mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-19 10:23:23 +02:00
Tobias Frauenschläger
ff730fec9e
Second review follow-up on the async record layer series. Stop the probe reselecting the cipher side. BuildMessage()'s BUILD_MSG_BEGIN case can call SetKeysSide() for DTLS with secure renegotiation, which swaps the active encryption state and clears recordSzOverhead. That is not part of a size calculation, and after the previous commit the suspended build survives to resume against whatever side the probe last chose, so a DTLS 1.2 record suspended for PREV_ORDER could resume against the renegotiation keys. Skip it when sizeOnly is set; the sizes are the same either way. The probe itself has to keep running. Not re-entering BuildMessage at all while a build is suspended looks tidier, but wolfssl_local_GetMaxPlaintextSize() derives the DTLS fragment size from this result, so falling back to the upper bound there shrinks fragments inconsistently between calls and the MTU reproducer fails its buffer comparison. Saving and restoring the two fields is what keeps the answer exact. Resume inside the record when handshake content is left. The previous commit declined to skip the padding for a fragmented or coalesced certificate_request, which was right, but left processReply at doProcessInit with the index inside the record, so the resume still started a fresh record parse in the middle of one. Mirror both halves of the end of record block instead: set runProcessingOneMessage when content remains, advance past the padding only at the boundary. Note the shared state at the source. BuildMessage() and BuildTls13Message() write ssl->options.buildMsgState even for a sizeOnly probe with asyncOkay clear, where everything else goes to the caller's own arguments. Nothing said so at those sites, so the next sizeOnly caller would reintroduce this. Record why only one of the three wc_ecc_make_key_ex() calls in eccsi.c needs a wait: the other two are preceded by wc_ecc_free(), which clears the marker their pending path is gated on. Moving either free would make them pend. Test changes. Force the overhead cache cold before probing, otherwise an AEAD suite answers from the cache without ever calling BuildMessage and the assertions hold no matter what the probe did. Compare against BuildMessage's own figure rather than only checking the size is positive, and run the whole thing for TLS 1.3 as well as TLS 1.2, since BuildTls13Message() clobbers the state by a different route: its sizeOnly return bypasses exit_buildmsg entirely. Checked by stubbing the restore out again, which fails the test. Also spell the new guard in cryptocb_test() as #if defined(WOLFSSL_ASYNC_CRYPT) to match the rest of that file, which uses that form 170 times against 4.
120 lines
5.9 KiB
YAML
120 lines
5.9 KiB
YAML
name: Async Tests
|
|
|
|
# START OF COMMON SECTION
|
|
on:
|
|
push:
|
|
branches: [ 'release/**' ]
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
branches: [ '*' ]
|
|
# Weekday-morning cron (10:00 UTC) seeds the master-scoped ccache that PR runs
|
|
# restore: re-runs --build-only (compile only, no tests) on the
|
|
# default branch. PR runs are read-only (see ccache-setup).
|
|
schedule:
|
|
- cron: '8 10 * * 1-5'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
# END OF COMMON SECTION
|
|
|
|
jobs:
|
|
# All former runner-per-config matrix entries build on one runner via
|
|
# .github/scripts/parallel-make-check.py (see os-check.yml for the full
|
|
# pattern): each config in its own out-of-tree ("VPATH") build directory
|
|
# off one checkout/autogen, checks on a pool of one-per-CPU worker
|
|
# threads, longest first. bubblewrap gives every test script its own
|
|
# network namespace so concurrent checks cannot collide on TCP/UDP ports
|
|
# (do not set AM_BWRAPPED here - that would disable it).
|
|
make_check:
