Skip to content

Commit 7d659ca

Browse files
gojimmypigojimmypi
committed
Introduce sm-cipher workflow tests to wolfsm
1 parent 24eeb72 commit 7d659ca

File tree

3 files changed

+301
-0
lines changed

3 files changed

+301
-0
lines changed

‎.github/SECURITY.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
If you discover a vulnerability, please report it to support@wolfssl.com
6+
7+
1. Include a detailed description
8+
2. Include method to reproduce and/or method of discovery
9+
3. We will evaluate the report promptly and respond to you with findings.
10+
4. We will credit you with the report if you would like.
11+
12+
**Please keep the vulnerability private** until a fix has been released.

‎.github/workflows/sm-cipher.yml‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
name: SM Cipher Test (2 of 2)
2+
#
3+
# Test fetches wolfssl-examples/Arduino and uses local, latest github master branch wolfssl
4+
#
5+
# These 4 workflows across 3 repos are interdependent for the current $REPO_OWNER:
6+
#
7+
# sm-cipher CI Build 1: https://github.com/$REPO_OWNER/wolfssl # /.github/workflows/sm-cipher.yml
8+
# - Builds SM-enabled library from local clone of wolfssl master branch
9+
# - Fetches examples from https://github.com/$REPO_OWNER/wolfsm
10+
#
11+
# THIS sm-cipher CI Build 2: https://github.com/$REPO_OWNER/wolfsm # /.github/workflows/sm-cipher.yml
12+
# - Builds SM-enabled library from fresh clone of wolfssl master branch here
13+
#
14+
# ** NOTE TO MAINTAINERS **
15+
#
16+
# Consider using winmerge or similar tool to keep the 2 sm-cipher.yml files in relative sync.
17+
# Although there are some specific differences, most of the contents are otherwise identical.
18+
#
19+
20+
# START OF COMMON SECTION
21+
on:
22+
push:
23+
branches: [ '**', 'master', 'main', 'release/**' ]
24+
paths:
25+
- '.github/workflows/sm-cipher.yml'
26+
- 'src/**'
27+
- 'wolfcrypt/**'
28+
- 'wolfssl/**'
29+
pull_request:
30+
# Run after merge on protected branches
31+
branches: [ "main", "master", "release/**" ]
32+
paths:
33+
- '.github/workflows/sm-cipher.yml'
34+
- 'src/**'
35+
- 'wolfcrypt/**'
36+
- 'wolfssl/**'
37+
workflow_dispatch:
38+
39+
concurrency:
40+
group: ${{ github.workflow }}-${{ github.ref }}
41+
cancel-in-progress: true
42+
# END OF COMMON SECTION
43+
44+
jobs:
45+
build:
46+
# TODO:
47+
# if: github.repository_owner == 'wolfssl'
48+
runs-on: ubuntu-latest
49+
env:
50+
REPO_OWNER: ${{ github.repository_owner }}
51+
steps:
52+
- name: Checkout Repository
53+
uses: actions/checkout@v4
54+
55+
- name: Set job environment variables
56+
run: |
57+
# Script to assign some common environment variables after everything is installed
58+
59+
ICON_OK=$(printf "\xE2\x9C\x85")
60+
ICON_FAIL=$(printf "\xE2\x9D\x8C")
61+
62+
# Show predefined summary:
63+
64+
# For the wolfssl repo, the GITHUB_WORKSPACE is the directory of wolfssl
65+
echo "GITHUB_WORKSPACE = $GITHUB_WORKSPACE"
66+
67+
