Skip to content

Commit bca871c

Browse files
gasbytesgasbytes
authored
XMLSec1 testing (#76)
* - add lenient DER parser for ECDSA signatures when we fail with -171, so that we extract the r and s parameters, when the der is malformed when the integer values are raw bytes without proper sign-bit handling (those ders are used when signing/veriffing in the xmlsec1's testsuite); - handle 0-byte cipher finalization in aes-cbc, we return -173 when data size = 0 when decrypting, this gets called by xmlsec1 to flush the buffer after decryption is done (not needed for wolfssl, but we return 0 in that case); * - Added v1.21.4 to the wget workflow - Added v2.6.7 to the openldap workflow * Run wget-v1.21.4 and openldap-v2.6.7 on native ubuntu:24.04 instead of debian:bookworm * - extracted parsing of DER length into a separate function; - removed accidental Tab in the wolfssl-gnutls-wrapper/src/cipher.c file; * - Added proper configurations for versions in wget and openldap that are being tested on ubuntu 24.04. - Wireshark workflow - Removing master version testing from the libjcat workflow. Uses post quantum by default, not currently supported by gnutls-wolfssl. * xmlsec workflow * - return statesments on new lines; - return -1 on num_bytes = 0 (unsupported);
1 parent 35d5af0 commit bca871c

7 files changed

Lines changed: 558 additions & 57 deletions

File tree

‎.github/workflows/libjcat.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
strategy:
2020
matrix:
2121
os: [ ubuntu-latest ]
22-
libjcat_ref: [ 'master', '0.2.3', '0.2.0' ]
22+
libjcat_ref: [ '0.2.3', '0.2.0' ]
2323
fail-fast: false
2424
runs-on: ${{ matrix.os }}
2525
container:

