From 4bb369c4eb155711099fca602d16761831532168 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sat, 29 Oct 2022 17:44:19 +0200 Subject: [PATCH 1/4] Always enable MBEDTLS_TEST_HOOKS in TLS 1.3-only test configurations MBEDTLS_TEST_HOOKS is not supposed to change the behavior of the library, so it's generally good to have it on in functional tests. Signed-off-by: Gilles Peskine --- tests/configs/tls13-only.h | 5 +++++ tests/scripts/all.sh | 16 ++-------------- 2 files changed, 7 insertions(+), 14 deletions(-) diff --git a/tests/configs/tls13-only.h b/tests/configs/tls13-only.h index 0a22c544b7..7483f1cd97 100644 --- a/tests/configs/tls13-only.h +++ b/tests/configs/tls13-only.h @@ -22,9 +22,11 @@ * limitations under the License. */ +/* Enable TLS 1.3 and core 1.3 features */ #define MBEDTLS_SSL_PROTO_TLS1_3 #define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE +/* Disable TLS 1.2 and 1.2-specific features */ #undef MBEDTLS_SSL_ENCRYPT_THEN_MAC #undef MBEDTLS_SSL_EXTENDED_MASTER_SECRET #undef MBEDTLS_SSL_PROTO_TLS1_2 @@ -32,3 +34,6 @@ #undef MBEDTLS_SSL_DTLS_ANTI_REPLAY #undef MBEDTLS_SSL_DTLS_HELLO_VERIFY #undef MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + +/* Enable some invasive tests */ +#define MBEDTLS_TEST_HOOKS diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index e8f1726076..6e1d4014a0 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -3248,8 +3248,8 @@ component_test_tls13_only () { msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3, without MBEDTLS_SSL_PROTO_TLS1_2" make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" - msg "test_suite_ssl: TLS 1.3 only, all key exchange modes enabled" - cd tests; ./test_suite_ssl; cd .. + msg "test: TLS 1.3 only, all key exchange modes enabled" + make test msg "ssl-opt.sh: TLS 1.3 only, all key exchange modes enabled" tests/ssl-opt.sh @@ -3334,18 +3334,6 @@ component_test_tls13_only_ephemeral_all () { tests/ssl-opt.sh } -component_test_tls13_only_with_hooks () { - msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3 and MBEDTLS_TEST_HOOKS, without MBEDTLS_SSL_PROTO_TLS1_2" - scripts/config.py set MBEDTLS_TEST_HOOKS - make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" - - msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, without MBEDTLS_SSL_PROTO_TLS1_2" - if_build_succeeded make test - - msg "ssl-opt.sh (TLS 1.3)" - if_build_succeeded tests/ssl-opt.sh -} - component_test_tls13 () { msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, without padding" scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3 From 8a4fd0e7a9b04b82cf6331b54cd5b296fe9cb8d3 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sat, 29 Oct 2022 17:51:19 +0200 Subject: [PATCH 2/4] Remove redundant build-only driver interface component component_build_psa_accel_alg_ecdsa is subsumed by component_test_psa_crypto_config_accel_ecdsa, which has the same configuration and additionally runs the unit tests. Signed-off-by: Gilles Peskine --- tests/scripts/all.sh | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 6e1d4014a0..8231644566 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -2238,25 +2238,6 @@ component_test_psa_crypto_config_chachapoly_disabled() { make test } -# This should be renamed to test and updated once the accelerator ECDSA code is in place and ready to test. -component_build_psa_accel_alg_ecdsa() { - # full plus MBEDTLS_PSA_CRYPTO_CONFIG with PSA_WANT_ALG_ECDSA - # without MBEDTLS_ECDSA_C - # PSA_WANT_ALG_ECDSA and PSA_WANT_ALG_DETERMINISTIC_ECDSA are already - # set in include/psa/crypto_config.h - msg "build: full + MBEDTLS_PSA_CRYPTO_CONFIG + PSA_WANT_ALG_ECDSA without MBEDTLS_ECDSA_C" - scripts/config.py full - scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG - scripts/config.py set MBEDTLS_PSA_CRYPTO_DRIVERS - scripts/config.py unset MBEDTLS_USE_PSA_CRYPTO - scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 - scripts/config.py unset MBEDTLS_ECDSA_C - scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED - scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - # Need to define the correct symbol and include the test driver header path in order to build with the test driver - make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_ECDSA -DMBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA -I../tests/include -O2" LDFLAGS="$ASAN_CFLAGS" -} - # This should be renamed to test and updated once