Lines Matching +full:test +full:- +full:only
6 # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
15 # -------
20 # ---------------
22 # Warning: the test is destructive. It includes various build modes and
32 # * Basic Unix tools (Windows users note: a Unix-style find must be before
39 # * arm-gcc and mingw-gcc
40 # * ArmCC 5 and ArmCC 6, unless invoked with --no-armcc
43 # to test, then a legacy version of these tools must be present as well
50 # The behavior on an error depends on whether --keep-going (alias -k)
52 # * Without --keep-going: the script stops on the first error without
55 # * With --keep-going: the script runs all requested components and
60 # script -c tests/scripts/all.sh
65 # ---------------------
73 # * component_test_XXX: build and test.
85 # fails if any command in it returns a non-zero status.
89 # cleaned-up state, and don't need to perform the cleanup themselves.
95 # This cleans up after an in-tree use of CMake.
107 # Abort on errors (even on the left-hand side of a pipe).
109 set -e -o pipefail -u
112 shopt -s extglob
115 test -d include -a -d library -a -d programs -a -d tests
119 test -d include -a -d core -a -d drivers -a -d programs -a -d tests
124 echo "Must be run from Mbed TLS / psa-crypto root" >&2
136 CONFIG_TEST_DRIVER_H='tests/include/test/drivers/config_test_driver.h'
145 # Files clobbered by in-tree cmake
155 # Seed value used with the --release-test option.
157 # See also RELEASE_SEED in basic-build-test.sh. Debugging is easier if
160 # basic-build-test.sh as well.
164 … : ${MBEDTLS_TEST_PLATFORM="$(uname -s | tr -c \\n0-9A-Za-z _)-$(uname -m | tr -c \\n0-9A-Za-z _)"}
172 : ${GNUTLS_CLI:="gnutls-cli"}
173 : ${GNUTLS_SERV:="gnutls-serv"}
179 : ${ARM_NONE_EABI_GCC_PREFIX:=arm-none-eabi-}
180 : ${ARM_LINUX_GNUEABI_GCC_PREFIX:=arm-linux-gnueabi-}
181 : ${CLANG_LATEST:="clang-latest"}
182 : ${CLANG_EARLIEST:="clang-earliest"}
183 : ${GCC_LATEST:="gcc-latest"}
184 : ${GCC_EARLIEST:="gcc-earliest"}
185 # if MAKEFLAGS is not set add the -j option to speed up invocations of make
186 if [ -z "${MAKEFLAGS+set}" ]; then
187 export MAKEFLAGS="-j$(all_sh_nproc)"
194 # default to -O2, use -Ox _after_ this if you want another level
195 ASAN_CFLAGS='-O2 -Werror -fsanitize=address,undefined -fno-sanitize-recover=all'
203 ALL_COMPONENTS=$(compgen -A function component_ | sed 's/component_//')
216 # Test whether the component $1 is included in the command line patterns.
220 # only does word splitting.
221 set -f
235 By default, run all tests. With one or more COMPONENT, run only those.
241 $0 --no-armcc --except test_memsan
245 -h|--help Print this help and exit.
246 --list-all-components List all available test components and exit.
247 --list-components List components supported on this platform and exit.
250 -q|--quiet Only output component names, and errors if any.
251 -f|--force Force the tests to overwrite any modified files.
252 -k|--keep-going Run all tests and report errors at the end.
253 -m|--memory Additional optional memory tests.
254 --append-outcome Append to the outcome file (if used).
255 --arm-none-eabi-gcc-prefix=<string>
256 Prefix for a cross-compiler for arm-none-eabi
258 --arm-linux-gnueabi-gcc-prefix=<string>
259 Prefix for a cross-compiler for arm-linux-gnueabi
261 --armcc Run ARM Compiler builds (on by default).
262 --restore First clean up the build tree, restoring backed up
265 --error-test Error test mode: run a failing function in addition
267 --except Exclude the COMPONENTs listed on the command line,
268 instead of running only those.
269 --no-append-outcome Write a new outcome file and analyze it (default).
270 --no-armcc Skip ARM Compiler builds.
271 --no-force Refuse to overwrite modified files (default).
272 --no-keep-going Stop at the first error (default).
273 --no-memory No additional memory tests (default).
274 --no-quiet Print full output from components.
275 --out-of-source-dir=<path> Directory used for CMake out-of-source build tests.
276 --outcome-file=<path> File where test outcomes are written (not done if
278 --random-seed Use a random seed value for randomized tests (default).
279 …-r|--release-test Run this script in release mode. This fixes the seed value to ${RELEASE_SEED…
280 -s|--seed Integer seed value to use for this test run.
283 --armc5-bin-dir=<ARMC5_bin_dir_path> ARM Compiler 5 bin directory.
284 --armc6-bin-dir=<ARMC6_bin_dir_path> ARM Compiler 6 bin directory.
285 --clang-earliest=<Clang_earliest_path> Earliest version of clang available
286 --clang-latest=<Clang_latest_path> Latest version of clang available
287 --gcc-earliest=<GCC_earliest_path> Earliest version of GCC available
288 --gcc-latest=<GCC_latest_path> Latest version of GCC available
289 --gnutls-cli=<GnuTLS_cli_path> GnuTLS client executable to use for most tests.
290 --gnutls-serv=<GnuTLS_serv_path> GnuTLS server executable to use for most tests.
291 --gnutls-legacy-cli=<GnuTLS_cli_path> GnuTLS client executable to use for legacy tests.
292 --gnutls-legacy-serv=<GnuTLS_serv_path> GnuTLS server executable to use for legacy tests.
293 --openssl=<OpenSSL_path> OpenSSL executable to use for most tests.
294 --openssl-legacy=<OpenSSL_path> OpenSSL executable to use for legacy tests..
295 … --openssl-next=<OpenSSL_path> OpenSSL executable to use for recent things like ARIA
309 find . -name .git -prune -o \
310 -iname CMakeFiles -exec rm -rf {} \+ -o \
311 \( -iname cmake_install.cmake -o \
312 -iname CTestTestfile.cmake -o \
313 -iname CMakeCache.txt -o \
314 -path './cmake/*.cmake' \) -exec rm -f {} \+
315 # Recover files overwritten by in-tree CMake builds
316 rm -f include/Makefile include/mbedtls/Makefile programs/!(fuzz)/Makefile
318 # Remove any artifacts from the component_test_cmake_as_subdirectory test.
319 rm -rf programs/test/cmake_subproject/build
320 rm -f programs/test/cmake_subproject/Makefile
321 rm -f programs/test/cmake_subproject/cmake_subproject
323 # Remove any artifacts from the component_test_cmake_as_package test.
324 rm -rf programs/test/cmake_package/build
325 rm -f programs/test/cmake_package/Makefile
326 rm -f programs/test/cmake_package/cmake_package
328 # Remove any artifacts from the component_test_cmake_as_installed_package test.
329 rm -rf programs/test/cmake_package_install/build
330 rm -f programs/test/cmake_package_install/Makefile
331 rm -f programs/test/cmake_package_install/cmake_package_install
335 if [[ -e "$x$backup_suffix" ]]; then
336 cp -p "$x$backup_suffix" "$x"
342 # in non-keep-going mode).
347 rm -f "$x$backup_suffix"
359 trap - $1
360 kill -$1 $$
373 sysctl -n hw.ncpuonline || # NetBSD, OpenBSD
374 sysctl -n hw.ncpu || # FreeBSD
381 if [ -n "${current_component:-}" ]; then
387 if [ $QUIET -eq 1 ]; then
404 WARNING_CFLAGS='-Werror -xc -std=c99' make lib
407 "$ARMC6_FROMELF" -z library/*.o
430 while [ $# -gt 0 ]; do
432 --armc5-bin-dir) shift; ARMC5_BIN_DIR="$1";;
433 --armc6-bin-dir) shift; ARMC6_BIN_DIR="$1";;
449 while [ $# -gt 0 ]; do
451 --append-outcome) append_outcome=1;;
452 --arm-none-eabi-gcc-prefix) shift; ARM_NONE_EABI_GCC_PREFIX="$1";;
453 --arm-linux-gnueabi-gcc-prefix) shift; ARM_LINUX_GNUEABI_GCC_PREFIX="$1";;
454 --armcc) no_armcc=;;
455 … --armc5-bin-dir) shift; ;; # assignment to ARMC5_BIN_DIR done in pre_parse_command_line_for_dirs
456 … --armc6-bin-dir) shift; ;; # assignment to ARMC6_BIN_DIR done in pre_parse_command_line_for_dirs
457 --clang-earliest) shift; CLANG_EARLIEST="$1";;
458 --clang-latest) shift; CLANG_LATEST="$1";;
459 --error-test) error_test=$((error_test + 1));;
460 --except) all_except=1;;
461 --force|-f) FORCE=1;;
462 --gcc-earliest) shift; GCC_EARLIEST="$1";;
463 --gcc-latest) shift; GCC_LATEST="$1";;
464 --gnutls-cli) shift; GNUTLS_CLI="$1";;
465 --gnutls-legacy-cli) shift; GNUTLS_LEGACY_CLI="$1";;
466 --gnutls-legacy-serv) shift; GNUTLS_LEGACY_SERV="$1";;
467 --gnutls-serv) shift; GNUTLS_SERV="$1";;
468 --help|-h) usage; exit;;
469 --keep-going|-k) KEEP_GOING=1;;
470 --list-all-components) printf '%s\n' $ALL_COMPONENTS; exit;;
471 --list-components) printf '%s\n' $SUPPORTED_COMPONENTS; exit;;
472 --memory|-m) MEMORY=1;;
473 --no-append-outcome) append_outcome=0;;
474 --no-armcc) no_armcc=1;;
475 --no-force) FORCE=0;;
476 --no-keep-going) KEEP_GOING=0;;
477 --no-memory) MEMORY=0;;
478 --no-quiet) QUIET=0;;
479 --openssl) shift; OPENSSL="$1";;
480 --openssl-legacy) shift; OPENSSL_LEGACY="$1";;
481 --openssl-next) shift; OPENSSL_NEXT="$1";;
482 --outcome-file) shift; MBEDTLS_TEST_OUTCOME_FILE="$1";;
483 --out-of-source-dir) shift; OUT_OF_SOURCE_DIR="$1";;
484 --quiet|-q) QUIET=1;;
485 --random-seed) unset SEED;;
486 --release-test|-r) SEED=$RELEASE_SEED;;
487 --restore) restore_first=1;;
488 --seed|-s) shift; SEED="$1";;
489 -*)
491 echo >&2 "Run $0 --help for usage."
500 if [ -z "$COMMAND_LINE_COMPONENTS" ] && [ $restore_first -eq 0 ]; then
504 # --no-armcc is a legacy option. The modern way is --except '*_armcc*'.
506 if [ -n "$no_armcc" ] && [ $all_except -eq 1 ]; then
511 if [ $all_except -eq 0 ]; then
514 # only does word splitting.
515 set -f
531 if [ $unsupported -ne 0 ]; then
539 if is_component_included "$component"; [ $? -eq $all_except ]; then
549 if [ $FORCE -eq 1 ]; then
550 rm -rf "$OUT_OF_SOURCE_DIR"
551 git checkout-index -f -q $CONFIG_H
555 if [ -d "$OUT_OF_SOURCE_DIR" ]; then
556 echo "Warning - there is an existing directory at '$OUT_OF_SOURCE_DIR'" >&2
557 echo "You can either delete this directory manually, or force the test by rerunning"
558 echo "the script as: $0 --force --out-of-source-dir $OUT_OF_SOURCE_DIR"
562 if ! git diff --quiet "$CONFIG_H"; then
563 err_msg "Warning - the configuration file '$CONFIG_H' has been edited. "
564 echo "You can either delete or preserve your work, or force the test by rerunning the"
565 echo "script as: $0 --force"
577 case "$(head -n1 Makefile)" in
579 …git update-index --no-skip-worktree Makefile library/Makefile programs/Makefile tests/Makefile pro…
580 … git checkout -- Makefile library/Makefile programs/Makefile tests/Makefile programs/fuzz/Makefile
587 cp -p "$x" "$x$backup_suffix"
603 if [ -t 1 ]; then
604 case "${TERM:-}" in
613 failure_summary_file=$PWD/all-sh-failures-$$.log
617 # command fails (test command) or not (configure or build).
