Skip to content

Commit 093276a

Browse files
stevefan1999-personalstevefan1999-personal
committed
Add comprehensive cipher suite combination testing script and GitHub Actions workflow
1 parent d6b80b0 commit 093276a

File tree

2 files changed

+262
-0
lines changed

2 files changed

+262
-0
lines changed

‎.github/workflows/cipher-suite-test.yml‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
name: Comprehensive Cipher Suite Matrix Tests
2+
3+
on:
4+
pull_request:
5+
paths-ignore:
6+
- README.md
7+
push:
8+
branches: [master]
9+
paths-ignore:
10+
- README.md
11+
workflow_dispatch:
12+
inputs:
13+
aead:
14+
description: 'AEAD algorithm to test (optional)'
15+
required: false
16+
type: string
17+
hash:
18+
description: 'Hash algorithm to test (optional)'
19+
required: false
20+
type: string
21+
verify:
22+
description: 'Verify algorithm to test (optional)'
23+
required: false
24+
type: string
25+
sign:
26+
description: 'Sign algorithm to test (optional)'
27+
required: false
28+
type: string
29+
kx:
30+
description: 'Key exchange algorithm to test (optional)'
31+
required: false
32+
type: string
33+
34+
permissions:
35+
contents: read
36+
37+
env:
38+
RUSTFLAGS: "-Dwarnings"
39+
40+
jobs:
41+
test-cipher-suite-matrix:
42+
runs-on: ubuntu-latest
43+
strategy:
44+
matrix:
45+
# Complete Cartesian product of all cipher suite components
46+
aead: ["aead-aes-gcm", "aead-aes-ccm", "aead-chacha20poly1305"]
47+
hash: ["hash-sha224", "hash-sha256", "hash-sha384", "hash-sha512"]
48+
verify: [
49+
"verify-ecdsa-p256-sha256", "verify-ecdsa-p256-sha384", "verify-ecdsa-p256-sha512",
50+
"verify-ecdsa-p384-sha256", "verify-ecdsa-p384-sha384", "verify-ecdsa-p384-sha512",
51+
"verify-ecdsa-p521-sha256", "verify-ecdsa-p521-sha384", "verify-ecdsa-p521-sha512",
52+
"verify-eddsa-ed25519",
53+
"verify-rsa-pkcs1-sha256", "verify-rsa-pkcs1-sha384", "verify-rsa-pkcs1-sha512",
54+
"verify-rsa-pss-sha256", "verify-rsa-pss-sha384", "verify-rsa-pss-sha512"
55+
]
56+
sign: [
57+
"sign-ecdsa-p256", "sign-ecdsa-p384", "sign-ecdsa-p521",
58+
"sign-eddsa-ed25519",
59+
"sign-rsa-pkcs1", "sign-rsa-pss"
60+
]
61+
kx: ["kx-p256", "kx-p384", "kx-p521", "kx-x25519", "kx-x448"]
62+
# Allow failures for incompatible combinations
63+
fail-fast: false
64+
65+
steps:
66+
- uses: actions/checkout@v4
67+
68+
- uses: dtolnay/rust-toolchain@master
69+
with:
70+
toolchain: stable
71+
72+
- uses: mozilla-actions/[email protected]
73+
- uses: Swatinem/rust-cache@v2
74+
75+
- name: Test cipher suite combination
76+
run: |
77+
echo "Testing cipher suite combination:"
78+
