diff --git a/.github/workflows/zephyr.yml b/.github/workflows/zephyr.yml index 63ab81c..61de641 100644 --- a/.github/workflows/zephyr.yml +++ b/.github/workflows/zephyr.yml @@ -25,8 +25,6 @@ env: WOLFSSL_REF: master ZEPHYR_REF: v4.4.2 ZEPHYR_SDK: 1.0.1 - # PRs and pushes skip the slow suites; the nightly and manual runs include them. - FULL_RUN: ${{ github.event_name != 'pull_request' && github.event_name != 'push' }} jobs: qemu-x86: @@ -56,14 +54,9 @@ jobs: - name: Unit tests run: | cd "$HOME/zephyrproject" - if [ "$FULL_RUN" = true ]; then - slow=; slow_suites=wolfcert.unit.scep_msg - else - slow="-e slow"; slow_suites= - fi # The EST suite and the sample need the host server "$HOME/zephyr-venv/bin/python" zephyr/scripts/twister \ - -T "${{ github.workspace }}/zephyr/tests" -e est $slow \ + -T "${{ github.workspace }}/zephyr/tests" -e est \ -p qemu_x86 \ -x=EXTRA_ZEPHYR_MODULES=${{ github.workspace }} \ --outdir "$HOME/twister-unit" -vv @@ -74,7 +67,7 @@ jobs: "$HOME/twister-unit/twister.json" \ wolfcert.unit.smoke wolfcert.unit.keygen wolfcert.unit.csr \ wolfcert.unit.csr_attrs wolfcert.unit.store \ - wolfcert.unit.parse_negative $slow_suites \ + wolfcert.unit.parse_negative wolfcert.unit.scep_msg \ --built-only wolfcert.build.no_builtin_transport \ wolfcert.build.rsa_only wolfcert.build.scep_only_rsa \ wolfcert.build.ed448_mldsa diff --git a/docs/CI.md b/docs/CI.md index cee0e21..67b8312 100644 --- a/docs/CI.md +++ b/docs/CI.md @@ -16,7 +16,7 @@ set skips the wolfSSL build entirely. | `nightly.yml` | schedule + dispatch | Re-runs the wolfSSL-variant build matrix against fresh wolfSSL `master`, the macOS extras, and the full negative-config set. Also **reseeds the wolfSSL prefix caches** so the next day's PRs restore instead of build. The feature/config gating itself now runs per-PR (see `pr.yml`). | | `sanitizers.yml` | schedule + dispatch | ASan+UBSan over the full test suite, ThreadSanitizer over the threaded integration roundtrips (against a TSAN-instrumented wolfSSL), and valgrind over a representative subset. | | `interop.yml` | schedule + dispatch | Third-party EST/SCEP interop (openssl, micromdm/scep, globalsign/est, cisco/libest, smallstep/step-ca). Best-effort: a dependency that fails to install makes its script exit 77, which is treated as a neutral skip; a real interop regression fails. | -| `zephyr.yml` | PR + push, schedule + dispatch | Two jobs sharing the west workspace setup (`.github/actions/zephyr-workspace`). The `qemu_x86` job runs the Zephyr module on `qemu_x86`: the unit suites, build-only rows for off-default Kconfig combinations, and an EST enrollment gate plus the sample against a host `wolfcert-server`, including a build of the sample with a custom trust anchor. The `mcxn` job builds the EST sample for `frdm_mcxn947/mcxn947/cpu0` with the SDK's `arm-zephyr-eabi` toolchain; [`zephyr/README.md`](../zephyr/README.md#est-client-sample) lists what CI covers per board. `scripts/ci/twister-assert-ran.py` checks that each step's suites actually ran. The slow `scep_msg` suite runs only on the nightly and on manual dispatch. | +| `zephyr.yml` | PR + push, schedule + dispatch | Two jobs sharing the west workspace setup (`.github/actions/zephyr-workspace`). The `qemu_x86` job runs the Zephyr module on `qemu_x86`: the unit suites, build-only rows for off-default Kconfig combinations, and an EST enrollment gate plus the sample against a host `wolfcert-server`, including a build of the sample with a custom trust anchor. The `mcxn` job builds the EST sample for `frdm_mcxn947/mcxn947/cpu0` with the SDK's `arm-zephyr-eabi` toolchain; [`zephyr/README.md`](../zephyr/README.md#est-client-sample) lists what CI covers per board. `scripts/ci/twister-assert-ran.py` checks that each step's suites actually ran. | ## wolfSSL configurations diff --git a/tests/integration/test_est_async_roundtrip.c b/tests/integration/test_est_async_roundtrip.c index dcc261f..3ad334b 100644 --- a/tests/integration/test_est_async_roundtrip.c +++ b/tests/integration/test_est_async_roundtrip.c @@ -141,6 +141,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, .tls_client_ca_pem = cli_cert, .tls_client_ca_pem_len = cli_cert_len, @@ -200,6 +201,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .http_basic_user = "alice", .http_basic_pass = "hunter2", .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, @@ -272,6 +274,7 @@ int main(void) free(tls_key); free(cli_cert); free(cli_key); + test_ca_store_close(); wolfcert_cleanup(); if (pha_skipped) return 77; diff --git a/tests/integration/test_est_chunked_robustness.c b/tests/integration/test_est_chunked_robustness.c index e48008d..2b60991 100644 --- a/tests/integration/test_est_chunked_robustness.c +++ b/tests/integration/test_est_chunked_robustness.c @@ -398,6 +398,7 @@ static int no_sigpipe_on_response(void) WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .est_allow_anonymous_enroll = 1, }; WolfCertServer* srv = NULL; @@ -459,6 +460,7 @@ int main(void) WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = g_tls_cert, .tls_cert_pem_len = g_tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, .est_allow_anonymous_enroll = 1, @@ -498,6 +500,7 @@ int main(void) if (rc != 0) return rc; + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_est_csr_attrs_apply_roundtrip.c b/tests/integration/test_est_csr_attrs_apply_roundtrip.c index 6373b9f..3fc2924 100644 --- a/tests/integration/test_est_csr_attrs_apply_roundtrip.c +++ b/tests/integration/test_est_csr_attrs_apply_roundtrip.c @@ -246,6 +246,7 @@ int main(void) WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .csr_attributes_der = policy.data, .csr_attributes_len = policy.len, .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, @@ -278,6 +279,7 @@ int main(void) if (rc != 0) return rc; + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_est_csr_attrs_enforce.c b/tests/integration/test_est_csr_attrs_enforce.c index 2384fbb..28376ff 100644 --- a/tests/integration/test_est_csr_attrs_enforce.c +++ b/tests/integration/test_est_csr_attrs_enforce.c @@ -367,6 +367,7 @@ int main(void) WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .csr_attributes_der = policy.data, .csr_attributes_len = policy.len, .est_require_csr_attributes = 1, @@ -395,6 +396,7 @@ int main(void) WolfCertServerCfgSrv cfg2 = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .csr_attributes_der = policy2.data, .csr_attributes_len = policy2.len, .est_require_csr_attributes = 1, @@ -422,6 +424,7 @@ int main(void) WolfCertServerCfgSrv cfg_raw = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .csr_attributes_der = policy_raw.data, .csr_attributes_len = policy_raw.len, .est_require_csr_attributes = 1, @@ -449,6 +452,7 @@ int main(void) WolfCertServerCfgSrv cfg_bare = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .http_basic_user = "alice", .http_basic_pass = "secret", .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, @@ -468,6 +472,7 @@ int main(void) if (rc != 0) return rc; + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_est_csr_attrs_roundtrip.c b/tests/integration/test_est_csr_attrs_roundtrip.c index bb477b0..7d20a03 100644 --- a/tests/integration/test_est_csr_attrs_roundtrip.c +++ b/tests/integration/test_est_csr_attrs_roundtrip.c @@ -93,6 +93,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .csr_attributes_der = blob.data, .csr_attributes_len = blob.len, .