629 *make*[\ /]tests*) false;; # make tests, make CFLAGS=-I../tests, ...
630 *test*) true;; # make test, tests/stuff, env V=v tests/stuff, ...
646 failed_command=${report_failed_command-$BASH_COMMAND}
648 if [[ $last_failure_status -eq $previous_failure_status &&
650 ${#FUNCNAME[@]} == $((previous_failure_funcall_depth - 1)) ]]
663 text="$current_section: $failed_command -> $last_failure_status"
668 # component. Otherwise (test command) keep the component running
676 if [ $failure_count -gt 0 ]; then
682 elif [ -z "${1-}" ]; then
685 if [ -n "${1-}" ]; then
688 rm -f "$failure_summary_file"
689 if [ $failure_count -gt 0 ]; then
718 if [ -n "$MBEDTLS_TEST_OUTCOME_FILE" ] && [ "$append_outcome" -eq 0 ]; then
719 rm -f "$MBEDTLS_TEST_OUTCOME_FILE"
724 if [ $QUIET -eq 1 ]; then
731 echo "MBEDTLS_TEST_OUTCOME_FILE: ${MBEDTLS_TEST_OUTCOME_FILE:-(none)}"
732 echo "SEED: ${SEED-"UNSET"}"
752 # only doing builds). Not all tests run OpenSSL and GnuTLS, but this
756 # and ssl-opt.sh, we just export the variables they require.
760 # Avoid passing --seed flag in every call to ssl-opt.sh
761 if [ -n "${SEED-}" ]; then
783 *_mingw[_\ ]*) check_tools "i686-w64-mingw32-gcc";;
802 # past this point, no call to check_tool, only printing output
803 if [ $QUIET -eq 1 ]; then
820 if [ $QUIET -eq 1 ]; then
832 # -------------------------
837 # - loc_accel_list="ALG_JPAKE"
838 # - loc_accel_list="ALG_FFDH KEY_TYPE_DH_KEY_PAIR KEY_TYPE_DH_PUBLIC_KEY"
848 # 2c. Adjust MBEDTLS_ symbols in mbedtls_config.h. This only affects the
853 # file: tests/include/test/drivers/config_test_driver.h. You usually
856 # calling scripts/config.py on this file remains the only option.
857 # 3. Build the driver library, then the main libraries, test, and programs.
869 # helper_libtestdriver1_make_main "$loc_accel_list" -C tests test_suite_foo
872 # Adjust the configuration - for both libtestdriver1 and main library,
881 # Enable PSA-based config (necessary to use drivers)
885 # partial support for cipher operations in the driver test library.
886 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_STREAM_CIPHER
887 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_ECB_NO_PADDING
895 # The function optionally accepts 1 parameter: a space-separated list of the
898 allowed_list="${1:-}"
899 scripts/config.py unset-all "MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED"
911 for item in $(sed -n 's/^#define PSA_WANT_\(ECC_[0-9A-Z_a-z]*\).*/\1/p' <"$CRYPTO_CONFIG_H"); do
924 …for item in $(sed -n "s/^#define PSA_WANT_\(KEY_TYPE_${key_type}_[0-9A-Z_a-z]*\).*/\1/p" <"$CRYPTO…
938 # 1. a space-separated list of things to accelerate;
939 # 2. optional: a space-separate list of things to also support.
942 loc_accel_flags=$( echo "$1 ${2-}" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
943 make -C tests libtestdriver1.a CFLAGS=" $ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
950 # 1. a space-separated list of things to accelerate;
952 # (examples: lib, -C tests test_suite_xxx, etc.)
959 …loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g'…
960 …loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&…
961 …$ASAN_CFLAGS -I../tests/include -I../tests -I../../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_L…
969 # Test Suites to be executed
971 # The test ordering tries to optimize for the following criteria:
985 msg "Check: check-generated-files, files generated with make" # 2s
987 tests/scripts/check-generated-files.sh
989 msg "Check: check-generated-files -u, files present" # 2s
990 tests/scripts/check-generated-files.sh -u
992 tests/scripts/check-generated-files.sh
994 msg "Check: check-generated-files -u, files absent" # 2s
996 tests/scripts/check-generated-files.sh -u
998 tests/scripts/check-generated-files.sh
1006 tests/scripts/check-doxy-blocks.pl
1016 rm -f ChangeLog.new
1017 scripts/assemble_changelog.py -o ChangeLog.new
1018 if [ -e ChangeLog.new ]; then
1020 # non-empty.
1021 diff -u ChangeLog ChangeLog.new || true
1028 tests/scripts/check_names.py -v
1032 msg "Check: test case descriptions" # < 1s
1033 if [ $QUIET -eq 1 ]; then
1034 opt='--quiet'
1038 tests/scripts/check_test_cases.py -q $opt
1050 #### Build and test many configurations and targets
1054 msg "build: make, default config (out-of-box)" # ~1min
1059 msg "test: main suites make, default config (out-of-box)" # ~10s
1060 make test
1062 msg "selftest: make, default config (out-of-box)" # ~10s
1063 programs/test/selftest
1068 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1071 msg "test: main suites (inc. selftests) (ASan build)" # ~ 50s
1072 make test
1074 msg "test: selftest (ASan build)" # ~ 10s
1075 programs/test/selftest
1077 msg "test: ssl-opt.sh (ASan build)" # ~ 1 min
1078 tests/ssl-opt.sh
1080 msg "test: compat.sh (ASan build)" # ~ 6 min
1083 msg "test: context-info.sh (ASan build)" # ~ 15 sec
1084 tests/context-info.sh
1090 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1093 msg "test: main suites (inc. selftests) (ASan build)" # ~ 50s
1094 make test
1096 msg "test: selftest (ASan build)" # ~ 10s
1097 programs/test/selftest
1099 msg "test: ssl-opt.sh (ASan build)" # ~ 1 min
1100 tests/ssl-opt.sh
1102 msg "test: compat.sh (ASan build)" # ~ 6 min
1105 msg "test: context-info.sh (ASan build)" # ~ 15 sec
1106 tests/context-info.sh
1112 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1115 msg "test: main suites (inc. selftests) (full config, ASan build)"
1116 make test
1118 msg "test: selftest (ASan build)" # ~ 10s
1119 programs/test/selftest
1121 msg "test: ssl-opt.sh (full config, ASan build)"
1122 tests/ssl-opt.sh
1124 msg "test: compat.sh (full config, ASan build)"
1127 msg "test: context-info.sh (full config, ASan build)" # ~ 15 sec
1128 tests/context-info.sh
1136 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1139 msg "test: main suites (inc. selftests) (full config, ASan build)"
1140 make test
1142 msg "test: selftest (ASan build)" # ~ 10s
1143 programs/test/selftest
1145 msg "test: ssl-opt.sh (full config, ASan build)"
1146 tests/ssl-opt.sh
1148 msg "test: compat.sh (full config, ASan build)"
1151 msg "test: context-info.sh (full config, ASan build)" # ~ 15 sec
1152 tests/context-info.sh
1160 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1163 msg "test: main suites (inc. selftests) (full config, ASan build)"
1164 make test
1166 msg "test: selftest (ASan build)" # ~ 10s
1167 programs/test/selftest
1174 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1177 msg "test: full config - USE_PSA_CRYPTO + PSA_CRYPTO_KEY_ID_ENCODES_OWNER, cmake, gcc, ASan"
1178 make test
1186 grep -x -F "$(sed -n 's/^ *# *define *\([A-Z_a-z][0-9A-Z_a-z]*\)..*/\1/p' "$1")"
1195 # We can only compile, not link, since our test and sample programs
1198 make CC=gcc CFLAGS='-Werror -Wall -Wextra -I../tests/include/spe' lib
1200 # Check that if a symbol is renamed by crypto_spe.h, the non-renamed
1207 msg "build: default config - PSA_CRYPTO_C + PSA_CRYPTO_CLIENT, make"
1215 msg "test: default config - PSA_CRYPTO_C + PSA_CRYPTO_CLIENT, make"
1216 make test
1224 msg "test: default config minus MBEDTLS_GENPRIME"
1225 make test
1229 msg "test/build: ref-configs (ASan build)" # ~ 6 min 20s
1230 # test-ref-configs works by overwriting mbedtls_config.h; this makes cmake
1231 # want to re-generate generated files that depend on it, quite correctly.
1234 # cmake can't know this, but re-generation is actually not necessary as
1235 # the generated files only depend on the list of available options, not
1236 # whether they're on or off. So, disable cmake's (over-sensitive here)
1239 CC=gcc cmake -D GEN_FILES=Off -D CMAKE_BUILD_TYPE:String=Asan .
1240 tests/scripts/test-ref-configs.pl
1246 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1249 msg "test: !MBEDTLS_SSL_RENEGOTIATION - main suites (inc. selftests) (ASan build)" # ~ 50s
1250 make test
1252 msg "test: !MBEDTLS_SSL_RENEGOTIATION - ssl-opt.sh (ASan build)" # ~ 6 min
1253 tests/ssl-opt.sh
1262 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1265 …msg "test: !MBEDTLS_PEM_PARSE_C !MBEDTLS_FS_IO - main suites (inc. selftests) (ASan build)" # ~ 50s
1266 make test
1268 msg "test: !MBEDTLS_PEM_PARSE_C !MBEDTLS_FS_IO - ssl-opt.sh (ASan build)" # ~ 6 min
1269 tests/ssl-opt.sh
1275 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1278 msg "test: RSA_NO_CRT - main suites (inc. selftests) (ASan build)" # ~ 50s
1279 make test
1281 msg "test: RSA_NO_CRT - RSA-related part of ssl-opt.sh (ASan build)" # ~ 5s
1282 tests/ssl-opt.sh -f RSA
1284 msg "test: RSA_NO_CRT - RSA-related part of compat.sh (ASan build)" # ~ 3 min
1285 tests/compat.sh -t RSA
1287 msg "test: RSA_NO_CRT - RSA-related part of context-info.sh (ASan build)" # ~ 15 sec
1288 tests/context-info.sh
1298 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1301 msg "test: Full minus CTR_DRBG, classic crypto - main suites"
1302 make test
1304 # In this configuration, the TLS test programs use HMAC_DRBG.
1307 msg "test: Full minus CTR_DRBG, classic crypto - ssl-opt.sh (subset)"
1308 tests/ssl-opt.sh -f 'Default\|SSL async private.*delay=\|tickets enabled on server'
1310 msg "test: Full minus CTR_DRBG, classic crypto - compat.sh (subset)"
1311 tests/compat.sh -m tls12 -t 'ECDSA PSK' -V NO -p OpenSSL
1320 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1323 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - main suites"
1324 make test
1326 # In this configuration, the TLS test programs use HMAC_DRBG.
1329 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - ssl-opt.sh (subset)"
1330 tests/ssl-opt.sh -f 'Default\|SSL async private.*delay=\|tickets enabled on server'
1332 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - compat.sh (subset)"
1333 tests/compat.sh -m tls12 -t 'ECDSA PSK' -V NO -p OpenSSL
1344 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1347 msg "test: Full minus HMAC_DRBG, classic crypto - main suites"
1348 make test
1353 # Test SSL with non-deterministic ECDSA. Only test features that
1355 msg "test: Full minus HMAC_DRBG, classic crypto - ssl-opt.sh (subset)"
1356 tests/ssl-opt.sh -f 'Default\|SSL async private: sign'
1358 # To save time, only test one protocol version, since this part of
1360 msg "test: Full minus HMAC_DRBG, classic crypto - compat.sh (ECDSA)"
1361 tests/compat.sh -m tls12 -t 'ECDSA'
1371 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1374 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - main suites"
1375 make test
1380 # Test SSL with non-deterministic ECDSA. Only test features that
1382 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - ssl-opt.sh (subset)"
1383 tests/ssl-opt.sh -f 'Default\|SSL async private: sign'
1385 # To save time, only test one protocol version, since this part of
1387 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - compat.sh (ECDSA)"
1388 tests/compat.sh -m tls12 -t 'ECDSA'
1404 # the SSL test programs don't have an RNG and can't work. Explicitly
1405 # make them use the PSA RNG with -DMBEDTLS_TEST_USE_PSA_CRYPTO_RNG.
