Skip to content

Commit 8f3013c

Browse files
krizhanovskykrizhanovsky
committed
* Fix build w/o DEBUG
* Remove x509 unit test since it uses obsoleted ciphers and hashes. #737 is extended by a point to load and test various certs. * Couple minor fixes for unit tests. * Several cleanups
1 parent 1e887d9 commit 8f3013c

File tree

12 files changed

+108
-725
lines changed

12 files changed

+108
-725
lines changed

‎tempesta_fw/t/unit/Makefile

Lines changed: 7 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -19,29 +19,13 @@
1919

2020
tfw_root = $(src)/../../../
2121

22-
EXTRA_CFLAGS += $(TFW_CFLAGS) -I$(tfw_root)/tempesta_fw -I$(tfw_root)/tempesta_fw/t \
23-
-I$(tfw_root) -I$(tfw_root)/tempesta_db/core
22+
EXTRA_CFLAGS += $(TFW_CFLAGS) -I$(tfw_root)/tempesta_fw -I$(tfw_root) \
23+
-I$(tfw_root)/tempesta_fw/t -I$(tfw_root)/tempesta_db/core
2424
EXTRA_CFLAGS += $(TTLS_CFLAGS)
2525

2626
obj-m += tfw_test.o
27-
tfw_test-objs = \
28-
main.o \
29-
test.o \
30-
helpers.o \
31-
test_addr.o \
32-
test_cfg.o \
33-
test_hash.o \
34-
test_http_match.o \
35-
test_http_msg.o \
36-
tfw_str_helper.o \
37-
test_tfw_str.o \
38-
test_mem_fast.o \
39-
test_http_parser.o \
40-
sched_helper.o \
41-
test_sched_ratio.o \
42-
test_sched_hash.o \
43-
test_http_tbl.o \
44-
test_http_sticky.o \
45-
test_wq.o \
46-
kallsyms_helper.o \
47-
test_tls.o
27+
28+
t-srcs = $(wildcard $(obj)/*.c)
29+
t-objs = $(patsubst %.c, %.o, $(t-srcs))
30+
31+
tfw_test-objs = $(subst $(src)/,,$(t-objs))

‎tempesta_fw/t/unit/test_http_sticky.c

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
#include "sock_srv.c"
4646
#include "client.c"
4747
#include "http_limits.c"
48+
#include "tls.c"
4849

4950
/* rename original tfw_cli_conn_send(), a custom version will be used here */
5051
#define tfw_cli_conn_send divert_tfw_cli_conn_send
@@ -199,13 +200,6 @@ tfw_http_resp_build_error(TfwHttpReq *req)
199200
(void)req;
200201
}
201202

202-
/* Custom version for testing purposes. */
203-
void
204-
tfw_tls_cfg_require(void)
205-
{
206-
return;
207-
}
208-
209203
/* setup/teardown helpers */
210204

211205
static void

‎tempesta_fw/t/unit/test_tls.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,10 @@ TEST(tls, name) \
4343
DEFINE_TLS_TEST(ecp);
4444
DEFINE_TLS_TEST(mpi);
4545
DEFINE_TLS_TEST(rsa);
46-
DEFINE_TLS_TEST(x509);
4746

4847
TEST_SUITE(tls)
4948
{
5049
TEST_RUN(tls, ecp);
5150
TEST_RUN(tls, mpi);
5251
TEST_RUN(tls, rsa);
53-
TEST_RUN(tls, x509);
5452
}

‎tls/certs.c

Lines changed: 0 additions & 369 deletions
This file was deleted.

‎tls/certs.h

Lines changed: 0 additions & 87 deletions
This file was deleted.