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, @@ -152,6 +153,7 @@ int main(void) WolfCertServerCfgSrv cfg2 = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, .est_allow_anonymous_enroll = 1, @@ -197,6 +199,7 @@ int main(void) wolfcert_buffer_free(&blob); free(tls_cert); free(tls_key); + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_est_mldsa_roundtrip.c b/tests/integration/test_est_mldsa_roundtrip.c index 9a0c6d2..6d6b325 100644 --- a/tests/integration/test_est_mldsa_roundtrip.c +++ b/tests/integration/test_est_mldsa_roundtrip.c @@ -114,6 +114,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .http_basic_user = "alice", .http_basic_pass = "hunter2", .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, @@ -156,6 +157,7 @@ int main(void) wolfcert_buffer_free(&ca_pem); free(tls_cert); free(tls_key); + test_ca_store_close(); wolfcert_cleanup(); if (rc == 0) diff --git a/tests/integration/test_est_mtls_roundtrip.c b/tests/integration/test_est_mtls_roundtrip.c index e7ca314..1b8fdbf 100644 --- a/tests/integration/test_est_mtls_roundtrip.c +++ b/tests/integration/test_est_mtls_roundtrip.c @@ -409,6 +409,7 @@ static int test_reenroll_mismatch_not_parked(const uint8_t* tls_cert, size_t tls .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, .tls_client_ca_pem = cli_cert, .tls_client_ca_pem_len = cli_cert_len, @@ -521,6 +522,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, .tls_client_ca_pem = cli_cert, .tls_client_ca_pem_len = cli_cert_len, @@ -623,6 +625,7 @@ int main(void) free(tls_key); free(cli_cert); free(cli_key); + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_est_pending_roundtrip.c b/tests/integration/test_est_pending_roundtrip.c index 43d0390..897c527 100644 --- a/tests/integration/test_est_pending_roundtrip.c +++ b/tests/integration/test_est_pending_roundtrip.c @@ -507,6 +507,7 @@ int main(void) WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .est_require_approval = 1, .est_retry_after_sec = 1, .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, @@ -524,6 +525,7 @@ int main(void) free(tls_cert); free(tls_key); + test_ca_store_close(); wolfcert_cleanup(); if (rc != 0) return rc; diff --git a/tests/integration/test_est_pha_roundtrip.c b/tests/integration/test_est_pha_roundtrip.c index ab5e233..5c4b2e7 100644 --- a/tests/integration/test_est_pha_roundtrip.c +++ b/tests/integration/test_est_pha_roundtrip.c @@ -167,6 +167,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, @@ -197,6 +198,7 @@ int main(void) free(tls_key); free(cli_cert); free(cli_key); + test_ca_store_close(); wolfcert_cleanup(); return 77; } @@ -354,6 +356,7 @@ int main(void) free(tls_key); free(cli_cert); free(cli_key); + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_est_roundtrip.c b/tests/integration/test_est_roundtrip.c index 65431cc..2efc58c 100644 --- a/tests/integration/test_est_roundtrip.c +++ b/tests/integration/test_est_roundtrip.c @@ -238,6 +238,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .http_basic_user = "alice", .http_basic_pass = "hunter2", .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, @@ -350,6 +351,7 @@ int main(void) WolfCertServerCfgSrv acfg = { .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .http_basic_user = "alice", .http_basic_pass = "hunter", .