‎.github/workflows/openldap.yml‎

Lines changed: 85 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,92 +1,151 @@
11
name: OpenLDAP Test
2-
32
# START OF COMMON SECTION
43
on:
54
push:
65
branches: [ 'master', 'main', 'release/**' ]
76
pull_request:
87
branches: [ '*' ]
9-
108
concurrency:
119
group: ${{ github.workflow }}-${{ github.ref }}
1210
cancel-in-progress: true
1311
# END OF COMMON SECTION
14-
1512
jobs:
1613
build_gnutls:
1714
name: Build wolfSSL, GnuTLS and provider
1815
timeout-minutes: 30
1916
strategy:
2017
matrix:
21-
os: [ ubuntu-latest ]
22-
openldap_ref: [ 'master', 'OPENLDAP_REL_ENG_2_5_13', 'OPENLDAP_REL_ENG_2_6_9' ]
18+
include:
19+
- os: ubuntu-latest
20+
openldap_ref: 'master'
21+
use_container: true
22+
- os: ubuntu-latest
23+
openldap_ref: 'OPENLDAP_REL_ENG_2_5_13'
24+
use_container: true
25+
- os: ubuntu-24.04
26+
openldap_ref: 'OPENLDAP_REL_ENG_2_6_7'
27+
use_container: false
28+
- os: ubuntu-latest
29+
openldap_ref: 'OPENLDAP_REL_ENG_2_6_9'
30+
use_container: true
2331
fail-fast: false
2432
runs-on: ${{ matrix.os }}
25-
container:
26-
image: debian:bookworm
27-
33+
container: ${{ matrix.use_container && 'debian:bookworm' || '' }}
2834
steps:
2935
- name: Checkout gnutls-wolfssl repository
3036
uses: actions/checkout@v4
31-
32-
- name: Ensure make available (Ubuntu only)
33-
if: matrix.os == 'ubuntu-latest'
37+
- name: Ensure make available
38+
if: matrix.use_container == true
3439
run: |
3540
apt-get update
3641
apt-get install -y build-essential
37-
38-
- name: Install GnuTLS dependencies (Ubuntu only)
39-
if: matrix.os == 'ubuntu-latest'
42+
- name: Install GnuTLS dependencies
43+
if: matrix.use_container == true
4044
run: |
4145
apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang \
4246
libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev sudo \
43-
git wget
47+
git wget automake libtool
4448
45-
- name: Install OpenLDAP dependencies (Ubuntu only)
46-
if: matrix.os == 'ubuntu-latest'
49+
- name: Install OpenLDAP dependencies
50+
if: matrix.use_container == true
4751
run: |
4852
sudo apt-get install -y libsasl2-dev libsasl2-modules libsasl2-modules-gssapi-mit \
4953
libargon2-dev groff-base libltdl-dev
5054
51-
# ───────────── cache the wolfssl/gnutls tool-chain ─────────────
55+
- name: Install dependencies on native Ubuntu
56+
if: matrix.use_container == false
57+
run: |
58+
sudo apt-get update
59+
sudo apt-get install -y build-essential gnulib autopoint gperf gtk-doc-tools nettle-dev clang \
60+
libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev \
61+
git wget libsasl2-dev libsasl2-modules libsasl2-modules-gssapi-mit \
62+
libargon2-dev groff-base libltdl-dev automake libtool
63+
64+
- name: Prepare cache directories (native runner)
65+
if: matrix.use_container == false
66+
run: |
67+
sudo mkdir -p /opt/gnutls /opt/wolfssl /opt/wolfssl-gnutls-wrapper
68+
sudo chown -R $USER:$USER /opt/gnutls /opt/wolfssl /opt/wolfssl-gnutls-wrapper
69+
70+
# ───────────── cache the wolfssl/gnutls tool-chain ─────────────
5271
- name: Restore cached gnutls-wolfssl
5372
id: cache-gnutls
5473
uses: actions/cache@v4
5574
with:
5675
path: |
57-
/opt/gnutls
58-
/opt/wolfssl
59-
/opt/wolfssl-gnutls-wrapper
60-
key: gnutls-wolfssl-${{ runner.os }}-${{ hashFiles('setup.sh', 'wolfssl-gnutls-wrapper/**', 'wolfssl/**', 'gnutls/**') }}
