Integrate tlsfuzzer integration test

Signed-off-by: Jakub Jelen <[email protected]>

.github/workflows/address-sanitizer.yml

@@ -46,6 +46,7 @@ jobs:
         # The detection on debian works ok, but on Fedora, we get linker script,
         # that is not compabitlbe with LD_PRELOAD so we force the absolute path.
         run: |
+          git submodule update --init
           if [ -f /etc/fedora-release ]; then
             CC=gcc \
             meson setup builddir -Db_sanitize=address -Dpreload_libasan=/usr/lib64/libasan.so.8.0.0

.github/workflows/build.yml

@@ -73,6 +73,7 @@ jobs:
       - name: Setup
         if : ( steps.nss-version-check.outputs.skiptest != 'true' )
         run: |
+          git submodule update --init
           CC=${{ matrix.compiler }} meson setup builddir
       - name: Build and Test
         if : ( steps.nss-version-check.outputs.skiptest != 'true' )

.gitmodules

@@ -0,0 +1,9 @@
+[submodule "tlsfuzzer"]
+	path = tlsfuzzer
+	url = https://github.com/tlsfuzzer/tlsfuzzer.git
+[submodule "python-ecdsa"]
+	path = python-ecdsa
+	url = https://github.com/tlsfuzzer/python-ecdsa.git
+[submodule "tlslite-ng"]
+	path = tlslite-ng
+	url = https://github.com/tlsfuzzer/tlslite-ng.git

tests/cert.json.in

@@ -0,0 +1,36 @@
+[
+    {"server_command": [@CHECKER@"openssl", "s_server", "-www",
+                        "-key", "@PRIURI@", "-cert", "@CRTURI@",
+                        "-verify", "1", "-CAfile", "tests/clientX509Cert.pem"],
+     "comment": "Use ANY certificate just to ensure that server tries to authorise a client",
+     "environment": {"PYTHONPATH" : "."},
+     "server_hostname": "localhost",
+     "server_port": @PORT@,
+     "tests" : [
+       {"name" : "test-tls13-certificate-verify.py",
+        "arguments" : ["-k", "tests/clientX509Key.pem",
+                       "-c", "tests/clientX509Cert.pem",
+                       "-s", "ecdsa_secp256r1_sha256 ecdsa_secp384r1_sha384 ecdsa_secp521r1_sha512 ed25519 ed448 8+26 8+27 8+28 rsa_pss_pss_sha256 rsa_pss_pss_sha384 rsa_pss_pss_sha512 rsa_pss_rsae_sha256 rsa_pss_rsae_sha384 rsa_pss_rsae_sha512 rsa_pkcs1_sha256 rsa_pkcs1_sha384 rsa_pkcs1_sha512 ecdsa_sha224 rsa_pkcs1_sha224",
+                       "-p", "@PORT@"]},
+       {"name" : "test-tls13-ecdsa-in-certificate-verify.py",
+          "arguments" : ["-k", "tests/serverECKey.pem",
+                         "-c", "tests/serverECCert.pem",
+                         "-s", "ecdsa_secp256r1_sha256 ecdsa_secp384r1_sha384 ecdsa_secp521r1_sha512 ed25519 ed448 8+26 8+27 8+28 rsa_pss_pss_sha256 rsa_pss_pss_sha384 rsa_pss_pss_sha512 rsa_pss_rsae_sha256 rsa_pss_rsae_sha384 rsa_pss_rsae_sha512 rsa_pkcs1_sha256 rsa_pkcs1_sha384 rsa_pkcs1_sha512 ecdsa_sha224 rsa_pkcs1_sha224",
+                         "-p", "@PORT@"]}
+     ]
+    },
+    {"server_command": [@CHECKER@"openssl", "s_server", "-www", "-key", "@ECPRIURI@", "-cert", "@ECCRTURI@"],
+     "comment": "Run test with ECDSA hostkey in pkcs11 provider",
+     "environment": {"PYTHONPATH" : "."},
+     "server_hostname": "localhost",
+     "server_port": @PORT@,
+     "tests" : [
+       {"name" : "test-tls13-conversation.py",
+        "arguments" : ["-p", "@PORT@"]},
+       {"name" : "test-conversation.py",
+        "arguments" : ["-p", "@PORT@",
+                       "-d"]}
+     ]
+    }
+]
+

tests/meson.build

@@ -137,6 +137,7 @@ tests = {
   'rand': {'suites': ['softokn', 'softhsm', 'kryoptic']},
   'readkeys': {'suites': ['softokn', 'softhsm', 'kryoptic']},
   'tls': {'suites': ['softokn', 'softhsm', 'kryoptic'], 'is_parallel': false},
+  'tlsfuzzer': {'suites': ['softokn', 'softhsm', 'kryoptic']},
   'uri': {'suites': ['softokn', 'softhsm', 'kryoptic']},
   'ecxc': {'suites': ['softhsm', 'kryoptic']},
   'cms': {'suites': ['softokn', 'kryoptic']},

tests/ttlsfuzzer

@@ -0,0 +1,53 @@
+#!/bin/bash -e
+# Copyright (C) 2024 Jakub Jelen <[email protected]>
+# SPDX-License-Identifier: Apache-2.0
+
+source "${TESTSSRCDIR}/helpers.sh"
+
+if [[ ! -d "${TESTSSRCDIR}/../tlsfuzzer" ]]; then
+    title "TLS fuzzer is not available -- skipping"
+    exit 77;
+fi
+
+TMPFILE="${PWD}/tls-fuzzer.$$.tmp"
+PORT=4433
+
+run_tests() {
+    # Prepare the tlsfuzzer configuration
+    sed -e "s|@PRIURI@|$PRIURI|g" -e "s/@CRTURI@/$CRTURI/g" \
+        -e "s|@ECPRIURI@|$ECPRIURI|g" -e "s/@ECCRTURI@/$ECCRTURI/g" \
+        -e "s/@PORT@/$PORT/g" ${TESTSSRCDIR}/cert.json.in >${TMPFILE}
+
+    # Run openssl under checker program if needed
+    if [[ -n "$CHECKER" ]]; then
+        sed -e "s|@CHECKER@|\"$CHECKER\", |g" -i ${TMPFILE}
+    else
+        sed -e "s|@CHECKER@||g" -i ${TMPFILE}
+    fi
+
+    pushd "${TESTSSRCDIR}/../tlsfuzzer"
+    test -d ecdsa || ln -s ../python-ecdsa/src/ecdsa ecdsa
+    test -d tlslite || ln -s ../tlslite-ng/tlslite tlslite 2>/dev/null
+    PYTHONPATH=. python3 tests/scripts_retention.py ${TMPFILE} openssl 821
+    rm -f ${TMPFILE}
+    popd
+}
+
+title SECTION "Run TLS fuzzer with server key on provider"
+run_tests
+title ENDSECTION
+
+title SECTION "Run TLS fuzzer forcing the provider for all server operations"
+#We need to disable digest operations as OpenSSL depends on context duplication working
+ORIG_OPENSSL_CONF=${OPENSSL_CONF}
+sed -e "s/^#MORECONF/alg_section = algorithm_sec\n\n[algorithm_sec]\ndefault_properties = ?provider=pkcs11/" \
+    -e "s/^#pkcs11-module-block-operations/pkcs11-module-block-operations = digest/" \
+    "${OPENSSL_CONF}" > "${OPENSSL_CONF}.forcetoken"
+export OPENSSL_CONF=${OPENSSL_CONF}.forcetoken
+
+run_tests
+
+OPENSSL_CONF=${ORIG_OPENSSL_CONF}
+title ENDSECTION
+
+exit 0