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, @@ -402,6 +404,7 @@ int main(void) wolfcert_buffer_free(&ca_pem); free(tls_cert); free(tls_key); + test_ca_store_close(); wolfcert_cleanup(); printf("OK (%d transport connects)\n", g_connect_calls); return 0; diff --git a/tests/integration/test_est_tls_roundtrip.c b/tests/integration/test_est_tls_roundtrip.c index 992a296..7b64a2a 100644 --- a/tests/integration/test_est_tls_roundtrip.c +++ b/tests/integration/test_est_tls_roundtrip.c @@ -139,6 +139,7 @@ static int test_client_reenroll_keeps_identity(const uint8_t* tls_cert, .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, }; @@ -299,6 +300,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, }; @@ -336,6 +338,7 @@ int main(void) .protocol = WOLFCERT_PROTO_EST, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .tls_cert_pem = tls_cert, .tls_cert_pem_len = tls_cert_len, .tls_key_pem = tls_key, .tls_key_pem_len = tls_key_len, .est_allow_anonymous_enroll = 1, @@ -408,6 +411,7 @@ int main(void) wolfcert_key_free(dk); free(tls_cert); free(tls_key); + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_scep_async_roundtrip.c b/tests/integration/test_scep_async_roundtrip.c index 0103814..244e3cd 100644 --- a/tests/integration/test_scep_async_roundtrip.c +++ b/tests/integration/test_scep_async_roundtrip.c @@ -931,7 +931,8 @@ int main(void) /* Scenario A: auto-approve server. */ WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s1 = NULL; REQUIRE(wolfcert_server_start(&cfg, &s1) == WOLFCERT_OK); pthread_t t1; @@ -946,6 +947,7 @@ int main(void) /* Scenario B: approval-required server (PENDING -> poll). */ WolfCertServerCfgSrv cfg_pending = { .protocol = WOLFCERT_PROTO_SCEP, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .scep_require_approval = 1 }; WolfCertServer* s2 = NULL; REQUIRE(wolfcert_server_start(&cfg_pending, &s2) == WOLFCERT_OK); @@ -960,7 +962,8 @@ int main(void) /* Scenario C: auto-approve server, async enroll -> async RenewalReq. */ WolfCertServerCfgSrv cfg_renew = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s3 = NULL; REQUIRE(wolfcert_server_start(&cfg_renew, &s3) == WOLFCERT_OK); pthread_t t3; @@ -974,7 +977,8 @@ int main(void) /* Scenario D: auto-approve server, session misuse guards. */ WolfCertServerCfgSrv cfg_guard = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s4 = NULL; REQUIRE(wolfcert_server_start(&cfg_guard, &s4) == WOLFCERT_OK); pthread_t t4; @@ -989,6 +993,7 @@ int main(void) /* Scenario E: approval-required server, blocking PENDING -> poll. */ WolfCertServerCfgSrv cfg_bpoll = { .protocol = WOLFCERT_PROTO_SCEP, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .scep_require_approval = 1 }; WolfCertServer* s5 = NULL; REQUIRE(wolfcert_server_start(&cfg_bpoll, &s5) == WOLFCERT_OK); @@ -1003,7 +1008,8 @@ int main(void) /* Scenario F: auto-approve server, session over base64 GET. */ WolfCertServerCfgSrv cfg_get = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s6 = NULL; REQUIRE(wolfcert_server_start(&cfg_get, &s6) == WOLFCERT_OK); pthread_t t6; @@ -1022,7 +1028,8 @@ int main(void) #ifdef WOLFCERT_HAVE_ED25519 /* Scenario H: auto-approve server, non-RSA signer rejection. */ WolfCertServerCfgSrv cfg_nonrsa = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s7 = NULL; REQUIRE(wolfcert_server_start(&cfg_nonrsa, &s7) == WOLFCERT_OK); pthread_t t7; @@ -1038,6 +1045,7 @@ int main(void) /* Scenario I: approval-required server, renewal poll with signer_cert. */ WolfCertServerCfgSrv cfg_rpoll = { .protocol = WOLFCERT_PROTO_SCEP, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .scep_require_approval = 1 }; WolfCertServer* s8 = NULL; REQUIRE(wolfcert_server_start(&cfg_rpoll, &s8) == WOLFCERT_OK); @@ -1052,7 +1060,8 @@ int main(void) /* Scenario J: auto-approve