76+
${{ matrix.use_container && '/opt/gnutls' || '~/cache/gnutls' }}
77+
${{ matrix.use_container && '/opt/wolfssl' || '~/cache/wolfssl' }}
78+
${{ matrix.use_container && '/opt/wolfssl-gnutls-wrapper' || '~/cache/wolfssl-gnutls-wrapper' }}
79+
key: gnutls-wolfssl-${{ runner.os }}-${{ matrix.use_container }}-${{ hashFiles('setup.sh', 'wolfssl-gnutls-wrapper/**', 'wolfssl/**', 'gnutls/**') }}
6180
restore-keys: |
62-
gnutls-wolfssl-${{ runner.os }}-
81+
gnutls-wolfssl-${{ runner.os }}-${{ matrix.use_container }}-
82+
83+
- name: Copy cache to /opt (native runner only)
84+
if: matrix.use_container == false && steps.cache-gnutls.outputs.cache-hit == 'true'
85+
run: |
86+
sudo mkdir -p /opt
87+
sudo cp -a ~/cache/gnutls /opt/
88+
sudo cp -a ~/cache/wolfssl /opt/
89+
sudo cp -a ~/cache/wolfssl-gnutls-wrapper /opt/
6390
6491
- name: Build GnuTLS with wolfSSL provider using setup.sh script
6592
if: steps.cache-gnutls.outputs.cache-hit != 'true'
6693
run: |
6794
echo "Running setup.sh..."
6895
GNUTLS_INSTALL=/opt/gnutls WOLFSSL_INSTALL=/opt/wolfssl ./setup.sh
96+
# For native runner: also save to cache location
97+
if [[ "${{ matrix.use_container }}" == "false" ]]; then
98+
mkdir -p ~/cache
99+
sudo cp -a /opt/gnutls ~/cache/
100+
sudo cp -a /opt/wolfssl ~/cache/
101+
sudo cp -a /opt/wolfssl-gnutls-wrapper ~/cache/
102+
sudo chown -R $(id -u):$(id -g) ~/cache
103+
fi
69104
70105
- name: Check setup.sh output directories
71106
run: |
72107
test -d /opt/wolfssl || { echo "/opt/wolfssl missing"; exit 1; }
73108
test -d /opt/gnutls || { echo "/opt/gnutls missing"; exit 1; }
74109
test -d /opt/wolfssl-gnutls-wrapper/lib || { echo "/opt/wolfssl-gnutls-wrapper/lib missing"; exit 1; }
75-
76110
- name: Build OpenLDAP at ${{ matrix.openldap_ref }}
77111
run: |
78112
git clone https://git.openldap.org/openldap/openldap.git
79113
cd openldap
80114
if [ "${{ matrix.openldap_ref }}" != "master" ]; then
81115
git checkout ${{ matrix.openldap_ref }}
82116
fi
83-
84117
- name: Configure OpenLDAP
85118
working-directory: openldap
86119
run: |
87120
export PKG_CONFIG_PATH=/opt/gnutls/lib/pkgconfig
88121
export CPPFLAGS=-I/opt/gnutls/include
89122
export LDFLAGS="-L/opt/gnutls/lib -Wl,-rpath,/opt/gnutls/lib"
123+
if [[ "${{ matrix.openldap_ref }}" = "OPENLDAP_REL_ENG_2_6_7" ]]; then
124+
./configure \
125+
ac_cv_func_memcmp_working=yes \
126+
lt_cv_dlopen_self=yes \
127+
--with-yielding-select=yes \
128+
--enable-dynamic \
129+
--enable-crypt \
130+
--with-tls=gnutls \
131+
--with-cyrus-sasl \
132+
--enable-otp \
133+
--with-argon2=libargon2 \
134+
--enable-argon2 \
135+
--enable-ppolicy \
136+
--enable-remoteauth \
137+
--prefix=/opt/openldap \
138+
--enable-modules \
139+
--enable-ipv6 \
140+
--enable-asyncmeta=mod \
141+
--enable-mdb=yes \
142+
--enable-ldap=mod \
143+
--enable-meta=mod \
144+
--enable-null=mod \
145+
--enable-passwd=mod \
146+
--enable-proxycache=mod \
147+
--enable-dnssrv=mod
148+
else
90149
./configure \
91150
--with-tls=gnutls \
92151
--with-cyrus-sasl \
@@ -97,13 +156,12 @@ jobs:
97156
--enable-remoteauth \
98157
--prefix=/opt/openldap \
99158
--enable-modules
100-
159+
fi
101160
- name: Build OpenLDAP
102161
working-directory: openldap
103162
run: |
104163
make depend
105164
make
106-
107165
- name: Test OpenLDAP
108166
working-directory: openldap
109167
run: |

