Tracking issue: Update "default" and "default_fips" to support TLS1.3

[toidiu]

Security issue notifications

As a modern TLS library, s2n-tls aims to provide sane and safe default. The goal of this task is to add TLS1.3 support to the "default" and "default_fips" policies.

Project plan:

• Set up a single GeneralBatch job which tests with a default TLS 1.2 policy. This will preserve majority of the current testing behavior when TLS 1.3 becomes the default. However, due to conditional compilation/feature probing (libcrypto, platform), this does sacrifice some code coverage. We consider this an acceptable risk. test: pin static testing policies to numbered versions #4845
• Add TLS1.3 support to the "default" and "default_fips" policies Ak WIP - adding tls13 to default security policies #4640

Post MVP:

• script to clean up double instances of s2n_config_set_cipher_preferences after auto gen script

 s2n_config_set_cipher_preferences(client_config, s2n_auto_gen_old_default_security_policy());
 s2n_config_set_cipher_preferences(client_config, "20170210");

---

Extra:

Pin to number policy (failed solution):

This solution was trying to pin current tests to the numbered equivalent of the default policy. However, this could cause a regression of "default" policy tests (tests which actually wanted to test the "default" policy). Since there is no easy way to detect these type of tests, we cannot pin tests to a numbered policy without risking regression.

• Pin tests to the old "default" and "default_fips" policies to prevent regression
  • Fix tests which modify the static configs test: avoid mutating static configs in tests #4749
  • Disallow explicit use of the "default" policy test: disallow explict use of "default" policy in tests #4750
    • Revert "test: disallow explict use of "default" policy in tests (#4750)" #4812
  • Disallow implicit use of the "default" and "default_fips" policy
    • manual changes prior to running auto-script test: prepare for auto amending implicit use of "default" security policy #4793
    • s2n_config_new() test: amend implicit use of "default" policy in tests #4778
    • s2n_config_new_minimal()
    • s2n_connection_new()
    • POC
  • Disallow explicit use of the "default_fips" policy test: disallow explict use of "default_fips" policy in tests #4781