1406 make CFLAGS="$ASAN_CFLAGS -O2 -DMBEDTLS_TEST_USE_PSA_CRYPTO_RNG" LDFLAGS="$ASAN_CFLAGS"
1408 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, classic crypto - main suites"
1409 make test
1411 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, classic crypto - ssl-opt.sh (subset)"
1412 tests/ssl-opt.sh -f 'Default'
1425 make CFLAGS="$ASAN_CFLAGS -O2" LDFLAGS="$ASAN_CFLAGS"
1427 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto - main suites"
1428 make test
1430 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto - ssl-opt.sh (subset)"
1431 tests/ssl-opt.sh -f 'Default\|opaque'
1440 make CFLAGS="$ASAN_CFLAGS -O2" LDFLAGS="$ASAN_CFLAGS"
1442 msg "test: full + PSA_CRYPTO_EXTERNAL_RNG + USE_PSA_CRYPTO minus CTR_DRBG"
1443 make test
1445 msg "test: full + PSA_CRYPTO_EXTERNAL_RNG + USE_PSA_CRYPTO minus CTR_DRBG"
1446 tests/ssl-opt.sh -f 'Default\|opaque'
1458 …make CFLAGS="$ASAN_CFLAGS '-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'…
1460 msg "test: full + MBEDTLS_PSA_INJECT_ENTROPY"
1461 make test
1469 make CFLAGS="-DMBEDTLS_TEST_SW_INET_PTON"
1471 msg "test: default plus MBEDTLS_TEST_SW_INET_PTON"
1472 make test
1476 msg "build: crypto_full with only the light subset of MD"
1487 # Disable things that would auto-enable MD_C
1490 # Note: MD-light is auto-enabled in build_info.h by modules that need it,
1498 msg "test: crypto_full with only the light subset of MD"
1499 make test
1533 msg "test: full minus CIPHER"
1534 make test
1550 # Disable what auto-enables ECP_LIGHT
1587 msg "test: full minus bignum"
1588 make test
1592 msg "build: default with only stream cipher"
1598 …# Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, A…
1600 # Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1602 …# Enable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_C…
1610 msg "test: default with only stream cipher"
1611 make test
1613 # Not running ssl-opt.sh because most tests require a non-NULL ciphersuite.
1617 msg "build: default with only stream cipher use psa"
1624 …# Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, A…
1626 # Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1628 …# Enable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_C…
1636 msg "test: default with only stream cipher use psa"
1637 make test
1639 # Not running ssl-opt.sh because most tests require a non-NULL ciphersuite.
1643 msg "build: default with only CBC-legacy cipher"
1649 …# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, AR…
1651 # Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1653 …# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_…
1661 msg "test: default with only CBC-legacy cipher"
1662 make test
1664 msg "test: default with only CBC-legacy cipher - ssl-opt.sh (subset)"
1665 tests/ssl-opt.sh -f "TLS 1.2"
1669 msg "build: default with only CBC-legacy cipher use psa"
1676 …# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, AR…
1678 # Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1680 …# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_…
1688 msg "test: default with only CBC-legacy cipher use psa"
1689 make test
1691 msg "test: default with only CBC-legacy cipher use psa - ssl-opt.sh (subset)"
1692 tests/ssl-opt.sh -f "TLS 1.2"
1696 msg "build: default with only CBC-legacy and CBC-EtM ciphers"
1702 …# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, AR…
1704 # Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1706 …# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_…
1714 msg "test: default with only CBC-legacy and CBC-EtM ciphers"
1715 make test
1717 msg "test: default with only CBC-legacy and CBC-EtM ciphers - ssl-opt.sh (subset)"
1718 tests/ssl-opt.sh -f "TLS 1.2"
1722 msg "build: default with only CBC-legacy and CBC-EtM ciphers use psa"
1729 …# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, AR…
1731 # Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1733 …# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_…
1741 msg "test: default with only CBC-legacy and CBC-EtM ciphers use psa"
1742 make test
1744 msg "test: default with only CBC-legacy and CBC-EtM ciphers use psa - ssl-opt.sh (subset)"
1745 tests/ssl-opt.sh -f "TLS 1.2"
1748 # We're not aware of any other (open source) implementation of EC J-PAKE in TLS
1750 # implementations ourselves: one using PSA, the other not. At least test that
1753 msg "build: TLS1.2 server+client w/ EC-JPAKE w/o USE_PSA"
1756 # https://github.com/Mbed-TLS/mbedtls/issues/8229
1758 make -C programs ssl/ssl_server2 ssl/ssl_client2
1762 msg "build: TLS1.2 server+client w/ EC-JPAKE w/ USE_PSA"
1766 make -C programs ssl/ssl_server2 ssl/ssl_client2
1767 make -C programs test/udp_proxy test/query_compile_time_config
1769 msg "test: server w/o USE_PSA - client w/ USE_PSA, text password"
1770 P_SRV=../s2_no_use_psa tests/ssl-opt.sh -f "ECJPAKE: working, TLS"
1771 msg "test: server w/o USE_PSA - client w/ USE_PSA, opaque password"
1772 P_SRV=../s2_no_use_psa tests/ssl-opt.sh -f "ECJPAKE: opaque password client only, working, TLS"
1773 msg "test: client w/o USE_PSA - server w/ USE_PSA, text password"
1774 P_CLI=../c2_no_use_psa tests/ssl-opt.sh -f "ECJPAKE: working, TLS"
1775 msg "test: client w/o USE_PSA - server w/ USE_PSA, opaque password"
1776 P_CLI=../c2_no_use_psa tests/ssl-opt.sh -f "ECJPAKE: opaque password server only, working, TLS"
1784 CC=clang cmake -D CMAKE_BUILD_TYPE:String=Asan .
1787 msg "test: Everest ECDH context - main suites (inc. selftests) (ASan build)" # ~ 50s
1788 make test
1790 msg "test: Everest ECDH context - ECDH-related part of ssl-opt.sh (ASan build)" # ~ 5s
1791 tests/ssl-opt.sh -f ECDH
1793 msg "test: Everest ECDH context - compat.sh with some ECDH ciphersuites (ASan build)" # ~ 3 min
1795 tests/compat.sh -f ECDH -V NO -e 'ARIA\|CAMELLIA\|CHACHA'
1799 msg "build: Everest ECDH context, only Curve25519" # ~ 6 min
1806 scripts/config.py unset-all "MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED"
1809 make CFLAGS="$ASAN_CFLAGS -O2" LDFLAGS="$ASAN_CFLAGS"
1811 msg "test: Everest ECDH context, only Curve25519" # ~ 50s
1812 make test
1819 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1822 msg "test: small SSL_OUT_CONTENT_LEN - ssl-opt.sh MFL and large packet tests"
1823 tests/ssl-opt.sh -f "Max fragment\|Large packet"
1830 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1833 msg "test: small SSL_IN_CONTENT_LEN - ssl-opt.sh MFL tests"
1834 tests/ssl-opt.sh -f "Max fragment"
1840 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1843 msg "test: small MBEDTLS_SSL_DTLS_MAX_BUFFERING #0 - ssl-opt.sh specific reordering test"
1844 …tests/ssl-opt.sh -f "DTLS reordering: Buffer out-of-order hs msg before reassembling next, free bu…
1850 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
1853 msg "test: small MBEDTLS_SSL_DTLS_MAX_BUFFERING #1 - ssl-opt.sh specific reordering test"
1854 …tests/ssl-opt.sh -f "DTLS reordering: Buffer encrypted Finished message, drop for fragmented NewSe…
1858 msg "build+test: psa_collect_statuses" # ~30s
1862 grep -q '^0:psa_crypto_init:' tests/statuses.log
1863 rm -f tests/statuses.log
1869 CC=clang CXX=clang cmake -D CMAKE_BUILD_TYPE:String=Release -D ENABLE_TESTING=On -D TEST_CPP=1 .
1872 msg "test: main suites (full config, clang)" # ~ 5s
1873 make test
1875 msg "test: cpp_dummy_build (full config, clang)" # ~ 1s
1876 programs/test/cpp_dummy_build
1878 msg "test: psa_constant_names (full config, clang)" # ~ 1s
1881 msg "test: ssl-opt.sh default, ECJPAKE, SSL async (full config)" # ~ 1s
1882 tests/ssl-opt.sh -f 'Default\|ECJPAKE\|SSL async private'
1884 msg "test: compat.sh NULL (full config)" # ~ 2 min
1885 …GNUTLS_CLI="$GNUTLS_LEGACY_CLI" GNUTLS_SERV="$GNUTLS_LEGACY_SERV" tests/compat.sh -e '^$' -f 'NULL'
1887 msg "test: compat.sh ARIA + ChachaPoly"
1888 env OPENSSL="$OPENSSL_NEXT" tests/compat.sh -e '^$' -f 'ARIA\|CHACHA'
1892 # Skip the test suites that don't have any constant-flow annotations.
1896 git -C tests/suites grep -L TEST_CF_ 'test_suite_*.function' |
1903 # Skip all but the given test suite
1905 ls -1 tests/suites/test_suite_*.function |
1906 grep -v $1.function |
1915 # - unset MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN - does the failure persist?
1916 # - or alternatively, change the build type to MemSanDbg, which enables
1924 CC=clang cmake -D CMAKE_BUILD_TYPE:String=MemSan .
1927 msg "test: main suites (full minus MBEDTLS_USE_PSA_CRYPTO, Msan + constant flow)"
1928 make test
1934 # - unset MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN - does the failure persist?
1935 # - or alternatively, change the build type to MemSanDbg, which enables
1942 CC=clang cmake -D CMAKE_BUILD_TYPE:String=MemSan .
1945 msg "test: main suites (Msan + constant flow)"
1946 make test
1951 # (heap buffer overflows, use of uninitialized memory, use-after-free,
1955 # - unset MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND - does the failure persist?
1956 # - or alternatively, build with debug info and manually run the offending
1957 # test suite with valgrind --track-origins=yes, then check if the origin
1964 cmake -D CMAKE_BUILD_TYPE:String=Release .
1967 # this only shows a summary of the results (how many of each type)
1969 msg "test: some suites (full minus MBEDTLS_USE_PSA_CRYPTO, valgrind + constant flow)"
1972 # Test asm path in constant time module - by default, it will test the plain C
1973 # path under Valgrind or Memsan. Running only the constant_time tests is fast (<1s)
1974 msg "test: valgrind asm constant_time"
1975 scripts/config.py --force set MBEDTLS_TEST_CONSTANT_FLOW_ASM
1977 cmake -D CMAKE_BUILD_TYPE:String=Release .
1985 # (heap buffer overflows, use of uninitialized memory, use-after-free,
1989 # - unset MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND - does the failure persist?
1990 # - or alternatively, build with debug info and manually run the offending
1991 # test suite with valgrind --track-origins=yes, then check if the origin
1997 cmake -D CMAKE_BUILD_TYPE:String=Release .
2000 # this only shows a summary of the results (how many of each type)
2002 msg "test: some suites (valgrind + constant flow)"
2007 # Test that removing the deprecated features from the default
2011 make CC=gcc CFLAGS='-O -Werror -Wall -Wextra'
2013 msg "test: make, default + MBEDTLS_DEPRECATED_REMOVED" # ~ 5s
2014 make test
2020 make CC=gcc CFLAGS='-O -Werror -Wall -Wextra'
2022 msg "test: make, full_no_deprecated config" # ~ 5s
2023 make test
2025 msg "test: ensure that X509 has no direct dependency on BIGNUM_C"
2030 # Test that there is nothing deprecated in "full_no_deprecated".
2037 make CC=gcc CFLAGS='-O -Werror -Wall -Wextra'
2039 msg "test: make, full_no_deprecated config, MBEDTLS_DEPRECATED_WARNING" # ~ 5s
2040 make test
2044 # Test that when MBEDTLS_DEPRECATED_WARNING is enabled, the build passes
2045 # with only certain whitelisted types of warnings.