|
|
name: make check
|
|
if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
|
|
runs-on: ubuntu-24.04
|
|
# Generous for a cold ccache; warm reruns finish in a fraction.
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
name: Checkout wolfSSL
|
|
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/install-apt-deps
|
|
with:
|
|
packages: autoconf automake libtool build-essential bubblewrap
|
|
ghcr-debs-tag: ubuntu-24.04-minimal
|
|
|
|
# ccache via the cross-platform composite; the script passes the
|
|
# compiler to configure as CC="ccache gcc" (or a per-config "cc").
|
|
- name: Set up ccache
|
|
uses: ./.github/actions/ccache-setup
|
|
with:
|
|
workflow-id: async
|
|
read-only: ${{ github.event_name == 'pull_request' }}
|
|
max-size: 250M
|
|
|
|
# Ubuntu 24.04 can restrict unprivileged user namespaces via AppArmor,
|
|
# which would stop the test scripts from re-execing under
|
|
# bwrap --unshare-net (their port-isolation mechanism).
|
|
- name: Allow unprivileged user namespaces (for bwrap)
|
|
run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
|
|
|
|
# The JSON list below is the former runner-per-config matrix; add new
|
|
# configs as new entries (a "comment" key is allowed for notes).
|
|
# "minutes" is the expected duration driving longest-first scheduling:
|
|
# take it from the Minutes column of a previous run's step summary, or
|
|
# omit it for a new config (defaults to 1) and refresh later. The list
|
|
# is kept sorted by minutes for readability, but the schedule sorts by
|
|
# the values, not list order.
|
|
- name: Build and make check all configs (parallel, out-of-tree)
|
|
run: |
|
|
cat > "$RUNNER_TEMP/async-configs.json" <<'EOF'
|
|
[
|
|
{"comment": "The only entry that pairs the software async simulator with --enable-all. --enable-all turns on cryptocb, which stops configure.ac from auto-enabling the simulator, so the asynccrypt-all entries below define WOLFSSL_ASYNC_CRYPT but never actually return WC_PENDING_E. Without this one nothing exercises TLS 1.3 post-handshake auth or DTLS writes against a pending crypto op. The minutes value is a projection, not a CI measurement: this config takes 1.6 min locally where the asynccrypt-all entries below take 1.4 against their declared 3. Refresh it from the first real run.",
|
|
"name": "asynccrypt-sw-all-dtls13", "minutes": 3,
|
|
"configure": ["--enable-asynccrypt-sw", "--enable-all",
|
|
"--enable-dtls13",
|
|
"CFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
|
{"name": "asynccrypt-all-no-mlkem", "minutes": 3,
|
|
"configure": ["--enable-asynccrypt", "--enable-all",
|
|
"--enable-dtls13", "--disable-mlkem",
|
|
"CFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"]},
|
|
{"name": "asynccrypt-all", "minutes": 3,
|
|
"configure": ["--enable-asynccrypt", "--enable-all",
|
|
"--enable-dtls13",
|
|
"CFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"]},
|
|
{"name": "asynccrypt-sw-ocspstapling-no-mlkem", "minutes": 1.5,
|
|
"configure": ["--enable-asynccrypt-sw", "--enable-ocspstapling",
|
|
"--enable-ocspstapling2", "--disable-mlkem",
|
|
"CFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
|
{"name": "asynccrypt-sw-ocspstapling", "minutes": 1.5,
|
|
"configure": ["--enable-asynccrypt-sw", "--enable-ocspstapling",
|
|
"--enable-ocspstapling2",
|
|
"CFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
|
{"name": "ocsp-nonblock-certs", "minutes": 1.5,
|
|
"configure": ["--enable-ocsp",
|
|
"CFLAGS=-DTEST_NONBLOCK_CERTS -pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}
|
|
]
|
|
EOF
|
|
.github/scripts/parallel-make-check.py \
|
|
${{ github.event_name == 'schedule' && '--build-only' || '' }} \
|
|
--private-dir=certs \
|
|
"$RUNNER_TEMP/async-configs.json"
|
|
|
|
- name: ccache stats
|
|
if: always()
|
|
run: ccache -s || true
|
|
|
|
- name: Upload logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
retention-days: 7
|
|
name: async-logs
|
|
path: |
|
|
build-*/make-check.log
|
|
build-*/test-suite.log
|
|
build-*/config.log
|
|
if-no-files-found: ignore
|