server for bootstrap, then the 500 stub. */ WolfCertServerCfgSrv cfg_500 = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s9 = NULL; REQUIRE(wolfcert_server_start(&cfg_500, &s9) == WOLFCERT_OK); pthread_t t9; @@ -1066,7 +1075,8 @@ int main(void) /* Scenario K: auto-approve server, argument-validation guards. */ WolfCertServerCfgSrv cfg_neg = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s10 = NULL; REQUIRE(wolfcert_server_start(&cfg_neg, &s10) == WOLFCERT_OK); pthread_t t10; @@ -1078,6 +1088,7 @@ int main(void) if (rc != 0) return rc; + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_scep_get_cert.c b/tests/integration/test_scep_get_cert.c index 72d563c..891f672 100644 --- a/tests/integration/test_scep_get_cert.c +++ b/tests/integration/test_scep_get_cert.c @@ -28,6 +28,7 @@ #include #include #include "internal.h" +#include "tls_test_util.h" #include #include @@ -351,6 +352,7 @@ int main(void) WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_SCEP, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .scep_enable_get_cert = 1, }; WolfCertServer* s = NULL; @@ -370,6 +372,7 @@ int main(void) WolfCertServerCfgSrv cfg_off = { .protocol = WOLFCERT_PROTO_SCEP, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), }; WolfCertServer* s_off = NULL; REQUIRE(wolfcert_server_start(&cfg_off, &s_off) == WOLFCERT_OK); @@ -384,6 +387,7 @@ int main(void) if (rc != 0) return rc; + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_scep_poll_roundtrip.c b/tests/integration/test_scep_poll_roundtrip.c index fc0b47a..67caee3 100644 --- a/tests/integration/test_scep_poll_roundtrip.c +++ b/tests/integration/test_scep_poll_roundtrip.c @@ -31,6 +31,7 @@ #include #include #include "internal.h" +#include "tls_test_util.h" #include #include @@ -506,7 +507,8 @@ static int next_ca_disabled_path(void) { /* GetNextCACert is not advertised and answers WOLFCERT_ERR_NOT_FOUND. */ WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s = NULL; REQUIRE(wolfcert_server_start(&cfg, &s) == WOLFCERT_OK); pthread_t tid; @@ -546,6 +548,7 @@ int main(void) WolfCertServerCfgSrv cfg_pending = { .protocol = WOLFCERT_PROTO_SCEP, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .scep_require_approval = 1, }; WolfCertServer* s1 = NULL; @@ -562,6 +565,7 @@ int main(void) WolfCertServerCfgSrv cfg_next = { .protocol = WOLFCERT_PROTO_SCEP, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .scep_enable_next_ca = 1, }; WolfCertServer* s2 = NULL; @@ -579,6 +583,7 @@ int main(void) if (rc != 0) return rc; + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_scep_roundtrip.c b/tests/integration/test_scep_roundtrip.c index 79abbc6..5b69f32 100644 --- a/tests/integration/test_scep_roundtrip.c +++ b/tests/integration/test_scep_roundtrip.c @@ -34,6 +34,7 @@ #include #include "internal.h" /* whitebox SCEP pkiMessage helpers */ +#include "tls_test_util.h" #include #include @@ -1465,7 +1466,8 @@ int main(void) return 1; WolfCertServerCfgSrv cfg = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s = NULL; REQUIRE(wolfcert_server_start(&cfg, &s) == WOLFCERT_OK); pthread_t tid; @@ -1704,6 +1706,7 @@ int main(void) /* Challenge password (RFC 8894 section 2.9). */ WolfCertServerCfgSrv cfg2 = { .protocol = WOLFCERT_PROTO_SCEP, .