wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-10 20:50:52 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
93d16f431c911981b588dfbf9786efa08215b45f
wolfssl/.github/workflows/tinytls13.yml
T
Aidan Garske 41fad5f307 Fix and expand tinytls13 footprint profile across CI configs 
Make every --enable-tinytls13 spelling build and pass locally, and grow the
CI matrix to cover them. These are fixes found while testing the configs the
CI workflow had not actually exercised.

- internal.h, internal.c, ssl_load.c: include ML-DSA and Falcon in the
  pkCurveOID member and producer guards so the PSK plus ML-DSA build compiles.
- tls13.c: gate the DoTls13CertificateVerify definition on NO_CERTS to match
  its call site.
- settings.h: let the AES-256 adder survive the floor, default the
  user_settings path to the SHA-256 floor, make WOLFSSL_NO_MALLOC opt-in so
  the test suite still runs, and keep ML-DSA ASN.1 for the cert profile.
- configure.ac: drive ENABLED_ASM and emit WOLFSSL_NO_ASM for the small C
  floor, restrict SP math to P-256, strip ML-DSA ASN.1 only on the PSK floor,
  and print a notice for the reduced security cert verify.
- examples: guard the cert loading paths for NO_CERTS and treat NO_CERTS as
  PSK mode in echoserver and echoclient.
- Add examples/configs/tinytls13_smoke.c, an in memory TLS 1.3 handshake test
  that drives PSK, ECDSA, ML-DSA-65 and RSA-PSS chain verify, plus forced
  cipher suites, for builds with no example or unit test harness.
- certs: add ECDSA leaves signed by the ML-DSA-65 and RSA-PSS CAs so the cert
  profiles drive a real PQC and PSS chain verify in CI.
- .github/workflows/tinytls13.yml: cover every profile and adder, run the
  smoke handshake on the build verified configs, and least privilege the
  workflow token.
2026-06-22 12:08:58 -07:00