# Show assigned build:env values (e.g. "wolfssl", "gojimmpi" or other owners):
68+
echo "REPO_OWNER = $REPO_OWNER"
69+
70+
# Update environment variables, not available here in this step yet
71+
echo "GITHUB_WORK=$(realpath "$GITHUB_WORKSPACE/../..")" >> "$GITHUB_ENV"
72+
echo "WOLFSM_ROOT=$(realpath "$GITHUB_WORKSPACE/../wolfsm")" >> "$GITHUB_ENV"
73+
echo "WOLFSSL_ROOT=$(realpath "$GITHUB_WORKSPACE/../wolfssl")" >> "$GITHUB_ENV"
74+
75+
echo "GITHUB_ENV=$GITHUB_ENV"
76+
77+
git status
78+
79+
echo "contents..."
80+
# typically "/home/runner/work/wolfssl/wolfssl" contains wolfssl source
81+
pwd
82+
ls
83+
84+
- name: Get wolfssl
85+
run: |
86+
# We are in wolfsm repo, fetch wolfssl code
87+
88+
# Show our custom values:
89+
echo "GITHUB_WORK = $GITHUB_WORK"
90+
91+
# WOLFSM_ROOT is the repo root for wolfsm clone
92+
echo "WOLFSM_ROOT = $WOLFSM_ROOT"
93+
94+
echo "Start pwd:"
95+
pwd
96+
# we're typically in $GITHUB_WORKSPACE=/home/runner/work/wolfssl/wolfssl
97+
# goto /home/runner/work to fetch wolfsm
98+
99+
echo "Current pwd for wolfsm clone fetch: $(pwd)"
100+
GITHUB_WORK=$(realpath "$GITHUB_WORKSPACE/../..")
101+
echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE"
102+
103+
104+
pushd ../
105+
echo "Updated pwd for wolfssl clone fetch: $(pwd)"
106+
107+
echo "clone --depth 1 https://github.com/$REPO_OWNER/wolfssl.git wolfssl"
108+
109+
git clone --depth 1 https://github.com/$REPO_OWNER/wolfssl.git wolfssl
110+
111+
cd ./wolfssl
112+
echo "Contents of this path for wolfssl = $(pwd)"
113+
ls
114+
popd
115+
116+
# ** END ** Get wolfssl
117+
118+
- name: Install wolfsm
119+
run: |
120+
# Run the local install.sh install script to install wolfsm code
121+
122+
echo "Current pwd for wolfsm clone fetch: $(pwd)"
123+
GITHUB_WORK=$(realpath "$GITHUB_WORKSPACE/../..")
124+
echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE"
125+
126+
# Typically /home/runner/work
127+
echo "GITHUB_WORK=$GITHUB_WORK"
128+
pwd
129+
echo "pushd $WOLFSM_ROOT"
130+
pushd "$WOLFSM_ROOT"
131+
pwd
132+
ls
133+
134+
echo "wolfssl check"
135+
ls ../wolfssl
136+
137+
echo "Call wolfsm/install.sh to install wolfsm code into $WOLFSSL_ROOT"
138+
./install.sh "$WOLFSSL_ROOT"
139+
popd
140+
141+
echo "contents..."
142+
pwd
143+
ls
144+
145+
# Done with install wolfssl
146+
147+
- name: Compile wolfssl
148+
run: |
149+
# Compile fresh wolfSSL with wolfsm code
150+
151+
cd "$WOLFSSL_ROOT"
152+
echo "Current directory: $PWD"
153+
154+
./autogen.sh
155+
./configure --enable-sm3 --enable-sm4-ecb --enable-sm4-cbc --enable-sm4-ctr --enable-sm4-gcm --enable-sm4-ccm --enable-sm2
156+
make
157+
# Done with compile wolfssl
158+
159+
- name: make check
160+
run: |
161+
# make check
162+
163+
cd "$WOLFSSL_ROOT"
164+
echo "Current directory: $PWD"
165+
166+
make check
167+
168+
- name: Test SM wolfcrypt
169+
shell: bash
170+
run: |
171+
# Run wolfcrypt tests from cloned wolfssl directory
172+
173+
cd "$WOLFSSL_ROOT"
174+
echo "Current directory: $PWD"
175+
176+
set -euo pipefail