2050 make CC=gcc CFLAGS='-O -Werror -Wall -Wextra -Wno-error=cpp' lib programs
2056 # from the use of deprecated functions in test suites.
2057 …make CC=gcc CFLAGS='-O -Werror -Wall -Wextra -Wno-error=deprecated-declarations -Wno-error=cpp -DM…
2059 msg "test: full config + MBEDTLS_TEST_DEPRECATED" # ~ 30s
2060 make test
2066 ! nm "$@" 2>/dev/null | grep -v ':$' | grep .
2070 msg "build: make, crypto only"
2072 make CFLAGS='-O1 -Werror'
2077 msg "build: make, crypto only, full config"
2079 make CFLAGS='-O1 -Werror'
2110 make CFLAGS='-O1 -Werror' all test
2115 msg "build: make, crypto only, baremetal config"
2117 make CFLAGS="-O1 -Werror -I$PWD/tests/include/baremetal-override/"
2127 make CFLAGS="-O1 -Werror -I$PWD/tests/include/baremetal-override/"
2131 # which makes the no-time.h-in-baremetal check fail. Ubuntu 16.04 has this
2133 ! grep -q -F time.h /usr/include/x86_64-linux-gnu/sys/types.h
2138 msg "test/build: depends.py cipher_id (gcc)"
2139 tests/scripts/depends.py cipher_id --unset-use-psa
2143 msg "test/build: depends.py cipher_chaining (gcc)"
2144 tests/scripts/depends.py cipher_chaining --unset-use-psa
2148 msg "test/build: depends.py cipher_padding (gcc)"
2149 tests/scripts/depends.py cipher_padding --unset-use-psa
2153 msg "test/build: depends.py curves (gcc)"
2154 tests/scripts/depends.py curves --unset-use-psa
2158 msg "test/build: depends.py hashes (gcc)"
2159 tests/scripts/depends.py hashes --unset-use-psa
2163 msg "test/build: depends.py kex (gcc)"
2164 tests/scripts/depends.py kex --unset-use-psa
2168 msg "test/build: depends.py pkalgs (gcc)"
2169 tests/scripts/depends.py pkalgs --unset-use-psa
2174 msg "test/build: depends.py cipher_id (gcc) with MBEDTLS_USE_PSA_CRYPTO defined"
2179 msg "test/build: depends.py cipher_chaining (gcc) with MBEDTLS_USE_PSA_CRYPTO defined"
2184 msg "test/build: depends.py cipher_padding (gcc) with MBEDTLS_USE_PSA_CRYPTO defined"
2189 msg "test/build: depends.py curves (gcc) with MBEDTLS_USE_PSA_CRYPTO defined"
2194 msg "test/build: depends.py hashes (gcc) with MBEDTLS_USE_PSA_CRYPTO defined"
2199 msg "test/build: depends.py kex (gcc) with MBEDTLS_USE_PSA_CRYPTO defined"
2204 msg "test/build: depends.py pkalgs (gcc) with MBEDTLS_USE_PSA_CRYPTO defined"
2216 # Only compile - this is primarily to test for compile issues
2217 make CC=gcc CFLAGS='-Werror -Wall -Wextra -I../tests/include/alt-dummy'
2231 # You can only have one threading implementation: alt or pthread, not both.
2245 scripts/config.py set-all 'MBEDTLS_([A-Z0-9]*|NIST_KW)_ALT'
2248 # We can only compile, not link, since we don't have any implementations
2250 make CC=gcc CFLAGS='-Werror -Wall -Wextra -I../tests/include/alt-dummy' lib
2259 # We can only compile, not link, since we don't have any implementations
2261 make CC=gcc CFLAGS='-Werror -Wall -Wextra -I../tests/include/alt-dummy' lib
2265 # full minus MBEDTLS_USE_PSA_CRYPTO: run the same set of tests as basic-build-test.sh
2276 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
2279 msg "test: main suites (full minus MBEDTLS_USE_PSA_CRYPTO)"
2280 make test
2282 # Note: ssl-opt.sh has some test cases that depend on
2284 # This is the only component where those tests are not skipped.
2285 msg "test: ssl-opt.sh (full minus MBEDTLS_USE_PSA_CRYPTO)"
2286 tests/ssl-opt.sh
2288 msg "test: compat.sh default (full minus MBEDTLS_USE_PSA_CRYPTO)"
2291 msg "test: compat.sh NULL (full minus MBEDTLS_USE_PSA_CRYPTO)"
2292 …LEGACY" GNUTLS_CLI="$GNUTLS_LEGACY_CLI" GNUTLS_SERV="$GNUTLS_LEGACY_SERV" tests/compat.sh -f 'NULL'
2294 msg "test: compat.sh ARIA + ChachaPoly (full minus MBEDTLS_USE_PSA_CRYPTO)"
2295 env OPENSSL="$OPENSSL_NEXT" tests/compat.sh -e '^$' -f 'ARIA\|CHACHA'
2306 # so we only want to include them in the accel list when building the main
2311 # ---------
2325 # -----
2335 # Make sure this was not re-enabled by accident (additive config)
2339 # -------------
2341 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDSA"
2342 make test
2353 # so we only want to include them in the accel list when building the main
2358 # ---------
2374 # -----
2380 # Make sure this was not re-enabled by accident (additive config)
2384 # -------------
2386 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDH"
2387 make test
2398 # ---------
2411 # -----
2417 # Make sure this was not re-enabled by accident (additive config)
2421 # -------------
2423 msg "test: full with accelerated FFDH"
2424 make test
2426 msg "ssl-opt: full with accelerated FFDH alg"
2427 tests/ssl-opt.sh -f "ffdh"
2431 msg "build: full with non-accelerated FFDH"
2441 msg "test suites: full with non-accelerated FFDH alg"
2442 make test
2444 msg "ssl-opt: full with non-accelerated FFDH alg"
2445 tests/ssl-opt.sh -f "ffdh"
2455 # so we only want to include them in the accel list when building the main
2460 # ---------
2464 # Make built-in fallback not available
2469 # -----
2475 # Make sure this was not re-enabled by accident (additive config)
2479 # -------------
2481 msg "test: full with accelerated PAKE"
2482 make test
2499 # so we only want to include them in the accel list when building the main
2504 # ---------
2509 # Disable modules that are accelerated - some will be re-enabled
2515 # Disable all curves - those that aren't accelerated should be re-enabled
2524 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
2527 # -----
2536 # ECP should be re-enabled but not the others
2543 # -------------
2545 msg "test suites: full with accelerated EC algs and some key types"
2546 make test
2549 # Run tests with only (non-)Weierstrass accelerated
2551 # - component_test_psa_crypto_config_accel_ecc_weierstrass_curves
2552 # - component_test_psa_crypto_config_accel_ecc_non_weierstrass_curves
2555 if [ $weierstrass -eq 1 ]; then
2558 desc="non-Weierstrass"
2570 # so we only want to include them in the accel list when building the main
2573 # helper_get_psa_curve_list that only keeps Weierstrass families.
2576 for item in $(sed -n 's/^#define PSA_WANT_\(ECC_[0-9A-Z_a-z]*\).*/\1/p' <"$CRYPTO_CONFIG_H"); do
2586 if [ $weierstrass -eq 1 ]; then
2593 # ---------
2596 # that's what's supported now, see docs/driver-only-builds.md.
2601 # We need to disable RSA too or PK will be re-enabled.
2602 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_RSA_[0-9A-Z_a-z]*"
2603 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_ALG_RSA_[0-9A-Z_a-z]*"
2608 # Disable modules that are accelerated - some will be re-enabled
2614 # Disable all curves - those that aren't accelerated should be re-enabled
2623 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
2626 # -----
2635 # We expect ECDH to be re-enabled for the missing curves
2637 # We expect ECP to be re-enabled, however the parts specific to the
2639 # - functions with mxz in the name are specific to Montgomery curves
2640 # - ecp_muladd is specific to Weierstrass curves
2642 if [ $weierstrass -eq 1 ]; then
2649 # We expect ECDSA and ECJPAKE to be re-enabled only when
2651 if [ $weierstrass -eq 1 ]; then
2660 # -------------
2662 msg "test suites: crypto_full minus PK with accelerated EC algs and $desc curves"
2663 make test
2674 # Auxiliary function to build config for all EC based algorithms (EC-JPAKE,
2677 # - 0 keep built-in EC algs,
2678 # - 1 exclude built-in EC algs (driver only).
2681 # same config, except for the use of driver or built-in EC algorithms:
2682 # - component_test_psa_crypto_config_accel_ecc_ecp_light_only;
2683 # - component_test_psa_crypto_config_reference_ecc_ecp_light_only.
2684 # This supports comparing their test coverage with analyze_outcomes.py.
2689 if [ "$driver_only" -eq 1 ]; then
2714 # so we only want to include them in the accel list when building the main
2719 # ---------
2721 # Use the same config as reference, only without built-in EC algs
2725 # - MBEDTLS_PK_PARSE_EC_EXTENDED
2726 # - MBEDTLS_PK_PARSE_EC_COMPRESSED
2729 # -----
2738 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
2745 # -------------
2747 msg "test suites: full with accelerated EC algs"
2748 make test
2750 msg "ssl-opt: full with accelerated EC algs"
2751 tests/ssl-opt.sh
2756 msg "build: MBEDTLS_PSA_CRYPTO_CONFIG with non-accelerated EC algs"
2762 msg "test suites: full with non-accelerated EC algs"
2763 make test
2765 msg "ssl-opt: full with non-accelerated EC algs"
2766 tests/ssl-opt.sh
2770 # - component_test_psa_crypto_config_accel_ecc_no_ecp_at_all()
2771 # - component_test_psa_crypto_config_reference_ecc_no_ecp_at_all()
2776 # - 1: building with accelerated EC algorithms (ECDSA, ECDH, ECJPAKE), therefore
2777 # excluding their built-in implementation as well as ECP_C & ECP_LIGHT
2778 # - 0: include built-in implementation of EC algorithms.
2787 if [ "$driver_only" -eq 1 ]; then
2796 # Disable all the features that auto-enable ECP_LIGHT (see build_info.h)
2799 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
2807 # Build and test a configuration where driver accelerates all EC algs while
2813 msg "build: full + accelerated EC algs - ECP"
2822 # so we only want to include them in the accel list when building the main
2827 # ---------
2835 # -----
2838 # SHA-1 and all SHA-2/3 variants, as they are used by ECDSA deterministic.
2846 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
2850 # Also ensure that ECP module was not re-enabled
2854 # -------------
2856 msg "test: full + accelerated EC algs - ECP"
2857 make test
2859 msg "ssl-opt: full + accelerated EC algs - ECP"
2860 tests/ssl-opt.sh
2873 msg "test: full + non accelerated EC algs"
2874 make test
2876 msg "ssl-opt: full + non accelerated EC algs"
2877 tests/ssl-opt.sh
2881 # - common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
2882 # - common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
2884 # - component_test_psa_crypto_config_accel_ecc_no_bignum
2885 # - accelerate all EC algs, disable RSA and FFDH
2886 # - component_test_psa_crypto_config_reference_ecc_no_bignum
2887 # - this is the reference component of the above
2888 # - it still disables RSA and FFDH, but it uses builtin EC algs
2889 # - component_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
2890 # - accelerate all EC and FFDH algs, disable only RSA
2891 # - component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
2892 # - this is the reference component of the above
2893 # - it still disables RSA, but it uses builtin EC and FFDH algs
2906 if [ "$driver_only" -eq 1 ]; then
2917 # Disable all the features that auto-enable ECP_LIGHT (see build_info.h)
2920 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
2922 # RSA support is intentionally disabled on this test because RSA_C depends
2924 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_RSA_[0-9A-Z_a-z]*"
2925 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_ALG_RSA_[0-9A-Z_a-z]*"
2938 # When testing ECC only, we disable FFDH support, both from builtin and
2940 scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_FFDH
2941 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_DH_[0-9A-Z_a-z]*"
2947 # exchanges only in the accelerated build
2948 if [ "$driver_only" -eq 1 ]; then
2962 # - component_test_psa_crypto_config_accel_ecc_no_bignum
2963 # - component_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
2965 # The goal is to build and test accelerating either:
2966 # - ECC only or
2967 # - both ECC and FFDH
2978 removed_text="ECP - DH"
2984 msg "build: full + accelerated $accel_text algs + USE_PSA - $removed_text - BIGNUM"
2999 # so we only want to include them in the accel list when building the main
3004 # ---------
3012 # -----
3015 # SHA-1 and all SHA-2/3 variants, as they are used by ECDSA deterministic.