the accelerator ECDH code is in place and ready to test. component_build_psa_accel_alg_ecdh() { # full plus MBEDTLS_PSA_CRYPTO_CONFIG with PSA_WANT_ALG_ECDH From 78e06a1054d89a2db0eadfee219c9127b39272ea Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sat, 29 Oct 2022 17:55:11 +0200 Subject: [PATCH 3/4] Remove redundant TLS 1.3 components * component_test_tls13_with_padding: just explicitly sets some options that are identical with full. * component_test_tls13_with_ecp_restartable: redundant since TLS 1.3 doesn't have any support for restartable ECC. * component_test_tls13_with_everest: not useful since TLS 1.3 doesn't call ECDH directly, it just relies on the PSA abstraction. Signed-off-by: Gilles Peskine --- tests/scripts/all.sh | 40 ---------------------------------------- 1 file changed, 40 deletions(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 8231644566..12affa19f5 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -3341,46 +3341,6 @@ component_test_tls13_no_compatibility_mode () { tests/ssl-opt.sh } -component_test_tls13_with_padding () { - msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, with padding" - scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3 - scripts/config.py set MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE - scripts/config.py set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 16 - CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan . - make - msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, with padding" - make test - msg "ssl-opt.sh (TLS 1.3 with padding)" - tests/ssl-opt.sh -} - -component_test_tls13_with_ecp_restartable () { - msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, with ecp_restartable" - scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3 - scripts/config.py set MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE - scripts/config.py set MBEDTLS_ECP_RESTARTABLE - CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan . - make - msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, with ecp_restartable" - make test - msg "ssl-opt.sh (TLS 1.3 with ecp_restartable)" - tests/ssl-opt.sh -} - -component_test_tls13_with_everest () { - msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, with Everest" - scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3 - scripts/config.py set MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE - scripts/config.py set MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED - scripts/config.py unset MBEDTLS_ECP_RESTARTABLE - CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan . - make - msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, with Everest" - make test - msg "ssl-opt.sh (TLS 1.3 with everest)" - tests/ssl-opt.sh -} - component_build_mingw () { msg "build: Windows cross build - mingw64, make (Link Library)" # ~ 30s make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall -Wextra' WINDOWS_BUILD=1 lib programs From da6017cbe340ab9907e4882816c3ffdbfa1bf815 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sun, 30 Oct 2022 21:02:40 +0100 Subject: [PATCH 4/4] Group cpp_dummy_build test into an existing component No need to do yet another build just to compile an additional trivial program. Signed-off-by: Gilles Peskine --- tests/scripts/all.sh | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 12affa19f5..9295c9d00f 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -1542,12 +1542,15 @@ component_test_psa_collect_statuses () { component_test_full_cmake_clang () { msg "build: cmake, full config, clang" # ~ 50s scripts/config.py full - CC=clang cmake -D CMAKE_BUILD_TYPE:String=Release -D ENABLE_TESTING=On . + CC=clang CXX=clang cmake -D CMAKE_BUILD_TYPE:String=Release -D ENABLE_TESTING=On -D TEST_CPP=1 . make msg "test: main suites (full config, clang)" # ~ 5s make test + msg "test: cpp_dummy_build (full config, clang)" # ~ 1s + programs/test/cpp_dummy_build + msg "test: psa_constant_names (full config, clang)" # ~ 1s tests/scripts/test_psa_constant_names.py @@ -1842,15 +1845,6 @@ component_test_depends_py_pkalgs_psa () { tests/scripts/depends.py pkalgs } -component_test_make_cxx () { - msg "build: Unix make, full, gcc + g++" - scripts/config.py full - make TEST_CPP=1 lib programs - - msg "test: cpp_dummy_build" - programs/test/cpp_dummy_build -} - component_build_module_alt () { msg "build: MBEDTLS_XXX_ALT" # ~30s scripts/config.py full