155 lines
8.7 KiB
YAML
Raw Blame History

name: Tiny TLS 1.3 Tests
# START OF COMMON SECTION
on:
push:
branches: [ 'release/**' ]
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
branches: [ '*' ]
schedule:
- cron: '42 10 * * 1-5'
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# END OF COMMON SECTION
permissions:
contents: read
jobs:
# Build + make check every --enable-tinytls13 spelling on one runner via
# .github/scripts/parallel-make-check.py (see psk.yml for the pattern).
make_check:
name: make check
if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v5
name: Checkout wolfSSL
- name: Install dependencies
uses: ./.github/actions/install-apt-deps
with:
packages: autoconf automake libtool build-essential bubblewrap
ghcr-debs-tag: ubuntu-24.04-minimal
- name: Set up ccache
uses: ./.github/actions/ccache-setup
with:
workflow-id: tinytls13
read-only: ${{ github.event_name == 'pull_request' }}
max-size: 100M
- name: Allow unprivileged user namespaces (for bwrap)
run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
# Every tiny TLS 1.3 profile/adder spelling, so each is proven to build
# and pass make check (which runs the TLS handshake test suite) out of
# the box. Server is enabled where a config needs the server-side tests.
# The psk-p256 and cert-rsaverify configs strip to combinations
# (ECDHE-only ECC without certs, RSA verify only) that the OpenSSL-compat
# API unit suite (coupled to examples via BUILD_TESTS) does not gate for.
# Rather than carry test-harness edits for those, they build static with
# --disable-examples, skip make check ("check": false), and instead run
# wolfcrypt/test/testwolfcrypt plus examples/configs/tinytls13_smoke.c
# (a self-contained in-memory TLS 1.3 handshake) for real crypto and
# handshake verification.
- name: Build and test all tinytls13 configs
run: |
cat > "$RUNNER_TEMP/tinytls13-configs.json" <<'EOF'
[
{"name": "tinytls13-psk-x25519", "minutes": 1,
"configure": ["--enable-tinytls13=psk,server", "--disable-mlkem"]},
{"name": "tinytls13-psk-p256", "minutes": 1, "check": false,
"configure": ["--enable-tinytls13=psk,p256,server", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
"run": [["make", "wolfcrypt/test/testwolfcrypt"], ["./wolfcrypt/test/testwolfcrypt"],
["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
["./tinytls13_smoke"]]},
{"name": "tinytls13-psk-staticmem", "minutes": 1,
"configure": ["--enable-tinytls13=psk,server,staticmem", "--disable-mlkem"]},
{"name": "tinytls13-psk-mldsa", "minutes": 1,
"configure": ["--enable-tinytls13=psk,server,mldsa", "--disable-mlkem"]},
{"name": "tinytls13-psk-sha384", "minutes": 1,
"configure": ["--enable-tinytls13=psk,server,sha384", "--disable-mlkem"]},
{"name": "tinytls13-cert", "minutes": 1,
"configure": ["--enable-tinytls13=cert,server", "--disable-mlkem"]},
{"name": "tinytls13-cert-sha384", "minutes": 1,
"configure": ["--enable-tinytls13=cert,server,sha384", "--disable-mlkem"]},
{"name": "tinytls13-cert-mutualauth", "minutes": 1,
"configure": ["--enable-tinytls13=cert,mutualauth,server", "--disable-mlkem"]},
{"name": "tinytls13-cert-rsaverify", "minutes": 1, "check": false,
"configure": ["--enable-tinytls13=cert,server,rsaverify", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
"run": [["make", "wolfcrypt/test/testwolfcrypt"], ["./wolfcrypt/test/testwolfcrypt"],
["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
["./tinytls13_smoke"]]},
{"name": "tinytls13-cert-mldsa", "minutes": 1,
"configure": ["--enable-tinytls13=cert,server,mldsa", "--enable-static", "--disable-mlkem"],
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
["./tinytls13_smoke"]]},
{"name": "tinytls13-psk-client-only", "minutes": 1,
"configure": ["--enable-tinytls13=psk", "--disable-mlkem"]},
{"name": "tinytls13-cert-client-only", "minutes": 1,
"configure": ["--enable-tinytls13=cert", "--disable-mlkem"]},
{"name": "tinytls13-psk-asm", "minutes": 1,
"configure": ["--enable-tinytls13=psk,server,asm", "--disable-mlkem"]},
{"name": "tinytls13-cert-asm", "minutes": 1,
"configure": ["--enable-tinytls13=cert,server,asm", "--disable-mlkem"]},
{"name": "tinytls13-cert-chacha", "minutes": 1, "check": false,
"configure": ["--enable-tinytls13=cert,server", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
"cflags": "-DHAVE_CHACHA -DHAVE_POLY1305",
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
["./tinytls13_smoke", "TLS13-CHACHA20-POLY1305-SHA256"]]},
{"name": "tinytls13-cert-aes256", "minutes": 1, "check": false,
"configure": ["--enable-tinytls13=cert,server,sha384", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
"cflags": "-DWOLFSSL_AES_256",
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
["./tinytls13_smoke", "TLS13-AES256-GCM-SHA384"]]},
{"name": "tinytls13-psk-mlkem", "minutes": 1,
"configure": ["--enable-tinytls13=psk,server", "--enable-static"],
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
["./tinytls13_smoke", "-", "mlkem"]]},
{"name": "tinytls13-cert-staticmem", "minutes": 1, "check": false,
"configure": ["--enable-tinytls13=cert,server,staticmem", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"],
"run": [["make", "wolfcrypt/test/testwolfcrypt"], ["./wolfcrypt/test/testwolfcrypt"],
["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
["./tinytls13_smoke"]]},
{"name": "tinytls13-nomalloc", "minutes": 1, "check": false,
"configure": ["--enable-tinytls13=psk,server,staticmem", "--enable-static", "--disable-shared", "--disable-examples", "--disable-crypttests", "--disable-mlkem"],
"cflags": "-DWOLFSSL_NO_MALLOC"},
{"name": "tinytls13-combo-cert-mutualauth-sha384", "minutes": 1,
"configure": ["--enable-tinytls13=cert,mutualauth,server,sha384", "--disable-mlkem"]},
{"name": "tinytls13-combo-cert-mldsa-sha384", "minutes": 1,
"configure": ["--enable-tinytls13=cert,server,mldsa,sha384", "--enable-static", "--disable-mlkem"],
"run": [["cc", "-I.", "-I..", "../examples/configs/tinytls13_smoke.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tinytls13_smoke"],
["./tinytls13_smoke"]]},
{"name": "tinytls13-bare", "minutes": 1,
"configure": ["--enable-tinytls13", "--disable-mlkem"]},
{"name": "tinytls13-usersettings", "minutes": 1, "check": false,
"user_settings": "examples/configs/user_settings_tinytls13.h",
"configure": ["--enable-usersettings", "--enable-static", "--disable-shared", "--disable-examples", "--disable-crypttests"]}
]
EOF
.github/scripts/parallel-make-check.py \
${{ github.event_name == 'schedule' && '--build-only' || '' }} \
--private-dir=certs \
"$RUNNER_TEMP/tinytls13-configs.json"
- name: ccache stats
if: always()
run: ccache -s || true
- name: Upload logs on failure
if: failure()
uses: actions/upload-artifact@v6
with:
retention-days: 7
name: tinytls13-logs
path: |
build-*/make-check.log
build-*/test-suite.log
build-*/config.log
if-no-files-found: ignore
Reference in New Issue View Git Blame Copy Permalink