s2n-tls handshake benchmark (#4053)

bindings/rust/Cargo.toml

@@ -9,7 +9,8 @@ members = [
 # s2n-tls-sys/Cargo.toml (part of the workspace) is generated by
 # generate/main.rs
 exclude = [
-    "generate"
+    "generate",
+    "bench"
 ]
 
 [profile.release]

bindings/rust/bench/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "bench"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+s2n-tls = { path = "../s2n-tls" }
+errno = "0.3"
+libc = "0.2"
+criterion = "0.3"
+# release_max_level_off feature removes logging statements in the release build
+log = { version = "0.4", features = [ "release_max_level_off", "max_level_debug" ] }
+
+[[bench]]
+name = "handshake"
+harness = false

bindings/rust/bench/benches/handshake.rs

@@ -0,0 +1,23 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+use bench::{S2NHarness, TlsBenchHarness};
+use criterion::{criterion_group, criterion_main, BatchSize, Criterion};
+
+pub fn criterion_benchmark(c: &mut Criterion) {
+    let mut group = c.benchmark_group("handshake");
+
+    group.bench_function("s2n-tls", |b| {
+        // generate all inputs (s2n-tls objects) before benchmarking handshakes
+        b.iter_batched_ref(
+            || S2NHarness::new(),
+            |s2n_tls| {
+                s2n_tls.handshake().unwrap();
+            },
+            BatchSize::SmallInput,
+        )
+    });
+}
+
+criterion_group!(benches, criterion_benchmark);
+criterion_main!(benches);

bindings/rust/bench/certs/ca-cert.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDnTCCAoUCFHd1xnhLaVEsJVDIz0PHH1mclbPuMA0GCSqGSIb3DQEBCwUAMIGJ
+MQswCQYDVQQGEwJKUDEOMAwGA1UECAwFQ2hpYmExEzARBgNVBAcMCkNoaWJhIENp
+dHkxGDAWBgNVBAoMD1Rlc3NpZXItQXNocG9vbDEYMBYGA1UEAwwPZGV2ZWxvcC5s
+b2NhbGNhMSEwHwYJKoZIhvcNAQkBFhJjYUBkZXZlbG9wLmxvY2FsY2EwIBcNMjMw
+NjA5MTcyNTAyWhgPMjIwMjExMTQxNzI1MDJaMIGJMQswCQYDVQQGEwJKUDEOMAwG
+A1UECAwFQ2hpYmExEzARBgNVBAcMCkNoaWJhIENpdHkxGDAWBgNVBAoMD1Rlc3Np
+ZXItQXNocG9vbDEYMBYGA1UEAwwPZGV2ZWxvcC5sb2NhbGNhMSEwHwYJKoZIhvcN
+AQkBFhJjYUBkZXZlbG9wLmxvY2FsY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQDII4MvapIuBLmDoIn/jeu9xeHqw8vUiPZecg4azweLv6B/QKKQSAXF
+bQA2JVCSHF7gxjHDvOFG3+Kx/RV74hKjHlp2yVMskW1r4e6WCC+duIBgR2y7xfaM
+7C5XKt6DuSexHECmUiU9cG2ZRP8lx8Wclvet9Ob+iP+sx3xQJ8Y0NtLjeo5UCV5X
+CAAVBUHLTypRNSsU6LFxkRjs2JxdjGLG98+ih4VNfc5lUXBJzcrCSLErnaIhvxcz
+X6myHd57eCYsWEsukuGcY+59rgPkxDofK+G/PwMOMVjYeQ1HoR/Ms9+mgN88Udcm
+d9IXCKZh1dmqbBZMOXZi5fjaViO8xhe1AgMBAAEwDQYJKoZIhvcNAQELBQADggEB
+AKA3FgjF97cFyT0EfZfJag3g5sSq1NLqGuAvmtgaUhdqRT2vo5Uuaj+ZqxmFvEll
+tb9zeQgaPksyW+wZ+Lg46qYHhwuInycqke6Sa4FKlQrydThoF9tM1zQtnJqzdX1s
+gcm731nR2O3lYsrfNRasOeB11rk4a14cJRwWk57d8qt/nLwmPMt9dc4IsCmqQw6l
+s0f49lX/PmEenAaO5hfVI7XcasT260L4/NlFA2HzrbGdO+o2aCrSfA5+Qt0PMsjZ
+H2P+1/JefgRyMDG8hk0ev2aoqkGBvZrSJyCI/+EZoJRuS1qPI3S+kHGXkJ3tF4i+
+IeTBeNaFh9ayc/UoUPyved0=
+-----END CERTIFICATE-----

