157 lines
4 KiB
Markdown
157 lines
4 KiB
Markdown
# TLS
|
|
|
|
### WolfSSL
|
|
|
|
```bash
|
|
git clone https://github.com/wolfSSL/wolfssl --depth 1
|
|
cd wolfssl
|
|
sh autogen.sh
|
|
./configure --enable-all --enable-all-crypto --disable-shared --prefix=/opt/wolfssl-rs/
|
|
make
|
|
sudo make install
|
|
```
|
|
|
|
## Reproduce
|
|
|
|
### Record
|
|
|
|
On the controler machine.
|
|
|
|
#### Installation
|
|
|
|
Build netreplay and copy it in this folder.
|
|
|
|
Authorize netreplay to bind to ports 80 and 443:
|
|
```bash
|
|
sudo setcap CAP_NET_BIND_SERVICE=+eip netreplay
|
|
```
|
|
|
|
Open Firefox with a dedicated profile: (create the profile using the GUI if it doesn't exist)
|
|
|
|
```bash
|
|
firefox -P tlsbench
|
|
```
|
|
|
|
In settings, disable DNS security.
|
|
|
|
In `about:config`, set `network.dns.forceResolve` to `127.0.0.1`.
|
|
|
|
Run the shell command:
|
|
|
|
```bash
|
|
python exp.py make debug -c
|
|
```
|
|
|
|
In Firefox, go to security settings, Certificates, import `/dev/shm/exp/certs/prime256v1/ca.crt` and trust it for identifying websites.
|
|
|
|
#### After installation
|
|
|
|
Stop anything running on ports 80 or 443.
|
|
|
|
Start the record proxy:
|
|
|
|
```bash
|
|
./netreplay records/mynewrecord record
|
|
```
|
|
|
|
Just browse. Any traffic will be recorded. Terminate netplayer with CTRL+C when finished.
|
|
|
|
### Measure
|
|
|
|
Copy the tlsbench folder on the target.
|
|
Build netreplay with the wanted cryptographic backends on the target (one build per backend), and place each version in tlsbench, named `netreplay-aws-lc`, `netreplay-boring`, etc.
|
|
|
|
Install dependencies on the target:
|
|
|
|
```bash
|
|
sudo apt install acct dtach
|
|
sudo chmod +s /sbin/sa
|
|
```
|
|
|
|
Modify experiment parameters at the top of `exp.py` to suit your setup and the wanted experiments.
|
|
|
|
Run:
|
|
|
|
```bash
|
|
python exp.py make pi3 -c
|
|
python exp.py send pi3
|
|
python exp.py run pi3 --idle
|
|
```
|
|
|
|
It may be needed to keep an SSH connection to the target open during the experiment, and to set `RemoveIPC=no` in `/etc/systemd/logind.conf` (then `systemctl restart systemd-logind`).
|
|
|
|
### Profile
|
|
|
|
Profile code execution on the local machine.
|
|
|
|
Install sa:
|
|
|
|
```bash
|
|
sudo apt install acct dtach python3-invoke python3-fabric
|
|
sudo chmod +s /sbin/sa
|
|
```
|
|
|
|
Install OpenSSL with debug symbols:
|
|
|
|
```bash
|
|
# Options from Debian build
|
|
# Debian package libssl3t64 -> Developer Information -> buildd reproducibility -> trixie rbuild
|
|
# https://tests.reproducible-builds.org/debian/rb-pkg/trixie/amd64/openssl.html
|
|
/usr/bin/perl ./Configure --release -g --prefix=/usr --openssldir=/usr/lib/ssl --libdir=lib/x86_64-linux-gnu shared no-idea no-mdc2 no-rc5 no-ssl3 no-ssl3-method enable-rfc3779 enable-cms no-capieng no-rdrand enable-tfo enable-zstd enable-zlib enable-fips enable-ec_nistp_64_gcc_128
|
|
# Or, if OpenSSL 1.1:
|
|
/usr/bin/perl ./Configure --release -g --prefix=/usr --openssldir=/usr/lib/ssl --libdir=lib/x86_64-linux-gnu shared no-idea no-mdc2 no-rc5 no-ssl3 no-ssl3-method enable-rfc3779 enable-cms no-capieng no-rdrand enable-zlib enable-ec_nistp_64_gcc_128 linux-x86_64
|
|
```
|
|
|
|
To build netreplay with this openssl:
|
|
|
|
```bash
|
|
OPENSSL_LIB_DIR=/home/pi/reps/openssl-openssl-3.6.1/ OPENSSL_DIR=/home/pi/reps/openssl-openssl-3.6.1/ cargo build --release
|
|
```
|
|
|
|
Authorize non-root users to use perf:
|
|
|
|
```bash
|
|
sudo sysctl kernel.perf_event_paranoid=-1
|
|
```
|
|
|
|
Run:
|
|
|
|
```bash
|
|
python exp.py make local -c
|
|
python exp.py run local
|
|
python plots.py prof <path/to/log>
|
|
```
|
|
|
|
### RAPL
|
|
|
|
```bash
|
|
gcc -O3 powercap.c -o powercap
|
|
sudo chown root powercap
|
|
sudo chmod u+s powercap
|
|
```
|
|
|
|
### Grid5000
|
|
|
|
```bash
|
|
ssh nancy.g5k
|
|
oarsub -q default -l host=2,walltime=2 -p "wattmeter=YES" -I
|
|
# Check the name of the other node in https://intranet.grid5000.fr/oar/Lyon/drawgantt-svg/
|
|
# Let's call them p1 and p2
|
|
ping p2
|
|
# Note p2 addr to exp.py
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
|
|
pip3 install fabric
|
|
python exp.py make g5k -c
|
|
python exp.py send g5k
|
|
|
|
# Notes
|
|
scp /lib/x86_64-linux-gnu/libssl.so.3.6 nancy.g5k:~/
|
|
scp /lib/x86_64-linux-gnu/libcrypto.so.3.6 nancy.g5k:~/
|
|
scp records/wikipedia nancy.g5k:tlsbench/records/
|
|
```
|
|
|
|
#### Wattmetre
|
|
|
|
API timestamp at Paris time.
|
|
|
|
https://api.grid5000.fr/stable/sites/nancy/metrics?nodes=gros-69&metrics=bmc_node_power_watt&start_time=2026-02-26T14:00&end_time=2026-02-26T14:40
|