Skip to content

Commit 36d128f

Browse files
gojimmypigojimmypi
committed
Introduce sm-cipher workflow tests
1 parent 24eeb72 commit 36d128f

File tree

3 files changed

+266
-0
lines changed

3 files changed

+266
-0
lines changed

‎.github/SECURITY.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
If you discover a vulnerability, please report it to [email protected]
6+
7+
1. Include a detailed description
8+
2. Include method to reproduce and/or method of discovery
9+
3. We will evaluate the report promptly and respond to you with findings.
10+
4. We will credit you with the report if you would like.
11+
12+
**Please keep the vulnerability private** until a fix has been released.

‎.github/workflows/sm-cipher.yml‎

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
name: SM Cipher Test (2 of 2)
2+
#
3+
# Test fetches wolfssl-examples/Arduino and uses local, latest github master branch wolfssl
4+
#
5+
# These 4 workflows across 3 repos are interdependent for the current $REPO_OWNER:
6+
#
7+
# sm-cipher CI Build 1: https://github.com/$REPO_OWNER/wolfssl # /.github/workflows/sm-cipher.yml
8+
# - Builds SM-enabled library from local clone of wolfssl master branch
9+
# - Fetches examples from https://github.com/$REPO_OWNER/wolfsm
10+
#
11+
# THIS sm-cipher CI Build 2: https://github.com/$REPO_OWNER/wolfsm # /.github/workflows/sm-cipher.yml
12+
# - Builds SM-enabled library from fresh clone of wolfssl master branch here
13+
#
14+
# ** NOTE TO MAINTAINERS **
15+
#
16+
# Consider using winmerge or similar tool to keep the 2 sm-cipher.yml files in relative sync.
17+
# Although there are some specific differences, most of the contents are otherwise identical.
18+
#
19+
20+
# START OF COMMON SECTION
21+
on:
22+
push:
23+
branches: [ '**', 'master', 'main', 'release/**' ]
24+
paths:
25+
- '.github/workflows/sm-cipher.yml'
26+
- 'src/**'
27+
- 'wolfcrypt/**'
28+
- 'wolfssl/**'
29+
pull_request:
30+
# Run after merge on protected branches
31+
branches: [ "main", "master", "release/**" ]
32+
paths:
33+
- '.github/workflows/sm-cipher.yml'
34+
- 'src/**'
35+
- 'wolfcrypt/**'
36+
- 'wolfssl/**'
37+
workflow_dispatch:
38+
39+
concurrency:
40+
group: ${{ github.workflow }}-${{ github.ref }}
41+
cancel-in-progress: true
42+
# END OF COMMON SECTION
43+
44+
jobs:
45+
build:
46+
# TODO:
47+
# if: github.repository_owner == 'wolfssl'
48+
runs-on: ubuntu-latest
49+
env:
50+
REPO_OWNER: ${{ github.repository_owner }}
51+
steps:
52+
- name: Checkout Repository
53+
uses: actions/checkout@v4
54+
55+
- name: Set job environment variables
56+
run: |
57+
# Script to assign some common environment variables after everything is installed
58+
59+
ICON_OK=$(printf "\xE2\x9C\x85")
60+
ICON_FAIL=$(printf "\xE2\x9D\x8C")
61+
62+
# Show predefined summary:
63+
64+
# For the wolfssl repo, the GITHUB_WORKSPACE is the directory of wolfssl
65+
echo "GITHUB_WORKSPACE = $GITHUB_WORKSPACE"
66+
67+
# Show assigned build:env values (e.g. "wolfssl", "gojimmpi" or other owners):
68+
echo "REPO_OWNER = $REPO_OWNER"
69+
70+
# Update environment variables, not available here in this step yet
71+
echo "GITHUB_WORK=$(realpath "$GITHUB_WORKSPACE/../..")" >> "$GITHUB_ENV"
72+
echo "WOLFSM_ROOT=$(realpath "$GITHUB_WORKSPACE/../wolfsm")" >> "$GITHUB_ENV"
73+
echo "WOLFSSL_ROOT=$(realpath "$GITHUB_WORKSPACE/../wolfssl")" >> "$GITHUB_ENV"
74+
75+
echo "GITHUB_ENV=$GITHUB_ENV"
76+
77+
echo "contents..."
78+
# typically "/home/runner/work/wolfssl/wolfssl" contains wolfssl source
79+
pwd
80+
ls
81+
82+
- name: Get wolfssl
83+
run: |
84+
# We are in wolfsm repo, fetch wolfssl code
85+
86+
# Show our custom values:
87+
echo "GITHUB_WORK = $GITHUB_WORK"
88+
89+
# WOLFSM_ROOT is the repo root for wolfsm clone
90+
echo "WOLFSM_ROOT = $WOLFSM_ROOT"
91+
92+
echo "Start pwd:"
93+
pwd
94+
# we're typically in $GITHUB_WORKSPACE=/home/runner/work/wolfssl/wolfssl
95+
# goto /home/runner/work to fetch wolfsm
96+
97+
echo "Current pwd for wolfsm clone fetch: $(pwd)"
98+
GITHUB_WORK=$(realpath "$GITHUB_WORKSPACE/../..")