bindings/rust/bench/certs/client-cert.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDuzCCAqOgAwIBAgIUNCurbgaG3FFx/oedAfC+QM7PJI4wDQYJKoZIhvcNAQEL
+BQAwgYkxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hp
+YmEgQ2l0eTEYMBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZl
+bG9wLmxvY2FsY2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYTAg
+Fw0yMzA2MDkxNzI1MDJaGA8yMjAyMTExNDE3MjUwMlowYDELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxDzANBgNVBAoM
+BmNsaWVudDEZMBcGA1UEAwwQY2xpZW50LmxvY2FsaG9zdDB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABPCBEz2mGh83HkcxVHCZeKnQnl4RcJI4kznhAMSGRrFl9yEkbypf
+wrOCTwytVQDn9ZLFR8BRWAlOQvaC7lYN0nVtA0dHpLJEATilvRzf3a4QUznh8Rbp
+svRRUvOXoXWTM6OB7jCB6zAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYDVR0OBBYE
+FAEG/BipFATRiCJUrQTLvrrsxwHMMIGzBgNVHSMEgaswgaihgY+kgYwwgYkxCzAJ
+BgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hpYmEgQ2l0eTEY
+MBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZlbG9wLmxvY2Fs
+Y2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYYIUd3XGeEtpUSwl
+UMjPQ8cfWZyVs+4wDQYJKoZIhvcNAQELBQADggEBAKsuZKK0mBcop0ZakO5tS8pm
+5BLqymrC3yhEoEKTS6Tf6ek+Fr/++3bIiFeU1+X84Pd6/cfHRZp1RHykDPiLZy5S
+xNZr+wsg1Dkx3GT521c/wievUTrqZ0G5/CK5On2jC5ytFHuARF9XNqYM/WhvSHN0
+q/ZLUBqyOOGUsQ5BHatgPuEKXp3n7Qp0yW4Wy/s16f3jRi4KCbGAQC+Q64OXzBzr
+rFMNGrLHJrusv4TIKQ/UR5A4JLuRChk1UdxlErowyID4UOOyzHroK73dFmwg/jGu
+65miqd2SX8KcKC2Jiq+YCAnzIpuigiyz0EgFAV/pdUZB1qP3hEwb4hJItz3vyAo=
+-----END CERTIFICATE-----

bindings/rust/bench/certs/client-key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBuxa4+TKypIlwZT2N3
+G3pMGDTJgrxTCfuc9QX917hf5ulXz915VIJkUcRFe+AXVkOhZANiAATwgRM9phof
+Nx5HMVRwmXip0J5eEXCSOJM54QDEhkaxZfchJG8qX8Kzgk8MrVUA5/WSxUfAUVgJ
+TkL2gu5WDdJ1bQNHR6SyRAE4pb0c392uEFM54fEW6bL0UVLzl6F1kzM=
+-----END PRIVATE KEY-----

bindings/rust/bench/certs/config/ca.cnf

@@ -0,0 +1,13 @@
+[ req ]
+prompt = no
+distinguished_name = ca_distinguished_name
+
+[ ca_distinguished_name ]
+# country name
+C = JP
+# state or province
+ST = Chiba
+L = Chiba City
+O = Tessier-Ashpool
+CN = develop.localca
+emailAddress = [email protected]

bindings/rust/bench/certs/config/client.cnf

@@ -0,0 +1,24 @@
+[req]
+distinguished_name = client_distinguished_name
+prompt = no
+
+# these fields are used to force x509 to v3 certificates
+# rustls will complain otherwise
+x509_extensions = v3_req
+req_extensions = req_ext
+
+[client_distinguished_name]
+countryName = US
+stateOrProvinceName = Washington
+localityName = Seattle
+organizationName = client
+commonName = client.localhost
+
+[v3_req]
+subjectAltName = @alt_names
+
+[req_ext]
+subjectAltName = @alt_names
+
+[alt_names]
+DNS = localhost