echo " AEAD: ${{ matrix.aead }}"
79+
echo " Hash: ${{ matrix.hash }}"
80+
echo " Verify: ${{ matrix.verify }}"
81+
echo " Sign: ${{ matrix.sign }}"
82+
echo " KX: ${{ matrix.kx }}"
83+
echo ""
84+
85+
# Build the feature string
86+
FEATURES="tls12,${{ matrix.aead }},${{ matrix.hash }},${{ matrix.verify }},${{ matrix.sign }},${{ matrix.kx }}"
87+
echo "Features: $FEATURES"
88+
89+
# Test the combination (allow failures for incompatible combinations)
90+
if cargo test --features "$FEATURES" 2>/dev/null; then
91+
echo "✅ PASSED: $FEATURES"
92+
else
93+
echo "❌ FAILED: $FEATURES (likely incompatible combination)"
94+
fi
95+
env:
96+
SCCACHE_GHA_ENABLED: "true"
97+
RUSTC_WRAPPER: "sccache"
98+
99+
- name: Build verification (optional)
100+
run: |
101+
FEATURES="tls12,${{ matrix.aead }},${{ matrix.hash }},${{ matrix.verify }},${{ matrix.sign }},${{ matrix.kx }}"
102+
if cargo build --features "$FEATURES" 2>/dev/null; then
103+
echo "✅ BUILD OK: $FEATURES"
104+
else
105+
echo "❌ BUILD FAILED: $FEATURES"
106+
fi
107+
env:
108+
SCCACHE_GHA_ENABLED: "true"
109+
RUSTC_WRAPPER: "sccache"
110+
continue-on-error: true
111+
112+
test-specific-combination:
113+
if: github.event_name == 'workflow_dispatch' && (github.event.inputs.aead != '' || github.event.inputs.hash != '' || github.event.inputs.verify != '' || github.event.inputs.sign != '' || github.event.inputs.kx != '')
114+
runs-on: ubuntu-latest
115+
steps:
116+
- uses: actions/checkout@v4
117+
118+
- uses: dtolnay/rust-toolchain@master
119+
with:
120+
toolchain: stable
121+
122+
- uses: mozilla-actions/[email protected]
123+
- uses: Swatinem/rust-cache@v2
124+
125+
- name: Test specific combination
126+
run: |
127+
# Use provided inputs or defaults
128+
AEAD="${{ github.event.inputs.aead }}"
129+
HASH="${{ github.event.inputs.hash }}"
130+
VERIFY="${{ github.event.inputs.verify }}"
131+
SIGN="${{ github.event.inputs.sign }}"
132+
KX="${{ github.event.inputs.kx }}"
133+
134+
# Set defaults if not provided
135+
[ -z "$AEAD" ] && AEAD="aead-aes-gcm"
136+
[ -z "$HASH" ] && HASH="hash-sha256"
137+
[ -z "$VERIFY" ] && VERIFY="verify-rsa-pkcs1-sha256"
138+
[ -z "$SIGN" ] && SIGN="sign-rsa-pkcs1"
139+
[ -z "$KX" ] && KX="kx-p256"
140+
141+
echo "Testing specific combination:"
142+
echo " AEAD: $AEAD"
143+
echo " Hash: $HASH"
144+
echo " Verify: $VERIFY"
145+
echo " Sign: $SIGN"
146+
echo " KX: $KX"
147+
148+
FEATURES="tls12,$AEAD,$HASH,$VERIFY,$SIGN,$KX"
149+
echo "Features: $FEATURES"
150+
151+
cargo test --features "$FEATURES"
152+
env:
153+
SCCACHE_GHA_ENABLED: "true"
154+
RUSTC_WRAPPER: "sccache"