3023 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
3027 # Also ensure that ECP, RSA, [DHM] or BIGNUM modules were not re-enabled
3034 # -------------
3036 msg "test suites: full + accelerated $accel_text algs + USE_PSA - $removed_text - DHM - BIGNUM"
3038 make test
3040 msg "ssl-opt: full + accelerated $accel_text algs + USE_PSA - $removed_text - BIGNUM"
3041 tests/ssl-opt.sh
3045 # - component_test_psa_crypto_config_reference_ecc_no_bignum
3046 # - component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
3048 # The goal is to build and test a reference scenario (i.e. with builtin
3071 msg "test suites: full + non accelerated EC algs + USE_PSA"
3072 make test
3074 msg "ssl-opt: full + non accelerated $accel_text algs + USE_PSA"
3075 tests/ssl-opt.sh
3095 # - component_test_tfm_config_p256m_driver_accel_ec()
3096 # - component_test_tfm_config()
3098 # Enable TF-M config
3102 # Adjust for the fact that we're building outside the TF-M environment.
3104 # TF-M has separation, our build doesn't
3107 # TF-M provdes its own (dummy) implemenation, from their tree
3116 # - USE_PSA_CRYPTO for PK_HAVE_ECC_KEYS
3120 # - ASN1_[PARSE/WRITE]_C found by check_config.h for pkparse/pkwrite
3123 # - MD_C for HKDF_C
3126 # Config adjustments for better test coverage in our environment.
3135 # when using only drivers / by p256-m
3137 # Disable all the features that auto-enable ECP_LIGHT (see build_info.h)
3138 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
3139 # Disable deterministic ECDSA as p256-m only does randomized
3140 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
3147 msg "build: TF-M config + p256m driver + accel ECDH(E)/ECDSA"
3152 …make CFLAGS="$ASAN_CFLAGS -DMBEDTLS_PSA_P256M_DRIVER_ENABLED -I../tests/include/spe" LDFLAGS="$ASA…
3154 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
3158 # Also ensure that ECP, RSA, DHM or BIGNUM modules were not re-enabled
3165 msg "test: TF-M config + p256m driver + accel ECDH(E)/ECDSA"
3166 make test
3175 msg "build: TF-M config"
3176 make CFLAGS='-Werror -Wall -Wextra -I../tests/include/spe' tests
3178 msg "test: TF-M config"
3179 make test
3184 # - starts from the "full" configuration minus the list of symbols passed in
3186 # - build
3187 # - test only TLS (i.e. test_suite_tls and ssl-opt)
3191 msg "build: full minus something, test TLS"
3201 msg "test: full minus something, test TLS"
3204 msg "ssl-opt: full minus something, test TLS"
3205 tests/ssl-opt.sh
3218 # - component_test_psa_ecc_key_pair_no_derive
3219 # - component_test_psa_ecc_key_pair_no_generate
3220 # The goal is to test with all PSA_WANT_KEY_TYPE_xxx_KEY_PAIR_yyy symbols
3222 # - $1 is the key type under test, i.e. ECC/RSA/DH
3223 # - $2 is the key option to be unset (i.e. generate, derive, etc)
3229 msg "build: full - MBEDTLS_USE_PSA_CRYPTO - ${disabled_psa_want}"
3236 scripts/config.py -f "$CRYPTO_CONFIG_H" unset "$disabled_psa_want"
3240 msg "test: full - MBEDTLS_USE_PSA_CRYPTO - ${disabled_psa_want}"
3241 make test
3253 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated RSA signature"
3258 # ---------
3263 # It seems it is not possible to remove only the support for RSA signature
3268 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_OAEP
3269 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PKCS1V15_CRYPT
3282 # Make sure both the library and the test library support the SHA hash
3283 # algorithms and only those ones (SHA256 is included by default). That way:
3284 # - the test library can compute the RSA signatures even in the case of a
3287 # - the dependency of RSA signature tests on PSA_WANT_ALG_SHA_xyz is
3290 # - when testing a signature key with an algorithm wildcard built from
3291 # PSA_ALG_ANY_HASH as algorithm to test with the key, the chosen hash
3293 # supported by the test library.
3295 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_MD5
3296 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RIPEMD160_C
3300 # We need PEM parsing in the test library as well to support the import
3302 scripts/config.py -f "$CONFIG_TEST_DRIVER_H" set MBEDTLS_PEM_PARSE_C
3303 scripts/config.py -f "$CONFIG_TEST_DRIVER_H" set MBEDTLS_BASE64_C
3306 # -----
3308 # These hashes are needed for some RSA-PSS signature tests.
3315 # Make sure this was not re-enabled by accident (additive config)
3320 # -------------
3322 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated RSA signature"
3323 make test
3326 # This is a temporary test to verify that full RSA support is present even when
3327 # only one single new symbols (PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) is defined.
3329 msg "Build: crypto config - MBEDTLS_RSA_C + PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC"
3357 # Keep only PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC enabled in order to ensure
3359 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
3360 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT
3361 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
3365 msg "Test: crypto config - MBEDTLS_RSA_C + PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC"
3366 make test
3368 # Parse only 1 relevant line from the outcome file, i.e. a test which is
3371 … cat $MBEDTLS_TEST_OUTCOME_FILE | grep 'RSA PKCS1 Sign #1 (SHA512, 1536 bits RSA)' | grep -q "PASS"
3379 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated hash"
3386 # ---------
3402 # -----
3408 # There's a risk of something getting re-enabled via config_psa.h;
3417 # -------------
3419 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated hash"
3420 make test
3424 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated+builtin hash"
3425 # This component ensures that all the test cases for
3439 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated+builtin hash"
3440 make test
3448 if [ "$driver_only" -eq 1 ]; then
3449 # disable the built-in implementation of hashes
3467 msg "test: full with accelerated hashes"
3474 # ---------
3479 # -----
3485 # There's a risk of something getting re-enabled via config_psa.h;
3494 # -------------
3496 msg "test: full with accelerated hashes"
3497 make test
3501 # dependency declarations in ssl-opt.sh and in TLS code are correct.
3502 msg "test: ssl-opt.sh, full with accelerated hashes"
3503 tests/ssl-opt.sh
3506 # interop testing (besides, we already got some from ssl-opt.sh).
3507 msg "test: compat.sh, full with accelerated hashes"
3508 tests/compat.sh -p mbedTLS -V YES
3513 # script to find regression in test coverage when accelerated hash is used (tests and ssl-opt).
3516 msg "test: full without accelerated hashes"
3522 msg "test: full without accelerated hashes"
3523 make test
3525 msg "test: ssl-opt.sh, full without accelerated hashes"
3526 tests/ssl-opt.sh
3530 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated cipher"
3535 # ---------
3542 # operations. As we want to test here with cipher operations solely
3546 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CMAC
3558 # -----
3564 # Make sure this was not re-enabled by accident (additive config)
3568 # -------------
3570 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated cipher"
3571 make test
3575 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated AEAD"
3580 # ---------
3594 # -----
3600 # Make sure this was not re-enabled by accident (additive config)
3606 # -------------
3608 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated AEAD"
3609 make test
3616 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CHACHA20_POLY1305
3617 make CC=gcc CFLAGS="$ASAN_CFLAGS -O2" LDFLAGS="$ASAN_CFLAGS"
3619 msg "test: full minus CHACHAPOLY"
3620 make test
3628 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CHACHA20_POLY1305
3629 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_GCM
3630 make CC=gcc CFLAGS="$ASAN_CFLAGS -O2" LDFLAGS="$ASAN_CFLAGS"
3632 msg "test: full minus CHACHAPOLY and GCM"
3633 make test
3640 cp configs/crypto-config-ccm-aes-sha256.h "$CRYPTO_CONFIG_H"
3644 msg "test: CCM + AES + SHA256 configuration"
3645 make test
3648 # This should be renamed to test and updated once the accelerator ECDH code is in place and ready t…
3650 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_ECDH without MBEDTLS_ECDH_C"
3660 …eed to define the correct symbol and include the test driver header path in order to build with th…
3661 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_ECDH -I../tests/…
3664 # This should be renamed to test and updated once the accelerator HMAC code is in place and ready t…
3666 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_HMAC"
3670 …eed to define the correct symbol and include the test driver header path in order to build with th…
3671 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_HMAC -I../tests/…
3674 # This should be renamed to test and updated once the accelerator HKDF code is in place and ready t…
3676 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_HKDF without MBEDTLS_HKDF_C"
3683 …eed to define the correct symbol and include the test driver header path in order to build with th…
3684 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_HKDF -I../tests/…
3687 # This should be renamed to test and updated once the accelerator MD5 code is in place and ready to…
3689 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_MD5 - other hashes"
3693 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RIPEMD160
3694 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_1
3695 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_224
3696 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_256
3697 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_384
3698 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_512
3699 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
3702 …eed to define the correct symbol and include the test driver header path in order to build with th…
3703 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_MD5 -I../tests/i…
3706 # This should be renamed to test and updated once the accelerator RIPEMD160 code is in place and re…
3708 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_RIPEMD160 - other hashes"
3712 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_MD5
3713 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_1
3714 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_224
3715 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_256
3716 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_384
3717 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_512
3718 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
3721 …eed to define the correct symbol and include the test driver header path in order to build with th…
3722 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_RIPEMD160 -I../t…
3725 # This should be renamed to test and updated once the accelerator SHA1 code is in place and ready t…
3727 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_SHA_1 - other hashes"
3731 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_MD5
3732 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RIPEMD160
3733 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_224
3734 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_256
3735 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_384
3736 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_512
3737 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
3740 …eed to define the correct symbol and include the test driver header path in order to build with th…
3741 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_SHA_1 -I../tests…
3744 # This should be renamed to test and updated once the accelerator SHA224 code is in place and ready…
3746 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_SHA_224 - other hashes"
3750 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_MD5
3751 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RIPEMD160
3752 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_1
3753 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_384
3754 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_512
3755 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
3756 …eed to define the correct symbol and include the test driver header path in order to build with th…
3757 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_SHA_224 -I../tes…
3760 # This should be renamed to test and updated once the accelerator SHA256 code is in place and ready…
3762 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_SHA_256 - other hashes"
3766 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_MD5
3767 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RIPEMD160
3768 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_1
3769 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_224
3770 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_384
3771 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_512
3772 …eed to define the correct symbol and include the test driver header path in order to build with th…
3773 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_SHA_256 -I../tes…
3776 # This should be renamed to test and updated once the accelerator SHA384 code is in place and ready…
3778 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_SHA_384 - other hashes"
3782 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_MD5
3783 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RIPEMD160
3784 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_1
3785 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_224
3786 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_256
3787 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
3790 …eed to define the correct symbol and include the test driver header path in order to build with th…
3791 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_SHA_384 -I../tes…
3794 # This should be renamed to test and updated once the accelerator SHA512 code is in place and ready…
3796 msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_SHA_512 - other hashes"
3800 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_MD5
3801 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RIPEMD160
3802 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_1
3803 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_224
3804 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_256
3805 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_SHA_384
3806 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
3809 …eed to define the correct symbol and include the test driver header path in order to build with th…
3810 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_SHA_512 -I../tes…
3813 # This should be renamed to test and updated once the accelerator RSA code is in place and ready to…
3815 …msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_RSA_PKCS1V15_CRYPT + PSA_WANT_KEY_TYPE_RS…
3819 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1
3820 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PKCS1V15_SIGN
3821 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_OAEP
3822 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PSS
3823 …eed to define the correct symbol and include the test driver header path in order to build with th…
3824 …ake CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYP…
3827 # This should be renamed to test and updated once the accelerator RSA code is in place and ready to…
3829 …msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_RSA_PKCS1V15_SIGN + PSA_WANT_KEY_TYPE_RSA…
3833 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1
3834 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PKCS1V15_CRYPT
3835 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_OAEP
3836 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PSS
3837 …eed to define the correct symbol and include the test driver header path in order to build with th…
3838 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIG…
3841 # This should be renamed to test and updated once the accelerator RSA code is in place and ready to…
3843 …msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_RSA_OAEP + PSA_WANT_KEY_TYPE_RSA_PUBLIC_K…
3847 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_ALG_RSA_OAEP 1
3848 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PKCS1V15_CRYPT
3849 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PKCS1V15_SIGN
3850 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PSS
3851 …eed to define the correct symbol and include the test driver header path in order to build with th…
3852 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_RSA_OAEP -I../te…
3855 # This should be renamed to test and updated once the accelerator RSA code is in place and ready to…
3857 …msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_RSA_PSS + PSA_WANT_KEY_TYPE_RSA_PUBLIC_KE…
3861 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_ALG_RSA_PSS 1
3862 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PKCS1V15_CRYPT
3863 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_PKCS1V15_SIGN
3864 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_RSA_OAEP
3865 …eed to define the correct symbol and include the test driver header path in order to build with th…
3866 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_ALG_RSA_PSS -I../tes…
3869 # This should be renamed to test and updated once the accelerator RSA code is in place and ready to…
3871 …msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_xxx + PSA_WANT_ALG_RSA_…
3875 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_ALG_RSA_PSS 1
3876 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1
3877 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1
3878 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1
3879 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1
3880 …eed to define the correct symbol and include the test driver header path in order to build with th…
3881 …make CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAI…
3884 # This should be renamed to test and updated once the accelerator RSA code is in place and ready to…
3886 …msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY + PSA_WANT_ALG_RSA_PS…
3890 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_ALG_RSA_PSS 1
3891 scripts/config.py -f "$CRYPTO_CONFIG_H" set PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1
3892 …eed to define the correct symbol and include the test driver header path in order to build with th…
3893 …ake CC=gcc CFLAGS="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_K…
3903 # test the TF-M configuration can build cleanly with various warning flags enabled
3907 msg "build: TF-M config, armclang armv7-m thumb2"
3909 …--target=arm-arm-none-eabi -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strin…
3913 # test the TF-M configuration can build cleanly with various warning flags enabled
3917 msg "build: TF-M config, clang, armv7-m thumb2"
3918 …--target=arm-linux-gnueabihf -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-str…
3920 msg "build: TF-M config, gcc native build"
3922 …-Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wshadow -Wvla -Wformat=2 -Wno-…
3927 # Test that all the combinations build cleanly. The most common issue is
3928 # unused variables/functions, so ensure -Wunused is set.