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store(), .challenge_password = "correct-horse" }; WolfCertServer* s2 = NULL; REQUIRE(wolfcert_server_start(&cfg2, &s2) == WOLFCERT_OK); @@ -1826,7 +1829,8 @@ int main(void) /* A CertRep with no recipientNonce is rejected (RFC 8894 3.2.1.2). */ WolfCertServerCfgSrv cfg3 = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s3 = NULL; REQUIRE(wolfcert_server_start(&cfg3, &s3) == WOLFCERT_OK); wolfcert_scep_server_set_faults(s3, 1 /* omit recipientNonce */, 0, 0); @@ -1866,7 +1870,8 @@ int main(void) /* A CertRep signed by a key other than the CA's is rejected. */ WolfCertServerCfgSrv cfg4 = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s4 = NULL; REQUIRE(wolfcert_server_start(&cfg4, &s4) == WOLFCERT_OK); wolfcert_scep_server_set_faults(s4, 0, 1 /* sign with wrong key */, 0); @@ -1906,7 +1911,8 @@ int main(void) /* A failed senderNonce RNG draw on the server answers HTTP 500. */ WolfCertServerCfgSrv cfg5 = { .protocol = WOLFCERT_PROTO_SCEP, - .bind_host = "127.0.0.1", .bind_port = 0 }; + .bind_host = "127.0.0.1", .bind_port = 0, + .ca_store = test_ca_store() }; WolfCertServer* s5 = NULL; REQUIRE(wolfcert_server_start(&cfg5, &s5) == WOLFCERT_OK); wolfcert_scep_server_set_faults(s5, 0, 0, 1 /* RNG draw fails */); @@ -1950,6 +1956,7 @@ int main(void) wolfcert_buffer_free(&csr); wolfcert_buffer_free(&issued); wolfcert_key_free(dk); + test_ca_store_close(); wolfcert_cleanup(); printf("OK\n"); return 0; diff --git a/tests/integration/test_server_stop_idle.c b/tests/integration/test_server_stop_idle.c index e444553..6d1e6d1 100644 --- a/tests/integration/test_server_stop_idle.c +++ b/tests/integration/test_server_stop_idle.c @@ -252,6 +252,7 @@ int main(void) cfg.protocol = TLS_LISTENER_PROTO; cfg.bind_host = "127.0.0.1"; cfg.bind_port = 0; + cfg.ca_store = test_ca_store(); cfg.tls_cert_pem = tls_cert; cfg.tls_cert_pem_len = tls_cert_len; cfg.tls_key_pem = tls_key; @@ -299,6 +300,7 @@ int main(void) cfg.protocol = WOLFCERT_PROTO_SCEP; cfg.bind_host = "127.0.0.1"; cfg.bind_port = 0; + cfg.ca_store = test_ca_store(); memset(&ctx, 0, sizeof(ctx)); REQUIRE(wolfcert_server_start(&cfg, &ctx.srv) == WOLFCERT_OK); @@ -425,6 +427,7 @@ int main(void) cfg.protocol = WOLFCERT_PROTO_SCEP; cfg.bind_host = "127.0.0.1"; cfg.bind_port = 0; + cfg.ca_store = test_ca_store(); memset(&ctx, 0, sizeof(ctx)); REQUIRE(wolfcert_server_start(&cfg, &ctx.srv) == WOLFCERT_OK); @@ -448,6 +451,7 @@ int main(void) free(tls_cert); free(tls_key); + test_ca_store_close(); wolfcert_cleanup(); printf("server stop idle: OK\n"); diff --git a/tests/integration/tls_test_util.h b/tests/integration/tls_test_util.h index e1e740e..098d803 100644 --- a/tests/integration/tls_test_util.h +++ b/tests/integration/tls_test_util.h @@ -38,6 +38,7 @@ #include #include #include +#include #include #include #include @@ -248,6 +249,37 @@ static inline int mint_self_id(const char* cn, int is_ca, return -1; } +static inline WolfCertStoreOps** test_ca_store_slot(void) +{ + static WolfCertStoreOps* store = NULL; + + return &store; +} + +/* One CA store for every test server in the process, so only the first + * server start generates a CA. */ +static inline WolfCertStoreOps* test_ca_store(void) +{ + WolfCertStoreOps** store = test_ca_store_slot(); + + if (*store == NULL) { + *store = wolfcert_store_memory_open(NULL); + if (*store == NULL) { + fprintf(stderr, "test_ca_store: cannot open the memory store\n"); + exit(1); + } + } + return *store; +} + +static inline void test_ca_store_close(void) +{ + WolfCertStoreOps** store = test_ca_store_slot(); + + wolfcert_store_memory_close(*store); + *store = NULL; +} + /* Self-signed TLS server identity (cert + key, PEM) for 127.0.0.1. */ static inline int gen_server_identity(uint8_t** cert_pem, size_t* cert_pem_len, uint8_t** key_pem, size_t* key_pem_len) diff --git a/tests/unit/test_scep_msg.c b/tests/unit/test_scep_msg.c index e0fdf3c..eb675a2 100644 --- a/tests/unit/test_scep_msg.c +++ b/tests/unit/test_scep_msg.c @@ -36,6 +36,8 @@ #include #endif #include +#define USE_CERT_BUFFERS_2048 +#include #ifndef NO_SHA #include #endif @@ -56,6 +58,43 @@ } \ } while (0) +static size_t g_rsa_drawn; + +/* Decodes the next of wolfSSL's six RSA-2048 test keys, failing once a test + * has drawn all six, so no test ever reuses one. */ +static int next_rsa_key(RsaKey* key) +{ + static const struct { + const unsigned char* der; + word32 len; + } pool[] = { + { ca_key_der_2048, sizeof(ca_key_der_2048) }, + { server_key_der_2048, sizeof(server_key_der_2048) }, + { client_key_der_2048, sizeof(client_key_der_2048) }, + { rsa_key_der_2048, sizeof(rsa_key_der_2048) }, + { tsa_key_der_2048, sizeof(tsa_key_der_2048) }, + { tsa_chain_key_der_2048, sizeof(tsa_chain_key_der_2048) }, + }; + size_t i = g_rsa_drawn; + word32 idx = 0; + + if (i >= sizeof(pool) / sizeof(pool[0])) { + fprintf(stderr, "test drew more than %zu RSA keys\n", + sizeof(pool) / sizeof(pool[0])); + return -1; + } + + g_rsa_drawn++; + return wc_RsaPrivateKeyDecode(pool[i].der, &idx, key, pool[i].len); +} + +/* Run fn with the whole key pool available. */ +static int run_test(int (*fn)(void)) +{ + g_rsa_drawn = 0; + return fn(); +} + /* Throwaway self-signed RSA CA cert and key, both DER; free with free(). */ static int make_ca(uint8_t** cert_out, size_t* cert_out_len, uint8_t** key_out, size_t* key_out_len) @@ -76,7 +115,7 @@ static int make_ca(uint8_t** cert_out, size_t* cert_out_len, return -1; } - if (ret == 0 && wc_MakeRsaKey(&key, 2048, WC_RSA_EXPONENT, &rng) != 0) + if (ret == 0 && next_rsa_key(&key) != 0) ret = -1; if (ret == 0) { @@ -163,7 +202,7 @@ static int make_signed_cert(const uint8_t* ca_der, size_t ca_der_len, (word32)ca_key_len) != 0) ret = -1; - if (ret == 0 && wc_MakeRsaKey(&sub_key, 2048, WC_RSA_EXPONENT, &rng) != 0) + if (ret == 0 && next_rsa_key(&sub_key) != 0) ret = -1; if (ret == 0) { @@ -563,7 +602,7 @@ static int test_signer_subject_matches_csr(void) REQUIRE(wc_InitRng(&rng) == 0); REQUIRE(wc_InitRsaKey(&key, NULL) == 0); - REQUIRE(wc_MakeRsaKey(&key, 2048, WC_RSA_EXPONENT, &rng) == 0); + REQUIRE(next_rsa_key(&key) == 0); REQUIRE(make_csr(&key, &rng, "device-4711.example.org", "Widgets Inc", &csr_der, &csr_len) == 0); @@ -611,7 +650,7 @@ static int test_signer_key_usage(void) REQUIRE(wc_InitRng(&rng) == 0); REQUIRE(wc_InitRsaKey(&key, NULL) == 0); - REQUIRE(wc_MakeRsaKey(&key, 2048, WC_RSA_EXPONENT, &rng) == 0); + REQUIRE(next_rsa_key(&key) == 0); REQUIRE(make_csr(&key, &rng, "device-9799.example.org", "Widgets Inc", &csr_der, &csr_len) == 0); @@ -941,10 +980,10 @@ static int test_zero_length_args_rejected(void) .server_url = "http://127.0.0.1:1/scep" }; uint8_t blob[4] = { 1, 2, 3, 4 }; WolfCertKey* key = NULL; - WolfCertKeyCfg kcfg = { .type = WOLFCERT_KEY_RSA, .param = 2048, - .dev_id = WOLFCERT_DEVID_SOFTWARE }; - REQUIRE(wolfcert_key_generate(&kcfg, &key) == WOLFCERT_OK); + REQUIRE(wolfcert_key_from_pem(client_key_der_2048, + sizeof(client_key_der_2048), NULL, &key) + == WOLFCERT_OK); #define REJECTS(what, call) \ do { \ @@ -1016,10 +1055,10 @@ static int test_result_defined_on_early_return(void) WolfCertScepCaps caps = { 0 }; uint8_t blob[4] = { 1, 2, 3, 4 }; WolfCertKey* key = NULL; - WolfCertKeyCfg kcfg = { .type = WOLFCERT_KEY_RSA, .param = 2048, - .dev_id = WOLFCERT_DEVID_SOFTWARE }; - REQUIRE(wolfcert_key_generate(&kcfg, &key) == WOLFCERT_OK); + REQUIRE(wolfcert_key_from_pem(client_key_der_2048, + sizeof(client_key_der_2048), NULL, &key) + == WOLFCERT_OK); #define POISON_AND_CALL(what, call) \ do { \ @@ -1248,7 +1287,7 @@ static int