bindings/rust/bench/certs/config/server.cnf

@@ -0,0 +1,24 @@
+[req]
+distinguished_name = server_distinguished_name
+prompt = no
+
+# these fields are used to force x509 to v3 certificates
+# rustls will complain otherwise
+x509_extensions = v3_req
+req_extensions = req_ext
+
+[server_distinguished_name]
+countryName = US
+stateOrProvinceName = Washington
+localityName = Seattle
+organizationName = server
+commonName = server.localhost
+
+[v3_req]
+subjectAltName = @alt_names
+
+[req_ext]
+subjectAltName = @alt_names
+
+[alt_names]
+DNS = localhost

bindings/rust/bench/certs/fullchain.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIDuzCCAqOgAwIBAgIUNDIVTXmgX5RATAJujllJQucIu74wDQYJKoZIhvcNAQEL
+BQAwgYkxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hp
+YmEgQ2l0eTEYMBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZl
+bG9wLmxvY2FsY2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYTAg
+Fw0yMzA2MDkxNzI1MDJaGA8yMjAyMTExNDE3MjUwMlowYDELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxDzANBgNVBAoM
+BnNlcnZlcjEZMBcGA1UEAwwQc2VydmVyLmxvY2FsaG9zdDB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABJD8tMww7UbaLR4YF2nR4zIJuYPBvo+4ur334MfX5RSVNSheX0x8
+t6CDzSxQQhURuBZuEPgsxhKKjj9+OAq/jTX2tS/hVfeMUoCyaqoKlNCUDu0EhunH
+51FINWa/ejbQw6OB7jCB6zAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYDVR0OBBYE
+FPxzHMcaw/HlTkUsoljncbhHxRXxMIGzBgNVHSMEgaswgaihgY+kgYwwgYkxCzAJ
+BgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hpYmEgQ2l0eTEY
+MBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZlbG9wLmxvY2Fs
+Y2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYYIUd3XGeEtpUSwl
+UMjPQ8cfWZyVs+4wDQYJKoZIhvcNAQELBQADggEBAAejR6XomhNxTtvKNGA7SgDh
+yeoz9ZQUipu2s4Dfy7Sf3s6NGRF8pL+3RByk5yB87I8YpdfWI0pjSZK1EWVXpwe4
+26E8EwncNVpaXJeI3z4L33IWSMYE+Q1MmduN8EvBtpMRSt06vLHZ+Y+uOZbsdaOq
+ioT4AP6AK7ZJ74STJWJIVMS6pNy9Do6HSAa9RX5+5fkn3gpho+Qtdhq0dRF/8RV6
+c7P79o6Q0SoK99G9WJOzwOkmXR9ytLAKq5GxS7JaxEjShWXc+v0VqEC/94iktXaM
+Bh9ndJPw6NMAhWZONpNqzQIzKKsNXtGqGWzN3Ed6bNnNFQohcZnyu5AT8kf3iQA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDnTCCAoUCFHd1xnhLaVEsJVDIz0PHH1mclbPuMA0GCSqGSIb3DQEBCwUAMIGJ
+MQswCQYDVQQGEwJKUDEOMAwGA1UECAwFQ2hpYmExEzARBgNVBAcMCkNoaWJhIENp
+dHkxGDAWBgNVBAoMD1Rlc3NpZXItQXNocG9vbDEYMBYGA1UEAwwPZGV2ZWxvcC5s
+b2NhbGNhMSEwHwYJKoZIhvcNAQkBFhJjYUBkZXZlbG9wLmxvY2FsY2EwIBcNMjMw
+NjA5MTcyNTAyWhgPMjIwMjExMTQxNzI1MDJaMIGJMQswCQYDVQQGEwJKUDEOMAwG
+A1UECAwFQ2hpYmExEzARBgNVBAcMCkNoaWJhIENpdHkxGDAWBgNVBAoMD1Rlc3Np
+ZXItQXNocG9vbDEYMBYGA1UEAwwPZGV2ZWxvcC5sb2NhbGNhMSEwHwYJKoZIhvcN
+AQkBFhJjYUBkZXZlbG9wLmxvY2FsY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQDII4MvapIuBLmDoIn/jeu9xeHqw8vUiPZecg4azweLv6B/QKKQSAXF
+bQA2JVCSHF7gxjHDvOFG3+Kx/RV74hKjHlp2yVMskW1r4e6WCC+duIBgR2y7xfaM
+7C5XKt6DuSexHECmUiU9cG2ZRP8lx8Wclvet9Ob+iP+sx3xQJ8Y0NtLjeo5UCV5X
+CAAVBUHLTypRNSsU6LFxkRjs2JxdjGLG98+ih4VNfc5lUXBJzcrCSLErnaIhvxcz
+X6myHd57eCYsWEsukuGcY+59rgPkxDofK+G/PwMOMVjYeQ1HoR/Ms9+mgN88Udcm
+d9IXCKZh1dmqbBZMOXZi5fjaViO8xhe1AgMBAAEwDQYJKoZIhvcNAQELBQADggEB
+AKA3FgjF97cFyT0EfZfJag3g5sSq1NLqGuAvmtgaUhdqRT2vo5Uuaj+ZqxmFvEll
+tb9zeQgaPksyW+wZ+Lg46qYHhwuInycqke6Sa4FKlQrydThoF9tM1zQtnJqzdX1s
+gcm731nR2O3lYsrfNRasOeB11rk4a14cJRwWk57d8qt/nLwmPMt9dc4IsCmqQw6l
+s0f49lX/PmEenAaO5hfVI7XcasT260L4/NlFA2HzrbGdO+o2aCrSfA5+Qt0PMsjZ
+H2P+1/JefgRyMDG8hk0ev2aoqkGBvZrSJyCI/+EZoJRuS1qPI3S+kHGXkJ3tF4i+
+IeTBeNaFh9ayc/UoUPyved0=
+-----END CERTIFICATE-----