3955 rm -f library/aes.o
3956 …-C library aes.o CC="clang" CFLAGS="-O0 -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-a…
3989 # to re-enable platform integration features otherwise disabled in C99 builds
3990 make CC=gcc CFLAGS='-Werror -Wall -Wextra -std=c99 -pedantic -Os -D_DEFAULT_SOURCE' lib programs
3991 make CC=gcc CFLAGS='-Werror -Wall -Wextra -Os' test
4001 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Check .
4009 make CC=gcc CFLAGS='-Werror -Wall -Wextra -O1'
4016 make CC=gcc CFLAGS='-Werror -Wall -Wextra -O1'
4022 msg "build: full config except net_sockets.c, make, gcc -std=c99 -pedantic" # ~ 30s
4026 make CC=gcc CFLAGS='-Werror -Wall -Wextra -O1 -std=c99 -pedantic' lib
4035 CC=gcc cmake -DCMAKE_BUILD_TYPE:String=Release .
4038 msg "test: MBEDTLS_MEMORY_BUFFER_ALLOC_C and MBEDTLS_MEMORY_BACKTRACE"
4039 make test
4046 CC=gcc cmake -DCMAKE_BUILD_TYPE:String=Release .
4049 msg "test: MBEDTLS_MEMORY_BUFFER_ALLOC_C"
4050 make test
4052 msg "test: ssl-opt.sh, MBEDTLS_MEMORY_BUFFER_ALLOC_C"
4054 tests/ssl-opt.sh -e '^DTLS proxy'
4061 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4064 msg "test: ssl-opt.sh, MFL-related tests"
4065 tests/ssl-opt.sh -f "Max fragment length"
4071 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4074 msg "test: !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE"
4075 make test
4077 msg "test: ssl-opt.sh, !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE"
4078 tests/ssl-opt.sh
4080 msg "test: compat.sh, !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE"
4083 msg "test: context-info.sh, !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE"
4084 tests/context-info.sh
4092 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4095 msg "test: MFL tests (disabled MFL extension case) & large packet tests"
4096 tests/ssl-opt.sh -f "Max fragment length\|Large buffer"
4098 msg "test: context-info.sh (disabled MFL extension case)"
4099 tests/context-info.sh
4105 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4108 msg "test: MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH enabled"
4109 make test
4111 msg "test: ssl-opt.sh, MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH enabled"
4112 tests/ssl-opt.sh
4114 msg "test: compat.sh, MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH enabled"
4122 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4125 msg "test: MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy)"
4126 make test
4128 msg "test: ssl-opt.sh, MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy) enabled"
4129 tests/ssl-opt.sh
4131 msg "test: compat.sh, MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy) enabled"
4142 CC=gcc cmake -DCMAKE_BUILD_TYPE:String=Release .
4145 …msg "test: MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH, MBEDTLS_MEMORY_BUFFER_ALLOC_C, MBEDTLS_MEMORY_DEBUG…
4146 make test
4148 …msg "test: MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH, MBEDTLS_MEMORY_BUFFER_ALLOC_C, MBEDTLS_MEMORY_DEBUG…
4149 tests/ssl-opt.sh -f "Handshake memory usage"
4159 msg "test: !MBEDTLS_SSL_SOME_MODES_USE_MAC"
4160 make test
4162 msg "test ssl-opt.sh: !MBEDTLS_SSL_SOME_MODES_USE_MAC"
4163 tests/ssl-opt.sh -f 'Default\|EtM' -e 'without EtM'
4169 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Check .
4172 msg "test: !MBEDTLS_HAVE_TIME_DATE - main suites"
4173 make test
4181 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4184 msg "test: MBEDTLS_PLATFORM_{CALLOC/FREE}_MACRO enabled (ASan build)"
4185 make test
4191 …make CC=gcc CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"$PWD/tests/configs/user-config-malloc-0-null.h\"…
4193 msg "test: malloc(0) returns NULL (ASan+UBSan build)"
4194 make test
4197 # Just the calloc selftest. "make test" ran the others as part of the
4198 # test suites.
4199 programs/test/selftest calloc
4201 msg "test ssl-opt.sh: malloc(0) returns NULL (ASan+UBSan build)"
4207 tests/ssl-opt.sh -e 'proxy'
4215 # with the name of the corresponding test, component_test_aesni.
4217 # In principle 32-bit x86 can support AESNI, but our implementation does not
4218 # support 32-bit x86, so we check for x86-64.
4219 # We can only grep /proc/cpuinfo on Linux, so this also checks for Linux
4220 (gcc -v 2>&1 | grep Target | grep -q x86_64) &&
4221 [[ "$HOSTTYPE" == "x86_64" && "$OSTYPE" == "linux-gnu" ]] &&
4222 (lscpu | grep -qw aes)
4229 # This test does not require the host to have support for AESNI (if it doesn't, the run-time
4238 # test the intrinsics implementation
4239 msg "AES tests, test intrinsics"
4241 make CC=gcc CFLAGS='-Werror -Wall -Wextra -mpclmul -msse2 -maes'
4242 # check that we built intrinsics - this should be used by default when supported by the compiler
4243 ./programs/test/selftest aes | grep "AESNI code" | grep -q "intrinsics"
4245 # test the asm implementation
4246 msg "AES tests, test assembly"
4248 make CC=gcc CFLAGS='-Werror -Wall -Wextra -mno-pclmul -mno-sse2 -mno-aes'
4249 … # check that we built assembly - this should be built if the compiler does not support intrinsics
4250 ./programs/test/selftest aes | grep "AESNI code" | grep -q "assembly"
4252 # test the plain C implementation
4257 make CC=gcc CFLAGS='-O2 -Werror'
4259 ./programs/test/selftest aes | not grep -q "AESNI code"
4260 not grep -q "AES note: using AESNI" ./programs/test/selftest
4261 grep -q "AES note: built-in implementation." ./programs/test/selftest
4263 # test the intrinsics implementation
4266 msg "AES tests, test AESNI only"
4268 make CC=gcc CFLAGS='-Werror -Wall -Wextra -mpclmul -msse2 -maes'
4269 ./programs/test/selftest aes | grep -q "AES note: using AESNI"
4270 ./programs/test/selftest aes | not grep -q "AES note: built-in implementation."
4271 grep -q "AES note: using AESNI" ./programs/test/selftest
4272 not grep -q "AES note: built-in implementation." ./programs/test/selftest
4278 support_test_m32_o0 && (lscpu | grep -qw aes)
4292 # test the intrinsics implementation
4293 msg "AES tests, test intrinsics"
4295 make CC=gcc CFLAGS='-m32 -Werror -Wall -Wextra -mpclmul -msse2 -maes' LDFLAGS='-m32'
4296 # check that we built intrinsics - this should be used by default when supported by the compiler
4297 ./programs/test/selftest aes | grep "AESNI code" | grep -q "intrinsics"
4298 grep -q "AES note: using AESNI" ./programs/test/selftest
4299 grep -q "AES note: built-in implementation." ./programs/test/selftest
4300 grep -q "AES note: using VIA Padlock" ./programs/test/selftest
4301 grep -q mbedtls_aesni_has_support ./programs/test/selftest
4306 msg "AES tests, test AESNI only"
4308 make CC=gcc CFLAGS='-m32 -Werror -Wall -Wextra -mpclmul -msse2 -maes' LDFLAGS='-m32'
4309 ./programs/test/selftest aes | grep -q "AES note: using AESNI"
4310 ./programs/test/selftest aes | not grep -q "AES note: built-in implementation."
4311 grep -q "AES note: using AESNI" ./programs/test/selftest
4312 not grep -q "AES note: built-in implementation." ./programs/test/selftest
4313 not grep -q "AES note: using VIA Padlock" ./programs/test/selftest
4314 not grep -q mbedtls_aesni_has_support ./programs/test/selftest
4319 msg "Build: AESCE test on arm64 platform without plain C."
4322 # armc[56] don't support SHA-512 intrinsics
4329 # this feature would prevent us from building with -Werror on
4337 armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8-a+crypto"
4339 msg "AESCE, build AESCE only"
4342 armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8-a+crypto"
4352 make CC=gcc CFLAGS="$ASAN_CFLAGS -m32 -O2" LDFLAGS="-m32 $ASAN_CFLAGS"
4353 grep -q mbedtls_padlock_has_support ./programs/test/selftest
4358 ( [ "$MBEDTLS_TEST_PLATFORM" == "Linux-x86_64" ] || \
4359 [ "$MBEDTLS_TEST_PLATFORM" == "Linux-amd64" ] ) && \
4360 [ "`dpkg --print-foreign-architectures`" == "i386" ]
4372 make CC=gcc CFLAGS='-Werror -Wall -Wextra'
4374 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH"
4375 make test
4379 msg "build: default config + AES_ONLY_128_BIT_KEY_LENGTH - CTR_DRBG_C"
4384 make CC=clang CFLAGS='-Werror -Wall -Wextra'
4386 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH - CTR_DRBG_C"
4387 make test
4391 msg "build: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
4397 make CC=gcc CFLAGS='-Werror -Wall -Wextra'
4399 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
4400 make test
4402 msg "selftest: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
4403 programs/test/selftest
4409 make CC=gcc CFLAGS='-Werror -Wall -Wextra'
4411 msg "test: AES_FEWER_TABLES"
4412 make test
4418 make CC=gcc CFLAGS='-Werror -Wall -Wextra'
4420 msg "test: AES_ROM_TABLES"
4421 make test
4428 make CC=gcc CFLAGS='-Werror -Wall -Wextra'
4430 msg "test: AES_FEWER_TABLES + AES_ROM_TABLES"
4431 make test
4439 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4442 msg "test: full + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
4443 make test
4451 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4454 msg "test: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY (ASan build)"
4455 make test
4464 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4467 msg "test: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
4468 make test
4474 make CC=clang CFLAGS="$ASAN_CFLAGS -Os" LDFLAGS="$ASAN_CFLAGS"
4476 msg "test: default config + MBEDTLS_PSA_CRYPTO_SE_C"
4477 make test
4481 msg "build: full + test drivers dispatching to builtins"
4484 loc_cflags="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST_ALL"
4485 …loc_cflags="${loc_cflags} '-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'"
4486 loc_cflags="${loc_cflags} -I../tests/include -O2"
4490 msg "test: full + test drivers dispatching to builtins"
4491 make test
4495 msg "build/test: make shared" # ~ 40s
4498 programs/test/dlopen_demo.sh
4502 msg "build/test: cmake shared" # ~ 2min
4503 cmake -DUSE_SHARED_MBEDTLS_LIBRARY=On .