‎.github/workflows/wget.yml‎

Lines changed: 68 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -18,53 +18,84 @@ jobs:
1818
timeout-minutes: 20
1919
strategy:
2020
matrix:
21-
os: [ ubuntu-latest ]
22-
wget_ref: [ 'master', 'v1.21.3', 'v1.24.5' ]
21+
include:
22+
- os: ubuntu-latest
23+
wget_ref: 'master'
24+
use_container: true
25+
- os: ubuntu-latest
26+
wget_ref: 'v1.21.3'
27+
use_container: true
28+
- os: ubuntu-24.04
29+
wget_ref: 'v1.21.4'
30+
use_container: false
31+
- os: ubuntu-latest
32+
wget_ref: 'v1.24.5'
33+
use_container: true
2334
fail-fast: false
2435
runs-on: ${{ matrix.os }}
25-
container:
26-
image: debian:bookworm
36+
container: ${{ matrix.use_container && 'debian:bookworm' || '' }}
2737

2838
steps:
2939
- name: Checkout gnutls-wolfssl repository
3040
uses: actions/checkout@v4
3141

32-
- name: Ensure make available (Ubuntu only)
33-
if: matrix.os == 'ubuntu-latest'
42+
- name: Ensure make available
43+
if: matrix.use_container == true
3444
run: |
3545
apt-get update
3646
apt-get install -y build-essential
37-
38-
- name: Install GnuTLS dependencies (Ubuntu only)
39-
if: matrix.os == 'ubuntu-latest'
47+
- name: Install GnuTLS dependencies
48+
if: matrix.use_container == true
4049
run: |
4150
apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang \
4251
libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev \
4352
sudo wget git flex
44-
45-
- name: Install wget dependencies (Ubuntu only)
46-
if: matrix.os == 'ubuntu-latest'
53+
- name: Install wget dependencies
54+
if: matrix.use_container == true
4755
run: |
4856
sudo apt-get install -y autoconf-archive libhttp-daemon-perl
57+
- name: Install dependencies on native Ubuntu
58+
if: matrix.use_container == false
59+
run: |
60+
sudo apt-get update
61+
sudo apt-get install -y build-essential gnulib autopoint gperf gtk-doc-tools nettle-dev clang \
62+
libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev \
63+
wget git flex autoconf-archive libhttp-daemon-perl
4964
50-
# ───────────── cache the wolfssl/gnutls tool-chain ─────────────
65+
# ───────────── cache the wolfssl/gnutls tool-chain ─────────────
5166
- name: Restore cached gnutls-wolfssl
5267
id: cache-gnutls
5368
uses: actions/cache@v4
5469
with:
5570
path: |
56-
/opt/gnutls
57-
/opt/wolfssl
58-
/opt/wolfssl-gnutls-wrapper
59-
key: gnutls-wolfssl-${{ runner.os }}-${{ hashFiles('setup.sh', 'wolfssl-gnutls-wrapper/**', 'wolfssl/**', 'gnutls/**') }}
71+
${{ matrix.use_container && '/opt/gnutls' || '~/cache/gnutls' }}
72+
${{ matrix.use_container && '/opt/wolfssl' || '~/cache/wolfssl' }}
73+
${{ matrix.use_container && '/opt/wolfssl-gnutls-wrapper' || '~/cache/wolfssl-gnutls-wrapper' }}
74+
key: gnutls-wolfssl-${{ runner.os }}-${{ matrix.use_container }}-${{ hashFiles('setup.sh', 'wolfssl-gnutls-wrapper/**', 'wolfssl/**', 'gnutls/**') }}
6075
restore-keys: |
61-
gnutls-wolfssl-${{ runner.os }}-
76+
gnutls-wolfssl-${{ runner.os }}-${{ matrix.use_container }}-
77+
78+
- name: Copy cache to /opt (native runner only)
79+
if: matrix.use_container == false && steps.cache-gnutls.outputs.cache-hit == 'true'
80+
run: |
81+
sudo mkdir -p /opt
82+
sudo cp -a ~/cache/gnutls /opt/
83+
sudo cp -a ~/cache/wolfssl /opt/
84+
sudo cp -a ~/cache/wolfssl-gnutls-wrapper /opt/
6285
6386
- name: Build GnuTLS with wolfSSL provider using setup.sh script
6487
if: steps.cache-gnutls.outputs.cache-hit != 'true'
6588
run: |
6689
echo "Running setup.sh..."
6790
GNUTLS_INSTALL=/opt/gnutls WOLFSSL_INSTALL=/opt/wolfssl ./setup.sh
91+
# For native runner: also save to cache location
92+
if [[ "${{ matrix.use_container }}" == "false" ]]; then
93+
mkdir -p ~/cache
94+
sudo cp -a /opt/gnutls ~/cache/
95+
sudo cp -a /opt/wolfssl ~/cache/
96+
sudo cp -a /opt/wolfssl-gnutls-wrapper ~/cache/
97+
sudo chown -R $(id -u):$(id -g) ~/cache
98+
fi
6899
69100
- name: Check setup.sh output directories
70101
run: |
@@ -74,7 +105,6 @@ jobs:
74105
test -d /opt/gnutls || exit 1
75106
echo "Check for wrapper installation..."
76107
test -d /opt/wolfssl-gnutls-wrapper/lib || exit 1
77-
78108
- name: Build wget at ${{ matrix.wget_ref }}
79109
uses: actions/checkout@v4
80110
with:
@@ -93,33 +123,39 @@ jobs:
93123
git clone https://github.com/coreutils/gnulib gnulib
94124
./bootstrap
95125
autoreconf -fi
96-
./configure --with-ssl=gnutls --with-libgnutls-prefix=/opt/gnutls
97-
126+
if [[ "${{ matrix.wget_ref }}" = "v1.21.4" ]]; then
127+
./configure --with-ssl=gnutls --with-libgnutls-prefix=/opt/gnutls \
128+
--without-libssl-prefix \
129+
--disable-rpath \
130+
--with-ssl=gnutls \
131+
--enable-pcre \
132+
--with-zlib \
133+
--enable-ipv6
134+
else
135+
./configure --with-ssl=gnutls --with-libgnutls-prefix=/opt/gnutls
136+
fi
98137
- name: Make wget
99138
working-directory: wget
100139
run: |
101140
make -j $(nproc)
102-
103141
# Get python 3.11 for old versions of wget
104142
- name: Install pyenv dependencies
105-
if: matrix.wget_ref == 'v1.21.3'
143+
if: matrix.wget_ref == 'v1.21.3' || matrix.wget_ref == 'v1.21.4'
106144
run: |
107145
sudo apt-get update
108146
sudo apt-get install -y make build-essential libssl-dev zlib1g-dev \
109147
libbz2-dev libreadline-dev libsqlite3-dev wget curl llvm \
110148
libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev \
111149
libffi-dev liblzma-dev
112-
113150
- name: Install pyenv
114-
if: matrix.wget_ref == 'v1.21.3'
151+
if: matrix.wget_ref == 'v1.21.3' || matrix.wget_ref == 'v1.21.4'
115152
run: |
116153
curl https://pyenv.run | bash
117-
118154
- name: Test wget
119155
working-directory: wget
120156
run: |
121157
# If Python 3.11 needed, reinitialize pyenv
122-
if [ "${{ matrix.wget_ref }}" = "v1.21.3" ]; then
158+
if [[ "${{ matrix.wget_ref }}" = "v1.21.3" || "${{ matrix.wget_ref }}" = "v1.21.4" ]]; then
123159
export PYENV_ROOT="$HOME/.pyenv"
124160
export PATH="$PYENV_ROOT/bin:$PATH"
125161
eval "$(pyenv init --path)"
@@ -128,5 +164,10 @@ jobs:
128164
pyenv global 3.11.9
129165
python --version
130166
fi
167+
# To make /opt/gnutls visible to the test binaries, LD_LIBRARY_PATH
168+
# is needed since we disable rpath for v1.21.4.
169+
if [[ "${{ matrix.wget_ref }}" = "v1.21.4" ]]; then
170+
export LD_LIBRARY_PATH=/opt/gnutls/lib:/opt/wolfssl/lib:/opt/wolfssl-gnutls-wrapper/lib:$LD_LIBRARY_PATH
171+
fi
131172
make check
132173
find . -name '*.log' | xargs grep wgw

0 commit comments

Comments
 (0)