test_issuer_and_subject_issuer_name(void) REQUIRE(wc_InitRng(&rng) == 0); REQUIRE(wc_InitRsaKey(&key, NULL) == 0); - REQUIRE(wc_MakeRsaKey(&key, 2048, WC_RSA_EXPONENT, &rng) == 0); + REQUIRE(next_rsa_key(&key) == 0); REQUIRE(make_ca(&ca_der, &ca_len, &ca_key_der, &ca_key_len) == 0); REQUIRE(make_signed_cert(ca_der, ca_len, ca_key_der, ca_key_len, @@ -1649,7 +1688,7 @@ static int test_signer_subject_fallback(void) REQUIRE(wc_InitRng(&rng) == 0); REQUIRE(wc_InitRsaKey(&key, NULL) == 0); - REQUIRE(wc_MakeRsaKey(&key, 2048, WC_RSA_EXPONENT, &rng) == 0); + REQUIRE(next_rsa_key(&key) == 0); REQUIRE(make_csr(&key, &rng, "", "", &csr, &csr_len) == 0); @@ -2307,56 +2346,56 @@ int main(void) { REQUIRE(test_static_mem_init() == 0); REQUIRE(wolfcert_init(NULL) == WOLFCERT_OK); - if (test_getca_url()) + if (run_test(test_getca_url)) return 1; - if (test_scep_rejects_est_cfg()) + if (run_test(test_scep_rejects_est_cfg)) return 1; - if (test_envelop_cipher_oid()) + if (run_test(test_envelop_cipher_oid)) return 1; - if (test_ca_fingerprint()) + if (run_test(test_ca_fingerprint)) return 1; - if (test_pki_get_url()) + if (run_test(test_pki_get_url)) return 1; - if (test_non_success_has_no_envelope()) + if (run_test(test_non_success_has_no_envelope)) return 1; - if (test_signer_subject_fallback()) + if (run_test(test_signer_subject_fallback)) return 1; - if (test_signer_subject_matches_csr()) + if (run_test(test_signer_subject_matches_csr)) return 1; - if (test_signer_key_usage()) + if (run_test(test_signer_key_usage)) return 1; - if (test_issuer_and_subject_issuer_name()) + if (run_test(test_issuer_and_subject_issuer_name)) return 1; - if (test_issuer_and_serial()) + if (run_test(test_issuer_and_serial)) return 1; - if (test_pem_has_cert()) + if (run_test(test_pem_has_cert)) return 1; - if (test_result_defined_on_early_return()) + if (run_test(test_result_defined_on_early_return)) return 1; - if (test_zero_length_args_rejected()) + if (run_test(test_zero_length_args_rejected)) return 1; - if (test_cert_rep_signer_trust()) + if (run_test(test_cert_rep_signer_trust)) return 1; - if (test_cert_rep_txid_and_type()) + if (run_test(test_cert_rep_txid_and_type)) return 1; - if (test_long_transaction_id()) + if (run_test(test_long_transaction_id)) return 1; - if (test_next_ca_response_is_signed()) + if (run_test(test_next_ca_response_is_signed)) return 1; - if (test_next_ca_response_signer_trust()) + if (run_test(test_next_ca_response_signer_trust)) return 1; - if (test_signer_is_verified_cert()) + if (run_test(test_signer_is_verified_cert)) return 1; - if (test_signer_matches_any_bundle_cert()) + if (run_test(test_signer_matches_any_bundle_cert)) return 1; - if (test_duplicate_signed_attrib()) + if (run_test(test_duplicate_signed_attrib)) return 1; - if (test_multi_value_signed_attrib()) + if (run_test(test_multi_value_signed_attrib)) return 1; - if (test_text_attrib_printable()) + if (run_test(test_text_attrib_printable)) return 1; #ifdef HAVE_ECC - if (test_envelop_rejects_ecc_ra()) + if (run_test(test_envelop_rejects_ecc_ra)) return 1; #endif wolfcert_cleanup(); diff --git a/zephyr/tests/wolfcert_unit_scep_msg/testcase.yaml b/zephyr/tests/wolfcert_unit_scep_msg/testcase.yaml index 283f10b..ad27abe 100644 --- a/zephyr/tests/wolfcert_unit_scep_msg/testcase.yaml +++ b/zephyr/tests/wolfcert_unit_scep_msg/testcase.yaml @@ -1,7 +1,6 @@ common: tags: - wolfcert - - slow harness: console harness_config: type: one_line @@ -9,7 +8,7 @@ common: - "WOLFCERT TEST RESULT: 0" tests: wolfcert.unit.scep_msg: - timeout: 900 + timeout: 180 platform_allow: qemu_x86 integration_platforms: - qemu_x86