bindings/rust/bench/certs/generate_certs.sh

@@ -0,0 +1,35 @@
+# immediately bail if any command fails
+set -e
+
+pushd "$(dirname "$0")"
+
+echo "generating CA private key and certificate"
+openssl req -nodes -new -x509 -keyout ca-key.pem -out ca-cert.pem -days 65536 -config config/ca.cnf
+
+# secp384r1 is an arbitrarily chosen curve that is supported by the default
+# security policy in s2n-tls.
+# https://github.com/aws/s2n-tls/blob/main/docs/USAGE-GUIDE.md#chart-security-policy-version-to-supported-curvesgroups
+echo "generating server private key and CSR"
+openssl req  -new -nodes -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout server-key.pem -out server.csr -config config/server.cnf
+
+echo "generating client private key and CSR"
+openssl req  -new -nodes -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout client-key.pem -out client.csr -config config/client.cnf
+
+echo "generating server certificate and signing it"
+openssl x509 -days 65536 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extensions req_ext -extfile config/server.cnf
+
+echo "generating client certificate and signing it"
+openssl x509 -days 65536 -req -in client.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -extensions req_ext -extfile config/client.cnf
+
+echo "verifying generated certificates"
+openssl verify -CAfile ca-cert.pem server-cert.pem
+openssl verify -CAfile ca-cert.pem client-cert.pem
+
+cat server-cert.pem ca-cert.pem > fullchain.pem
+
+echo "cleaning up temporary files"
+rm server.csr
+rm client.csr
+rm ca-key.pem
+
+popd