‎tls/config.h

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -248,7 +248,7 @@
248248
*
249249
* Comment to skip keyUsage checking for both CA and leaf certificates.
250250
*/
251-
#define TTLS_X509_CHECK_KEY_USAGE
251+
//#define TTLS_X509_CHECK_KEY_USAGE
252252

253253
/**
254254
* \def TTLS_X509_CHECK_EXTENDED_KEY_USAGE
@@ -263,18 +263,6 @@
263263
*/
264264
#define TTLS_X509_CHECK_EXTENDED_KEY_USAGE
265265

266-
/**
267-
* \def TTLS_CERTS_C
268-
*
269-
* Enable the test certificates.
270-
*
271-
* Module: library/certs.c
272-
* Caller:
273-
*
274-
* This module is used for testing (ssl_client/server).
275-
*/
276-
#define TTLS_CERTS_C
277-
278266
/**
279267
* \def TTLS_DHM_C
280268
*

‎tls/pk.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ do { \
4949
void
5050
ttls_pk_free(ttls_pk_context *ctx)
5151
{
52-
BUG_ON(!ctx || !ctx->pk_info);
52+
if (unlikely(!ctx || !ctx->pk_info))
53+
return;
5354

5455
ctx->pk_info->ctx_free_func(ctx->pk_ctx);
5556

‎tls/ttls.c

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1551,9 +1551,7 @@ ttls_parse_certificate(TlsCtx *tls, unsigned char *buf, size_t len,
15511551
ca_crl,
15521552
tls->conf->cert_profile,
15531553
tls->hostname,
1554-
&sess->verify_result,
1555-
tls->conf->f_vrfy,
1556-
tls->conf->p_vrfy);
1554+
&sess->verify_result);
15571555
if (r)
15581556
T_DBG("client cert verification status: %d\n", r);
15591557

@@ -1828,15 +1826,6 @@ ttls_conf_authmode(ttls_config *conf, int authmode)
18281826
conf->authmode = authmode;
18291827
}
18301828

1831-
void
1832-
ttls_conf_verify(ttls_config *conf,
1833-
int (*f_vrfy)(void *, ttls_x509_crt *, int, uint32_t *),
1834-
void *p_vrfy)
1835-
{
1836-
conf->f_vrfy = f_vrfy;
1837-
conf->p_vrfy = p_vrfy;
1838-
}
1839-
18401829
#if defined(TTLS_CLI_C)
18411830
int ttls_set_session(ttls_context *tls, const ttls_ssl_session *session)
18421831
{
@@ -2148,9 +2137,8 @@ static int
21482137
ttls_handshake_step(TlsCtx *tls, unsigned char *buf, size_t len, size_t hh_len,
21492138
unsigned int *read)
21502139
{
2151-
TlsIOCtx *io = &tls->io_in;
2152-
2153-
T_DBG3("handshake message %u on state %x\n", io->msgtype, tls->state);
2140+
T_DBG3("handshake message %u on state %x\n",
2141+
tls->io_in.msgtype, tls->state);
21542142

21552143
#if defined(TTLS_CLI_C)
21562144
if (tls->conf->endpoint == TTLS_IS_CLIENT)

‎tls/ttls.h

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -545,21 +545,6 @@ int ttls_ctx_init(TlsCtx *tls, const ttls_config *conf);
545545
*/
546546
void ttls_conf_authmode(ttls_config *conf, int authmode);
547547

548-
/**
549-
* \brief Set the verification callback (Optional).
550-
*
551-
* If set, the verify callback is called for each
552-
* certificate in the chain. For implementation
553-
* information, please see \c ttls_x509_crt_verify()
554-
*
555-
* \param conf SSL configuration
556-
* \param f_vrfy verification function
557-
* \param p_vrfy verification parameter
558-
*/
559-
void ttls_conf_verify(ttls_config *conf,
560-
int (*f_vrfy)(void *, ttls_x509_crt *, int, uint32_t *),
561-
void *p_vrfy);
562-
563548
/**
564549
* \brief Callback type: generate and write session ticket
565550
*