4506 make test
4507 programs/test/dlopen_demo.sh
4512 $cc --version
4514 msg "build/test: $cc $opt, $info" # ~ 30s
4515 make CC="$cc" CFLAGS="$opt -std=c99 -pedantic -Wall -Wextra -Werror"
4518 # optimizations use inline assembly whereas runs with -O0
4520 make test # ~30s
4530 test_build_opt 'full config' clang -O0 -Os -O2
4536 test_build_opt 'full config' "$CLANG_LATEST" -O0 -Os -O2
4544 test_build_opt 'full config' "$CLANG_EARLIEST" -O0
4552 test_build_opt 'full config' "$GCC_LATEST" -O0 -Os -O2
4560 test_build_opt 'full config' "$GCC_EARLIEST" -O0
4568 scripts/config.py -w full_config.h full
4570 make CFLAGS="-I '$PWD' -DMBEDTLS_CONFIG_FILE='\"full_config.h\"'"
4572 programs/test/query_compile_time_config MBEDTLS_NIST_KW_C
4579 …make CFLAGS="-I '$PWD' -DMBEDTLS_CONFIG_FILE='\"full_config.h\"' -DMBEDTLS_USER_CONFIG_FILE='\"use…
4580 not programs/test/query_compile_time_config MBEDTLS_NIST_KW_C
4582 rm -f user_config.h full_config.h
4590 make CFLAGS="-I '$PWD' -DMBEDTLS_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"'"
4592 programs/test/query_compile_time_config MBEDTLS_CMAC_C
4600 …make CFLAGS="-I '$PWD' -DMBEDTLS_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"' -DMBEDTLS_PSA_CRYP…
4601 not programs/test/query_compile_time_config MBEDTLS_CMAC_C
4603 rm -f psa_test_config.h psa_user_config.h
4611 …make -C tests include/alt-extra/psa/crypto_platform_alt.h include/alt-extra/psa/crypto_struct_alt.h
4616 …make CFLAGS="-I ../tests/include/alt-extra -DMBEDTLS_PSA_CRYPTO_PLATFORM_FILE='\"psa/crypto_platfo…
4617 …make -C programs -o fuzz CFLAGS="-I ../tests/include/alt-extra -DMBEDTLS_PSA_CRYPTO_PLATFORM_FILE=…
4621 programs/test/query_included_headers | grep -x PSA_CRYPTO_PLATFORM_ALT_H
4622 programs/test/query_included_headers | grep -x PSA_CRYPTO_STRUCT_ALT_H
4623 programs/test/query_included_headers | not grep -x PSA_CRYPTO_PLATFORM_H
4624 programs/test/query_included_headers | not grep -x PSA_CRYPTO_STRUCT_H
4628 # Build without optimization, so as to use portable C code (in a 32-bit
4629 # build) and not the i386-specific inline assembly.
4630 msg "build: i386, make, gcc -O0 (ASan build)" # ~ 30s
4633 make CC=gcc CFLAGS="$ASAN_CFLAGS -m32 -O0" LDFLAGS="-m32 $ASAN_CFLAGS"
4635 msg "test: i386, make, gcc -O0 (ASan build)"
4636 make test
4639 case $(uname -m) in
4648 msg "build: i386, make, gcc -O2 (ASan build)" # ~ 30s
4651 make CC=gcc CFLAGS="$ASAN_CFLAGS -m32 -O2" LDFLAGS="-m32 $ASAN_CFLAGS"
4653 msg "test: i386, make, gcc -O2 (ASan build)"
4654 make test
4656 msg "test ssl-opt.sh, i386, make, gcc-O2"
4657 tests/ssl-opt.sh
4667 make CC=gcc CFLAGS="$ASAN_CFLAGS -m32 -O2" LDFLAGS="-m32 $ASAN_CFLAGS"
4669 msg "test: i386, Everest ECDH context - main suites (inc. selftests) (ASan build)" # ~ 50s
4670 make test
4672 msg "test: i386, Everest ECDH context - ECDH-related part of ssl-opt.sh (ASan build)" # ~ 5s
4673 tests/ssl-opt.sh -f ECDH
4675 …msg "test: i386, Everest ECDH context - compat.sh with some ECDH ciphersuites (ASan build)" # ~ 3 …
4677 tests/compat.sh -f ECDH -V NO -e 'ARIA\|CAMELLIA\|CHACHA'
4684 msg "build: 64-bit ILP32, make, gcc" # ~ 30s
4686 make CC=gcc CFLAGS='-Werror -Wall -Wextra -mx32' LDFLAGS='-mx32'
4688 msg "test: 64-bit ILP32, make, gcc"
4689 make test
4692 case $(uname -m) in
4701 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
4704 msg "test: MBEDTLS_MPI_WINDOW_SIZE=1 - main suites (inc. selftests) (ASan build)" # ~ 10s
4705 make test
4709 msg "build: gcc, force 32-bit bignum limbs"
4714 make CC=gcc CFLAGS='-Werror -Wall -Wextra -DMBEDTLS_HAVE_INT32'
4716 msg "test: gcc, force 32-bit bignum limbs"
4717 make test
4721 msg "build: gcc, force 64-bit bignum limbs"
4726 make CC=gcc CFLAGS='-Werror -Wall -Wextra -DMBEDTLS_HAVE_INT64'
4728 msg "test: gcc, force 64-bit bignum limbs"
4729 make test
4733 msg "build: gcc, force 32-bit bignum limbs, new bignum interface, test hooks (ASan build)"
4740 …make CC=gcc CFLAGS="$ASAN_CFLAGS -Werror -Wall -Wextra -DMBEDTLS_HAVE_INT32" LDFLAGS="$ASAN_CFLAGS"
4742 msg "test: gcc, force 32-bit bignum limbs, new bignum interface, test hooks (ASan build)"
4743 make test
4750 make CFLAGS='-Werror -O1'
4752 msg "test: MBEDTLS_NO_UDBL_DIVISION native" # ~ 10s
4753 make test
4760 make CFLAGS='-Werror -O1'
4762 msg "test: MBEDTLS_NO_64BIT_MULTIPLICATION native" # ~ 10s
4763 make test
4774 make CFLAGS='-Werror -Os'
4776 msg "test: no strings" # ~ 10s
4777 make test
4785 make CFLAGS='-Werror -O2'
4787 msg "test: full + MBEDTLS_X509_REMOVE_INFO" # ~ 10s
4788 make test
4790 msg "test: ssl-opt.sh, full + MBEDTLS_X509_REMOVE_INFO" # ~ 1 min
4791 tests/ssl-opt.sh
4795 msg "build: ${ARM_NONE_EABI_GCC_PREFIX}gcc -O1, baremetal+debug" # ~ 10s
4797 …I_GCC_PREFIX}ar" LD="${ARM_NONE_EABI_GCC_PREFIX}ld" CFLAGS='-std=c99 -Werror -Wall -Wextra -O1' lib
4799 msg "size: ${ARM_NONE_EABI_GCC_PREFIX}gcc -O1, baremetal+debug"
4800 ${ARM_NONE_EABI_GCC_PREFIX}size -t library/*.o
4804 msg "build: ${ARM_LINUX_GNUEABI_GCC_PREFIX}gcc -march=arm5vte, baremetal+debug" # ~ 10s
4808 # See https://github.com/Mbed-TLS/mbedtls/pull/2169 and comments.
4810 # https://github.com/Mbed-TLS/mbedtls/pull/3449#issuecomment-675313720
4811 …c" AR="${ARM_LINUX_GNUEABI_GCC_PREFIX}ar" CFLAGS='-Werror -Wall -Wextra -march=armv5te -O1' LDFLAG…
4813 msg "size: ${ARM_LINUX_GNUEABI_GCC_PREFIX}gcc -march=armv5te -O1, baremetal+debug"
4814 ${ARM_LINUX_GNUEABI_GCC_PREFIX}size -t library/*.o
4821 msg "build: ${ARM_NONE_EABI_GCC_PREFIX}gcc -march=arm5vte, baremetal+debug" # ~ 10s
4825 # in case the gcc-arm-linux-gnueabi toolchain is not available
4826 …NONE_EABI_GCC_PREFIX}ar" CFLAGS='-std=c99 -Werror -Wall -Wextra -march=armv5te -O1' LDFLAGS='-marc…
4828 msg "size: ${ARM_NONE_EABI_GCC_PREFIX}gcc -march=armv5te -O1, baremetal+debug"
4829 ${ARM_NONE_EABI_GCC_PREFIX}size -t library/*.o
4833 msg "build: ${ARM_NONE_EABI_GCC_PREFIX}gcc -mthumb -mcpu=cortex-m0plus, baremetal_size" # ~ 10s
4835 …r" LD="${ARM_NONE_EABI_GCC_PREFIX}ld" CFLAGS='-std=c99 -Werror -Wall -Wextra -mthumb -mcpu=cortex-…
4837 msg "size: ${ARM_NONE_EABI_GCC_PREFIX}gcc -mthumb -mcpu=cortex-m0plus -Os, baremetal_size"
4838 ${ARM_NONE_EABI_GCC_PREFIX}size -t library/*.o
4841 ${ARM_NONE_EABI_GCC_PREFIX}size -t $lib | grep TOTALS
4846 msg "build: ${ARM_NONE_EABI_GCC_PREFIX}gcc -DMBEDTLS_NO_UDBL_DIVISION, make" # ~ 10s
4849 …_EABI_GCC_PREFIX}ar" LD="${ARM_NONE_EABI_GCC_PREFIX}ld" CFLAGS='-std=c99 -Werror -Wall -Wextra' lib
4850 echo "Checking that software 64-bit division is not required"
4858 …GCC_PREFIX}ar" LD="${ARM_NONE_EABI_GCC_PREFIX}ld" CFLAGS='-std=c99 -Werror -O1 -march=armv6-m -mth…
4859 echo "Checking that software 64-bit multiplication is not required"
4870 …make CC="clang" CFLAGS='-std=c99 -Werror -Os --target=arm-linux-gnueabihf -march=armv7-m -mthumb' …
4872 # Some Thumb 1 asm is sensitive to optimisation level, so test both -O0 and -Os
4873 msg "build: clang thumb 1 -O0, make"
4875 …make CC="clang" CFLAGS='-std=c99 -Werror -O0 --target=arm-linux-gnueabihf -mcpu=arm1136j-s -mthumb…
4877 msg "build: clang thumb 1 -Os, make"
4879 …make CC="clang" CFLAGS='-std=c99 -Werror -Os --target=arm-linux-gnueabihf -mcpu=arm1136j-s -mthumb…
4885 # armc[56] don't support SHA-512 intrinsics
4892 # this feature would prevent us from building with -Werror on
4898 make CC="$ARMC5_CC" AR="$ARMC5_AR" WARNING_CFLAGS='--strict --c99' lib
4901 "$ARMC5_FROMELF" -z library/*.o
4905 # Compile mostly with -O1 since some Arm inline assembly is disabled for -O0.