99+
echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE"
100+
101+
102+
pushd ../
103+
echo "Updated pwd for wolfssl clone fetch: $(pwd)"
104+
105+
echo "clone --depth 1 https://github.com/$REPO_OWNER/wolfssl.git wolfssl"
106+
107+
git clone --depth 1 https://github.com/$REPO_OWNER/wolfssl.git wolfssl
108+
109+
cd ./wolfssl
110+
echo "Contents of this path for wolfssl = $(pwd)"
111+
ls
112+
popd
113+
114+
# ** END ** Get wolfssl
115+
116+
- name: Install wolfsm
117+
run: |
118+
# Run the local install.sh install script to install wolfsm code
119+
120+
echo "Current pwd for wolfsm clone fetch: $(pwd)"
121+
GITHUB_WORK=$(realpath "$GITHUB_WORKSPACE/../..")
122+
echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE"
123+
124+
# Typically /home/runner/work
125+
echo "GITHUB_WORK=$GITHUB_WORK"
126+
pwd
127+
echo "pushd $WOLFSM_ROOT"
128+
pushd "$WOLFSM_ROOT"
129+
pwd
130+
ls
131+
132+
echo "wolfssl check"
133+
ls ../wolfssl
134+
135+
echo "Call wolfsm/install.sh to install wolfsm code into $WOLFSSL_ROOT"
136+
./install.sh "$WOLFSSL_ROOT"
137+
popd
138+
139+
echo "contents..."
140+
pwd
141+
ls
142+
143+
# Done with install wolfssl
144+
145+
- name: Compile wolfssl
146+
run: |
147+
# Compile fresh wolfSSL with wolfsm code
148+
149+
cd "$WOLFSSL_ROOT"
150+
echo "Current directory: $PWD"
151+
152+
./autogen.sh
153+
./configure --enable-sm3 --enable-sm4-ecb --enable-sm4-cbc --enable-sm4-ctr --enable-sm4-gcm --enable-sm4-ccm --enable-sm2
154+
make
155+
# Done with compile wolfssl
156+
157+
- name: Test SM wolfcrypt
158+
shell: bash
159+
run: |
160+
# Run client / server tests from cloned wolfssl directory
161+
162+
cd "$WOLFSSL_ROOT"
163+
echo "Current directory: $PWD"
164+
165+
set -euo pipefail
166+
167+
./wolfcrypt/test/testwolfcrypt
168+
169+
- name: Run SM benchmark
170+
shell: bash
171+
run: |
172+
# Run client / server tests from cloned wolfssl directory
173+
174+
cd "$WOLFSSL_ROOT"
175+
echo "Current directory: $PWD"
176+
177+
set -euo pipefail
178+
179+
./wolfcrypt/benchmark/benchmark
180+
181+
- name: Test SM client/server (TLS 1.2 and 1.3)
182+
shell: bash
183+
run: |
184+
# Run client / server tests from cloned wolfssl directory
185+
186+
cd "$WOLFSSL_ROOT"
187+
echo "Current directory: $PWD"
188+
189+
set -euo pipefail
190+
191+
# Parameterized cases
192+
cases=(
193+
"-v 3 -l ECDHE-ECDSA-SM4-CBC-SM3"
194+
"-v 3 -l ECDHE-ECDSA-SM4-GCM-SM3"
195+
"-v 3 -l ECDHE-ECDSA-SM4-CCM-SM3"
196+
"-v 4 -l TLS13-SM4-GCM-SM3"
197+
"-v 4 -l TLS13-SM4-CCM-SM3 "
198+
)
199+
200+
srv_bin=./examples/server/server
201+
cli_bin=./examples/client/client
202+
203+
srv_cert=./certs/sm2/server-sm2.pem
204+
srv_key=./certs/sm2/server-sm2-priv.pem
205+
cli_cert=./certs/sm2/client-sm2.pem
206+
cli_key=./certs/sm2/client-sm2-priv.pem
207+
ca_root=./certs/sm2/root-sm2.pem
208+
209+
# Use an explicit port so we can start/stop cleanly
210+
port=11111
211+
212+
# Ensure background server is cleaned up even on failure
213+
cleanup() { pkill -P $$ || true; }
214+
trap cleanup EXIT
215+
216+
for args in "${cases[@]}"; do
217+
echo "=== Testing: ${args} ==="
218+
219+
# Start server in background
220+
"${srv_bin}" ${args} \
221+
-c "${srv_cert}" -k "${srv_key}" \
222+
-A "${cli_cert}" -V \
223+
-p "${port}" &
224+
srv_pid=$!
225+
226+
# Brief wait for server to bind
227+
sleep 2
228+
229+
# Run client with a hard timeout so CI never hangs
230+
set +e
231+
timeout 60s "${cli_bin}" ${args} \
232+
-h 127.0.0.1 -p "${port}" \
233+
-c "${cli_cert}" -k "${cli_key}" \
234+
-A "${ca_root}" -C
235+
rc=$?
236+
set -e
237+
238+
# Stop server and evaluate result
239+
kill "${srv_pid}" || true
240+
wait "${srv_pid}" || true
241+
242+
if [ ${rc} -ne 0 ]; then
243+
echo "Client failed for: ${args} (rc=${rc})"
244+
exit ${rc}
245+
fi
246+
done

‎.gitignore‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Visual Studio
2+
/.vs
3+
4+
# Visual Studio Code Workspace Files
5+
*.vscode
6+
7+
# Backup files
8+
*.bak

0 commit comments

Comments
 (0)