bindings/rust/bench/certs/server-cert.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDuzCCAqOgAwIBAgIUNDIVTXmgX5RATAJujllJQucIu74wDQYJKoZIhvcNAQEL
+BQAwgYkxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hp
+YmEgQ2l0eTEYMBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZl
+bG9wLmxvY2FsY2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYTAg
+Fw0yMzA2MDkxNzI1MDJaGA8yMjAyMTExNDE3MjUwMlowYDELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxDzANBgNVBAoM
+BnNlcnZlcjEZMBcGA1UEAwwQc2VydmVyLmxvY2FsaG9zdDB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABJD8tMww7UbaLR4YF2nR4zIJuYPBvo+4ur334MfX5RSVNSheX0x8
+t6CDzSxQQhURuBZuEPgsxhKKjj9+OAq/jTX2tS/hVfeMUoCyaqoKlNCUDu0EhunH
+51FINWa/ejbQw6OB7jCB6zAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYDVR0OBBYE
+FPxzHMcaw/HlTkUsoljncbhHxRXxMIGzBgNVHSMEgaswgaihgY+kgYwwgYkxCzAJ
+BgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hpYmEgQ2l0eTEY
+MBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZlbG9wLmxvY2Fs
+Y2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYYIUd3XGeEtpUSwl
+UMjPQ8cfWZyVs+4wDQYJKoZIhvcNAQELBQADggEBAAejR6XomhNxTtvKNGA7SgDh
+yeoz9ZQUipu2s4Dfy7Sf3s6NGRF8pL+3RByk5yB87I8YpdfWI0pjSZK1EWVXpwe4
+26E8EwncNVpaXJeI3z4L33IWSMYE+Q1MmduN8EvBtpMRSt06vLHZ+Y+uOZbsdaOq
+ioT4AP6AK7ZJ74STJWJIVMS6pNy9Do6HSAa9RX5+5fkn3gpho+Qtdhq0dRF/8RV6
+c7P79o6Q0SoK99G9WJOzwOkmXR9ytLAKq5GxS7JaxEjShWXc+v0VqEC/94iktXaM
+Bh9ndJPw6NMAhWZONpNqzQIzKKsNXtGqGWzN3Ed6bNnNFQohcZnyu5AT8kf3iQA=
+-----END CERTIFICATE-----

bindings/rust/bench/certs/server-key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCSl0T2qNjybO7rcLvx
+++vXvjPk98d+YXxGKH+voS+VynS8eOyjcVjJVRYCetXZAlihZANiAASQ/LTMMO1G
+2i0eGBdp0eMyCbmDwb6PuLq99+DH1+UUlTUoXl9MfLegg80sUEIVEbgWbhD4LMYS
+io4/fjgKv4019rUv4VX3jFKAsmqqCpTQlA7tBIbpx+dRSDVmv3o20MM=
+-----END PRIVATE KEY-----

bindings/rust/bench/rust-toolchain

@@ -0,0 +1 @@
+stable

bindings/rust/bench/src/harness.rs

@@ -0,0 +1,25 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+use std::fs::read_to_string;
+
+pub fn read_to_bytes(path: &str) -> Vec<u8> {
+    read_to_string(path).unwrap().into_bytes()
+}
+
+pub enum Mode {
+    Client,
+    Server,
+}
+
+pub trait TlsBenchHarness {
+    /// Initialize buffers, configs, and connections (pre-handshake)
+    fn new() -> Self;
+
+    /// Run handshake on initialized connection
+    /// Returns error if handshake already happened
+    fn handshake(&mut self) -> Result<(), &str>;
+
+    /// Checks if handshake is finished for both client and server
+    fn handshake_completed(&self) -> bool;
+}

bindings/rust/bench/src/lib.rs

@@ -0,0 +1,22 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod harness;
+pub mod s2n_tls;
+pub use crate::{harness::TlsBenchHarness, s2n_tls::S2NHarness};
+
+const SERVER_KEY_PATH: &str = "certs/server-key.pem";
+const SERVER_CERT_CHAIN_PATH: &str = "certs/fullchain.pem";
+const CA_CERT_PATH: &str = "certs/ca-cert.pem";
+
+#[cfg(test)]
+mod tests {
+    use std::path::Path;
+
+    #[test]
+    fn cert_paths_valid() {
+        assert!(Path::new(crate::SERVER_KEY_PATH).exists());
+        assert!(Path::new(crate::SERVER_CERT_CHAIN_PATH).exists());
+        assert!(Path::new(crate::CA_CERT_PATH).exists());
+    }
+}