177+
178+
./wolfcrypt/test/testwolfcrypt
179+
180+
- name: Run SM benchmark
181+
shell: bash
182+
run: |
183+
# Run benchmark from cloned wolfssl directory
184+
185+
cd "$WOLFSSL_ROOT"
186+
echo "Current directory: $PWD"
187+
188+
set -euo pipefail
189+
190+
./wolfcrypt/benchmark/benchmark
191+
192+
- name: Test SM client/server (TLS 1.2 and 1.3)
193+
shell: bash
194+
run: |
195+
# Run client / server tests from cloned wolfssl directory
196+
197+
cd "$WOLFSSL_ROOT"
198+
echo "Current directory: $PWD"
199+
200+
set -euo pipefail
201+
202+
# Parameterized cases
203+
cases=(
204+
"-v 3 -l ECDHE-ECDSA-SM4-CBC-SM3"
205+
"-v 3 -l ECDHE-ECDSA-SM4-GCM-SM3"
206+
"-v 3 -l ECDHE-ECDSA-SM4-CCM-SM3"
207+
"-v 4 -l TLS13-SM4-GCM-SM3"
208+
"-v 4 -l TLS13-SM4-CCM-SM3"
209+
)
210+
211+
srv_bin=./examples/server/server
212+
cli_bin=./examples/client/client
213+
214+
srv_cert=./certs/sm2/server-sm2.pem
215+
srv_key=./certs/sm2/server-sm2-priv.pem
216+
cli_cert=./certs/sm2/client-sm2.pem
217+
cli_key=./certs/sm2/client-sm2-priv.pem
218+
ca_root=./certs/sm2/root-sm2.pem
219+
220+
# Use an explicit port so we can start/stop cleanly
221+
port=11111
222+
223+
# Ensure background server is cleaned up even on failure
224+
cleanup() { pkill -P $$ >/dev/null 2>&1 || true; }
225+
trap cleanup EXIT
226+
227+
for args in "${cases[@]}"; do
228+
echo "=== Testing ${args} on port ${port} ==="
229+
230+
# Start server in background; capture PID
231+
"${srv_bin}" ${args} \
232+
-c "${srv_cert}" -k "${srv_key}" \
233+
-A "${cli_cert}" -V \
234+
-p "${port}" &
235+
srv_pid=$!
236+
237+
# Wait briefly for the server to listen
238+
if command -v ss >/dev/null 2>&1; then
239+
for _ in {1..40}; do
240+
ss -ltn | grep -q ":${port} " && break
241+
echo "Waiting for server on port ${port} ..."
242+
sleep 0.25
243+
done
244+
else
245+
sleep 2
246+
fi
247+
248+
# Run client with timeout so CI does not hang
249+
set +e
250+
timeout 60s "${cli_bin}" ${args} \
251+
-h 127.0.0.1 -p "${port}" \
252+
-c "${cli_cert}" \
253+
-k "${cli_key}" \
254+
-A "${ca_root}" -C
255+
rc=$?
256+
set -e
257+
258+
# Graceful shutdown: only kill if still running; keep quiet
259+
if kill -0 "${srv_pid}" >/dev/null 2>&1; then
260+
kill "${srv_pid}" # >/dev/null 2>&1 || true
261+
fi
262+
wait "${srv_pid}" # >/dev/null 2>&1 || true
263+
264+
if [ ${rc} -ne 0 ]; then
265+
echo "Client failed for: ${args} (rc=${rc})"
266+
exit ${rc}
267+
fi
268+
done
269+
270+
- name: Unit test
271+
run: |
272+
# Run unit.test ./tests/test-sm2.conf
273+
274+
cd "$WOLFSSL_ROOT"
275+
echo "Current directory: $PWD"
276+
277+
echo "looking for test-sm2.conf"
278+
ls ./tests/test-sm2.conf
279+
280+
echo "Run unit test: ./tests/unit.test ./tests/test-sm2.conf"
281+
./tests/unit.test ./tests/test-sm2.conf

‎.gitignore‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Visual Studio
2+
/.vs
3+
4+
# Visual Studio Code Workspace Files
5+
*.vscode
6+
7+
# Backup files
8+
*.bak

0 commit comments

Comments
 (0)