsky added the question Questions and support tasks label Jul 29, 2019
@krizhanovsky krizhanovsky changed the title Tempesta TLS generates non optimzal TCP segments Tempesta TLS generates non optimal TCP segments Oct 3, 2019
@krizhanovsky krizhanovsky self-assigned this Mar 5, 2020
@krizhanovsky krizhanovsky added the TLS Tempesta TLS module and related issues label Apr 27, 2020
krizhanovsky added a commit to tempesta-tech/tempesta-test that referenced this issue Dec 13, 2020
@krizhanovsky
Fix tls.test_tls_integrity.Proxy.test_tcp_segs
2a13877 
tempesta-tech/tempesta#1325 :
the test originally didn't consider the TLS handshake
overhead.
@krizhanovsky
Copy link
Contributor Author

There is actually not problem: the first segment is TCP SYN-ACK, the 2nd and 3rd segments from Tempesta TLS are the handshake messages. I fixed the test in tempesta-tech/tempesta-test@2a13877

@krizhanovsky krizhanovsky mentioned this issue Dec 13, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@krizhanovsky krizhanovsky

Labels
invalid performance question Questions and support tasks test TLS Tempesta TLS module and related issues
Projects
None yet
Milestone
0.7 - HTTP/2
Development

Successfully merging a pull request may close this issue.

Moving away from Scapy-ssl_tls and fix tls/ tests tempesta-tech/tempesta-test
1 participant
@krizhanovsky