‎test-cipher-suites.sh‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
#!/bin/bash
2+
3+
# Comprehensive cipher suite test script for rustls-rustcrypto
4+
# Tests ALL possible combinations of cipher suite components using Cartesian product
5+
6+
set -e
7+
8+
echo "Testing ALL possible cipher suite combinations..."
9+
echo "=================================================="
10+
echo "This will test the complete Cartesian product of:"
11+
echo " - AEAD algorithms: aead-aes-gcm, aead-aes-ccm, aead-chacha20poly1305"
12+
echo " - Hash algorithms: hash-sha224, hash-sha256, hash-sha384, hash-sha512"
13+
echo " - Verify algorithms: 16 different verification schemes"
14+
echo " - Sign algorithms: 6 different signing schemes"
15+
echo " - Key exchange: kx-p256, kx-p384, kx-p521, kx-x25519, kx-x448"
16+
echo ""
17+
echo "Total combinations: 3 × 4 × 16 × 6 × 5 = $(echo "3*4*16*6*5" | bc) combinations"
18+
echo "=================================================="
19+
echo ""
20+
21+
# Component arrays
22+
AEAD_ALGORITHMS=("aead-aes-gcm" "aead-aes-ccm" "aead-chacha20poly1305")
23+
HASH_ALGORITHMS=("hash-sha224" "hash-sha256" "hash-sha384" "hash-sha512")
24+
VERIFY_ALGORITHMS=(
25+
"verify-ecdsa-p256-sha256" "verify-ecdsa-p256-sha384" "verify-ecdsa-p256-sha512"
26+
"verify-ecdsa-p384-sha256" "verify-ecdsa-p384-sha384" "verify-ecdsa-p384-sha512"
27+
"verify-ecdsa-p521-sha256" "verify-ecdsa-p521-sha384" "verify-ecdsa-p521-sha512"
28+
"verify-eddsa-ed25519"
29+
"verify-rsa-pkcs1-sha256" "verify-rsa-pkcs1-sha384" "verify-rsa-pkcs1-sha512"
30+
"verify-rsa-pss-sha256" "verify-rsa-pss-sha384" "verify-rsa-pss-sha512"
31+
)
32+
SIGN_ALGORITHMS=(
33+
"sign-ecdsa-p256" "sign-ecdsa-p384" "sign-ecdsa-p521"
34+
"sign-eddsa-ed25519"
35+
"sign-rsa-pkcs1" "sign-rsa-pss"
36+
)
37+
KEY_EXCHANGE_ALGORITHMS=("kx-p256" "kx-p384" "kx-p521" "kx-x25519" "kx-x448")
38+
39+
# Counters
40+
total_combinations=$(echo "${#AEAD_ALGORITHMS[@]} * ${#HASH_ALGORITHMS[@]} * ${#VERIFY_ALGORITHMS[@]} * ${#SIGN_ALGORITHMS[@]} * ${#KEY_EXCHANGE_ALGORITHMS[@]}" | bc)
41+
tested_count=0
42+
passed_count=0
43+
failed_count=0
44+
45+
echo "Starting comprehensive test of $total_combinations combinations..."
46+
echo ""
47+
48+
# Function to test a cipher suite combination
49+
test_cipher_suite() {
50+
local aead="$1"
51+
local hash="$2"
52+
local verify="$3"
53+
local sign="$4"
54+
local kx="$5"
55+
56+
((tested_count++))
57+
58+
# Build feature string
59+
local features="tls12,$aead,$hash,$verify,$sign,$kx"
60+
61+
# Create a short name for display
62+
local name="${aead#*-}-${hash#*-}-${verify#*-verify-}-${sign#*-}-${kx#*-}"
63+
64+
echo "[$tested_count/$total_combinations] Testing: $name"
65+
echo " Features: $features"
66+
67+
# Test the combination
68+
if cargo test --features "$features" >/dev/null 2>&1; then
69+
echo " ✅ PASSED"
70+
((passed_count++))
71+
return 0
72+
else
73+
echo " ❌ FAILED (incompatible combination)"
74+
((failed_count++))
75+
return 1
76+
fi
77+
}
78+
79+
# Test all combinations using nested loops (Cartesian product)
80+
for aead in "${AEAD_ALGORITHMS[@]}"; do
81+
for hash in "${HASH_ALGORITHMS[@]}"; do
82+
for verify in "${VERIFY_ALGORITHMS[@]}"; do
83+
for sign in "${SIGN_ALGORITHMS[@]}"; do
84+
for kx in "${KEY_EXCHANGE_ALGORITHMS[@]}"; do
85+
test_cipher_suite "$aead" "$hash" "$verify" "$sign" "$kx"
86+
echo ""
87+
done
88+
done
89+
done
90+
done
91+
done
92+
93+
echo "=================================================="
94+
echo "COMPREHENSIVE TEST RESULTS:"
95+
echo "=================================================="
96+
echo "Total combinations tested: $tested_count"
97+
echo "Passed: $passed_count"
98+
echo "Failed: $failed_count"
99+
echo "Success rate: $(echo "scale=2; $passed_count * 100 / $tested_count" | bc)%"
100+
echo ""
101+
echo "Note: Failed combinations are expected as not all component combinations"
102+
echo "are compatible or implemented in the codebase."
103+
echo ""
104+
echo "To run specific combinations:"
105+
echo " cargo test --features 'tls12,aead-aes-gcm,hash-sha256,verify-rsa-pkcs1-sha256,sign-rsa-pkcs1,kx-p256'"
106+
echo ""
107+
echo "For GitHub Actions matrix testing, see: .github/workflows/cipher-suite-test.yml"
108+
echo "To regenerate this script, run: python generate-cipher-suite-tests.py --shell"

0 commit comments

Comments
 (0)