‎tls/x509.c

Lines changed: 23 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,37 @@
11
/*
2-
* X.509 common functions for parsing and verification
2+
* Tempesta TLS
33
*
4-
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
5-
* Copyright (C) 2015-2018 Tempesta Technologies, Inc.
6-
* SPDX-License-Identifier: GPL-2.0
4+
* X.509 common functions for parsing and verification.
75
*
8-
* This program is free software; you can redistribute it and/or modify
9-
* it under the terms of the GNU General Public License as published by
10-
* the Free Software Foundation; either version 2 of the License, or
11-
* (at your option) any later version.
6+
* The ITU-T X.509 standard defines a certificate format for PKI.
127
*
13-
* This program is distributed in the hope that it will be useful,
14-
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15-
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16-
* GNU General Public License for more details.
8+
* http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
9+
* http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
10+
* http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
1711
*
18-
* You should have received a copy of the GNU General Public License along
19-
* with this program; if not, write to the Free Software Foundation, Inc.,
20-
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
12+
* http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
13+
* http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
2114
*
22-
* This file is part of mbed TLS (https://tls.mbed.org)
23-
*/
24-
/*
25-
* The ITU-T X.509 standard defines a certificate format for PKI.
15+
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
16+
* Copyright (C) 2015-2018 Tempesta Technologies, Inc.
17+
* SPDX-License-Identifier: GPL-2.0
18+
*
19+
* This program is free software; you can redistribute it and/or modify
20+
* it under the terms of the GNU General Public License as published by
21+
* the Free Software Foundation; either version 2 of the License, or
22+
* (at your option) any later version.
2623
*
27-
* http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
28-
* http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
29-
* http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
24+
* This program is distributed in the hope that it will be useful,
25+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
26+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27+
* GNU General Public License for more details.
3028
*
31-
* http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
32-
* http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
29+
* You should have received a copy of the GNU General Public License along
30+
* with this program; if not, write to the Free Software Foundation, Inc.,
31+
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
3332
*/
3433
#include "ttls.h"
3534
#include "asn1.h"
36-
#include "certs.h"
3735
#include "oid.h"
3836
#include "pem.h"
3937
#include "tls_internal.h"
@@ -928,66 +926,3 @@ ttls_x509_time_is_future(const ttls_x509_time *from)
928926

929927
return x509_check_time(from, &now);
930928
}
931-
932-
/*
933-
* Checkup routine
934-
*/
935-
int ttls_x509_self_test(int verbose)
936-
{
937-
#if defined(TTLS_CERTS_C)
938-
int ret;
939-
uint32_t flags;
940-
ttls_x509_crt cacert;
941-
ttls_x509_crt clicert;
942-
943-
if (verbose != 0)
944-
pr_info(" X.509 certificate load: ");
945-
946-
ttls_x509_crt_init(&clicert);
947-
948-
ret = ttls_x509_crt_parse(&clicert, (unsigned char *) ttls_test_cli_crt,
949-
ttls_test_cli_crt_len);
950-
if (ret != 0)
951-
{
952-
if (verbose != 0)
953-
pr_info("failed\n");
954-
955-
return ret;
956-
}
957-
958-
ttls_x509_crt_init(&cacert);
959-
960-
ret = ttls_x509_crt_parse(&cacert, (unsigned char *) ttls_test_ca_crt,
961-
ttls_test_ca_crt_len);
962-
if (ret != 0)
963-
{
964-
if (verbose != 0)
965-
pr_info("failed\n");
966-
967-
return ret;
968-
}
969-
970-
if (verbose != 0)
971-
pr_info("passed\n X.509 signature verify: ");
972-
973-
ret = ttls_x509_crt_verify(&clicert, &cacert, NULL, NULL, &flags, NULL, NULL);
974-
if (ret != 0)
975-
{
976-
if (verbose != 0)
977-
pr_info("failed\n");
978-
979-
return ret;
980-
}
981-
982-
if (verbose != 0)
983-
pr_info("passed\n\n");
984-
985-
ttls_x509_crt_free(&cacert );
986-
ttls_x509_crt_free(&clicert);
987-
988-
return 0;
989-
#else
990-
((void) verbose);
991-
return 0;
992-
#endif
993-
}

0 commit comments

Comments
 (0)