4907 # ARM Compiler 6 - Target ARMv7-A
4908 armc6_build_test "-O1 --target=arm-arm-none-eabi -march=armv7-a"
4910 # ARM Compiler 6 - Target ARMv7-M
4911 armc6_build_test "-O1 --target=arm-arm-none-eabi -march=armv7-m"
4913 # ARM Compiler 6 - Target ARMv7-M+DSP
4914 armc6_build_test "-O1 --target=arm-arm-none-eabi -march=armv7-m+dsp"
4916 # ARM Compiler 6 - Target ARMv8-A - AArch32
4917 armc6_build_test "-O1 --target=arm-arm-none-eabi -march=armv8.2-a"
4919 # ARM Compiler 6 - Target ARMv8-M
4920 armc6_build_test "-O1 --target=arm-arm-none-eabi -march=armv8-m.main"
4922 # ARM Compiler 6 - Target ARMv8.2-A - AArch64
4923 armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8.2-a+crypto"
4925 # ARM Compiler 6 - Target Cortex-M0 - no optimisation
4926 armc6_build_test "-O0 --target=arm-arm-none-eabi -mcpu=cortex-m0"
4928 # ARM Compiler 6 - Target Cortex-M0
4929 armc6_build_test "-Os --target=arm-arm-none-eabi -mcpu=cortex-m0"
4941 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
4943 msg "test: TLS 1.3 only, all key exchange modes enabled"
4944 make test
4946 msg "ssl-opt.sh: TLS 1.3 only, all key exchange modes enabled"
4947 tests/ssl-opt.sh
4951 msg "build: TLS 1.3 only from default, only PSK key exchange mode"
4963 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
4965 msg "test_suite_ssl: TLS 1.3 only, only PSK key exchange mode enabled"
4968 msg "ssl-opt.sh: TLS 1.3 only, only PSK key exchange mode enabled"
4969 tests/ssl-opt.sh
4973 msg "build: TLS 1.3 only from default, only ephemeral key exchange mode"
4977 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
4979 msg "test_suite_ssl: TLS 1.3 only, only ephemeral key exchange mode"
4982 msg "ssl-opt.sh: TLS 1.3 only, only ephemeral key exchange mode"
4983 tests/ssl-opt.sh
4987 msg "build: TLS 1.3 only from default, only ephemeral ffdh key exchange mode"
4993 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
4995 msg "test_suite_ssl: TLS 1.3 only, only ephemeral ffdh key exchange mode"
4998 msg "ssl-opt.sh: TLS 1.3 only, only ephemeral ffdh key exchange mode"
4999 tests/ssl-opt.sh
5003 msg "build: TLS 1.3 only from default, only PSK ephemeral key exchange mode"
5013 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
5015 msg "test_suite_ssl: TLS 1.3 only, only PSK ephemeral key exchange mode"
5018 msg "ssl-opt.sh: TLS 1.3 only, only PSK ephemeral key exchange mode"
5019 tests/ssl-opt.sh
5023 msg "build: TLS 1.3 only from default, only PSK ephemeral ffdh key exchange mode"
5034 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
5036 msg "test_suite_ssl: TLS 1.3 only, only PSK ephemeral ffdh key exchange mode"
5039 msg "ssl-opt.sh: TLS 1.3 only, only PSK ephemeral ffdh key exchange mode"
5040 tests/ssl-opt.sh
5044 msg "build: TLS 1.3 only from default, without ephemeral key exchange mode"
5053 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
5055 msg "test_suite_ssl: TLS 1.3 only, PSK and PSK ephemeral key exchange modes"
5058 msg "ssl-opt.sh: TLS 1.3 only, PSK and PSK ephemeral key exchange modes"
5059 tests/ssl-opt.sh
5063 msg "build: TLS 1.3 only from default, without PSK key exchange mode"
5066 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
5068 msg "test_suite_ssl: TLS 1.3 only, ephemeral and PSK ephemeral key exchange modes"
5071 msg "ssl-opt.sh: TLS 1.3 only, ephemeral and PSK ephemeral key exchange modes"
5072 tests/ssl-opt.sh
5081 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
5083 msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, without padding"
5084 make test
5085 msg "ssl-opt.sh (TLS 1.3)"
5086 tests/ssl-opt.sh
5095 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
5097 msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, without padding"
5098 make test
5099 msg "ssl-opt.sh (TLS 1.3 no compatibility mode)"
5100 tests/ssl-opt.sh
5104 msg "build: TLS 1.3 only from default, record size limit extension enabled"
5106 make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
5108 msg "test_suite_ssl: TLS 1.3 only, record size limit extension enabled"
5111 msg "ssl-opt.sh: (TLS 1.3 only, record size limit extension tests only)"
5113 # record size limit extension. There is no way to prevent gnutls-cli from sending the extension
5114 … # which makes all G_NEXT_CLI + P_SRV tests fail. Thus, run only the tests for the this extension.
5115 tests/ssl-opt.sh -f "Record Size Limit"
5119 msg "build: Windows cross build - mingw64, make (Link Library)" # ~ 30s
5121 …make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall …
5123 # note Make tests only builds the tests, but doesn't run them
5124 …make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror' WINDO…
5127 msg "build: Windows cross build - mingw64, make (DLL)" # ~ 30s
5128 …make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall …
5129 …make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall …
5133 case $(i686-w64-mingw32-gcc -dumpversion 2>/dev/null) in
5134 [0-5]*|"") false;;
5142 CC=clang cmake -D CMAKE_BUILD_TYPE:String=MemSan .
5145 msg "test: main suites (MSan)" # ~ 10s
5146 make test
5148 msg "test: ssl-opt.sh (MSan)" # ~ 1 min
5149 tests/ssl-opt.sh
5153 if [ "$MEMORY" -gt 0 ]; then
5154 msg "test: compat.sh (MSan)" # ~ 6 min 20s
5162 CC=clang cmake -D CMAKE_BUILD_TYPE:String=Release .
5165 msg "test: main suites, Valgrind (default config)"
5171 if [ "$MEMORY" -gt 0 ]; then
5172 msg "test: ssl-opt.sh --memcheck (default config)"
5173 tests/ssl-opt.sh --memcheck
5176 if [ "$MEMORY" -gt 1 ]; then
5177 msg "test: compat.sh --memcheck (default config)"
5178 tests/compat.sh --memcheck
5181 if [ "$MEMORY" -gt 0 ]; then
5182 msg "test: context-info.sh --memcheck (default config)"
5183 tests/context-info.sh --memcheck
5191 CC=clang cmake -D CMAKE_BUILD_TYPE:String=Release .
5194 msg "test: main suites, Valgrind (full config)"
5204 # Attempt to parse lsb-release to find out distribution and version. If not
5205 # found this should fail safe (test is supported).
5206 if [[ -f /etc/lsb-release ]]; then
5208 while read -r lsb_line; do
5213 done < /etc/lsb-release
5220 # Running the out of source CMake test on Ubuntu 16.04 using more than one
5225 [ "$distrib_id" != "Ubuntu" ] || [ "$distrib_ver_major" -gt 16 ]
5233 msg "build: cmake 'out-of-source' build"
5238 cmake -D CMAKE_BUILD_TYPE:String=Check -D GEN_FILES=ON "$MBEDTLS_ROOT_DIR"
5241 msg "test: cmake 'out-of-source' build"
5242 make test
5243 # Check that ssl-opt.sh can find the test programs.
5246 # file is missing (ssl-opt.sh tolerates the absence of some files so
5248 ./tests/ssl-opt.sh -f 'Default' >ssl-opt.out 2>ssl-opt.err
5249 grep PASS ssl-opt.out
5250 cat ssl-opt.err >&2
5251 # If ssl-opt.err is non-empty, record an error and keep going.
5252 [ ! -s ssl-opt.err ]
5253 rm ssl-opt.out ssl-opt.err
5255 rm -rf "$OUT_OF_SOURCE_DIR"
5263 msg "build: cmake 'as-subdirectory' build"
5264 cd programs/test/cmake_subproject
5266 cmake -D GEN_FILES=ON .
5279 msg "build: cmake 'as-package' build"
5280 cd programs/test/cmake_package
5294 msg "build: cmake 'as-installed-package' build"
5295 cd programs/test/cmake_package_install
5305 # Make a copy of config file to use for the in-tree test
5316 msg "build: cmake with -DMBEDTLS_CONFIG_FILE"
5317 scripts/config.py -w full_config.h full
5318 echo '#error "cmake -DMBEDTLS_CONFIG_FILE is not working."' > "$MBEDTLS_ROOT_DIR/$CONFIG_H"
5319 cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h "$MBEDTLS_ROOT_DIR"
5322 msg "build: cmake with -DMBEDTLS_CONFIG_FILE + -DMBEDTLS_USER_CONFIG_FILE"
5327 …cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h -DMBEDTLS_USER_CONFIG_FILE=user_config.h…
5329 not programs/test/query_compile_time_config MBEDTLS_NIST_KW_C
5331 rm -f user_config.h full_config.h
5334 rm -rf "$OUT_OF_SOURCE_DIR"
5336 # Now repeat the test for an in-tree build:
5338 # Restore config for the in-tree test
5345 msg "build: cmake (in-tree) with -DMBEDTLS_CONFIG_FILE"
5346 scripts/config.py -w full_config.h full
5347 echo '#error "cmake -DMBEDTLS_CONFIG_FILE is not working."' > "$MBEDTLS_ROOT_DIR/$CONFIG_H"
5348 cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h .
5351 msg "build: cmake (in-tree) with -DMBEDTLS_CONFIG_FILE + -DMBEDTLS_USER_CONFIG_FILE"
5356 …cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h -DMBEDTLS_USER_CONFIG_FILE=user_config.h…
5358 not programs/test/query_compile_time_config MBEDTLS_NIST_KW_C
5360 rm -f user_config.h full_config.h
5372 # Only compile - we're looking for sizeof-pointer-memaccess warnings
5373 …CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-zeroize-memset.h\"' -DMBEDTLS_T…
5378 # Test that the function mbedtls_platform_zeroize() is not optimized away by
5388 if [ -z "$(gdb -batch -nw -ex 'set disable-randomization off' 2>&1)" ]; then
5389 gdb_disable_aslr='set disable-randomization off'
5392 for optimization_flag in -O2 -O3 -Ofast -Os; do
5394 msg "test: $compiler $optimization_flag, mbedtls_platform_zeroize()"
5396 …gdb -ex "$gdb_disable_aslr" -x tests/scripts/test_zeroize.gdb -nw -batch -nx 2>&1 | tee test_zeroi…
5398 not grep -i "error" test_zeroize.log
5399 rm -f test_zeroize.log
5406 msg "build: make, default config (out-of-box), libmbedcrypto.a only"
5407 make -C library libmbedcrypto.a
5409 msg "unit test: test_psa_compliance.py"
5414 # psa-compliance-tests only supports CMake >= 3.10.0
5415 ver="$(cmake --version)"
5422 [ "$ver_major" -eq 3 ] && [ "$ver_minor" -ge 10 ]
5431 case $(uncrustify --version) in
5439 tests/scripts/check-python-files.sh
5443 msg "unit test: generate_test_code.py"
5446 # harmless info on stdout so it can be suppress with --quiet.
5449 msg "unit test: translate_ciphers.py"
5450 python3 -m unittest tests/scripts/translate_ciphers.py 2>&1
5471 # Function invoked by --error-test to test error reporting.
5474 if [ $KEEP_GOING -ne 0 ]; then
5480 # Expected error: 'grep non_existent /dev/null -> 1'
5482 # Expected error: '! grep -q . tests/scripts/all.sh -> 1'
5483 not grep -q . "$0"
5484 # Expected error: 'make unknown_target -> 2'
5506 if [ $KEEP_GOING -eq 1 ]; then
5507 # We want to keep running if the subshell fails, so 'set -e' must
5512 if [ $QUIET -eq 1 ]; then
5517 if [ $KEEP_GOING -eq 1 ]; then
5518 # Keep "set -e" off, and run an ERR trap instead to record failures.
5519 set -E
5524 if [ $KEEP_GOING -eq 1 ]; then
5525 trap - ERR
5530 if [ $KEEP_GOING -eq 1 ]; then
5531 set -e
5532 if [ $component_status -ne 0 ]; then
5553 if [ $KEEP_GOING -eq 1 ]; then