If the variable SKIP_TEST_SUITES is not defined with -D, but is defined
in an environment variable, tell cmake to get it from there.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
When testing under Valgrind for constant flow, skip test suites that don't
have any constant-flow annotations, since the testing wouldn't do anything
more that testing with ordinary Valgrind (component_test_valgrind).
This is a significant time saving since testing with Valgrind is very slow.
In Mbed TLS 2.28, MBEDTLS_USE_PSA_CRYPTO does not affect constant-time
functions, so testing in the full configuration covers all we need.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This is the first step in arranging that functions from constant_time.c are
tested in test_suite_constant_time.function.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
These are very CPU-intensive, so make it easy to skip them. And conversely,
make it easy to run them without the growing body of SSL tests.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The test cases using tcp_client.pl are failing only on Travis's bionic and
focal systems (I can't reproduce the failure locally). Exclude them.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Don't use an all.sh component because there isn't one that does what we
want (modern Clang with ASan, and test everything).
* We need to set CC explicitly or tweak PATH, because clang in $PATH on
Travis focal instances is Clang 7 which is too old (we want Clang 10).
* Travis lacks the array of versions of openssl and gnutls that we normally
use for testing, so we need to exclude some tests (or build our
own multiple versions of openssl and gnutls).
The SSL test exclusions are ad hoc and based on what currently works.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Restore compatibiltiy testing against OpenSSL for
(D)TLS versions smaller that 1.2.
. Fix the check for support in OpenSSL for these versions
. For test cases for (D)TLS version smaller than 1.2,
restore the configuration of OpenSSL client/server
with the given TLS version, as it was before #5660
that broke it.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
OpenSSL may be configured to support features such as cipher suites or
protocol versions that are disabled by default. Enable them all: we're
testing, we don't care about enabling insecure stuff. This is not needed
with the builds of OpenSSL that we're currently using on the Jenkins CI, but
it's needed with more recent versions such as typically found on developer
machines, and with future CI additions.
The syntax to do that was only introduced in OpenSSL 1.1.0; fortunately we
don't need to do anything special with earlier versions.
With OpenSSL 1.1.1f on Ubuntu 20.04, this is needed to enable TLS 1.0, TLS
1.1 and DTLS 1.0. This also allows SHA-1 in certificates, which is still
needed for a few test cases in ssl-opt.sh. Curiously, this is also needed
for the cipher suite TLS-DHE-PSK-WITH-ARIA-128-GCM-SHA256 (and no other,
including other DHE-PSK or ARIA cipher suites).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Restore compatibiltiy testing against OpenSSL for
(D)TLS versions smaller that 1.2.
. Fix the check for support in OpenSSL for these versions
. For test cases for (D)TLS version smaller than 1.2,
restore the configuration of OpenSSL client/server
with the given TLS version, as it was before #5660
that broke it.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
psa_cipher_encrypt() and psa_cipher_decrypt() sometimes add a zero offset to
a null pointer when the cipher does not use an IV. This is undefined
behavior, although it works as naively expected on most platforms. This
can cause a crash with modern Clang+ASan (depending on compiler optimizations).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The first half of the table is not used, let's reuse index 0 for the
result instead of appending it in the end.
Signed-off-by: Janos Follath <janos.follath@arm.com>
