1#!/usr/bin/env perl
2
3# curves.pl
4#
5# Copyright The Mbed TLS Contributors
6# SPDX-License-Identifier: Apache-2.0
7#
8# Licensed under the Apache License, Version 2.0 (the "License"); you may
9# not use this file except in compliance with the License.
10# You may obtain a copy of the License at
11#
12# http://www.apache.org/licenses/LICENSE-2.0
13#
14# Unless required by applicable law or agreed to in writing, software
15# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17# See the License for the specific language governing permissions and
18# limitations under the License.
19#
20# Purpose
21#
22# The purpose of this test script is to validate that the library works
23# with any combination of elliptic curves. To this effect, build the library
24# and run the test suite with each tested combination of elliptic curves.
25#
26# Testing all 2^n combinations would be too much, so we only test 2*n:
27#
28# 1. Test with a single curve, for each curve. This validates that the
29#    library works with any curve, and in particular that curve-specific
30#    code is guarded by the proper preprocessor conditionals.
31# 2. Test with all curves except one, for each curve. This validates that
32#    the test cases have correct dependencies. Testing with a single curve
33#    doesn't validate this for tests that require more than one curve.
34
35# Usage: tests/scripts/curves.pl
36#
37# This script should be executed from the root of the project directory.
38#
39# Only curves that are enabled in mbedtls_config.h will be tested.
40#
41# For best effect, run either with cmake disabled, or cmake enabled in a mode
42# that includes -Werror.
43
44use warnings;
45use strict;
46
47-d 'library' && -d 'include' && -d 'tests' or die "Must be run from root\n";
48
49my $sed_cmd = 's/^#define \(MBEDTLS_ECP_DP.*_ENABLED\)/\1/p';
50my $config_h = 'include/mbedtls/mbedtls_config.h';
51my @curves = split( /\s+/, `sed -n -e '$sed_cmd' $config_h` );
52
53# Determine which curves support ECDSA by checking the dependencies of
54# ECDSA in check_config.h.
55my %curve_supports_ecdsa = ();
56{
57    local $/ = "";
58    local *CHECK_CONFIG;
59    open(CHECK_CONFIG, '<', 'include/mbedtls/check_config.h')
60        or die "open include/mbedtls/check_config.h: $!";
61    while (my $stanza = <CHECK_CONFIG>) {
62        if ($stanza =~ /\A#if defined\(MBEDTLS_ECDSA_C\)/) {
63            for my $curve ($stanza =~ /(?<=\()MBEDTLS_ECP_DP_\w+_ENABLED(?=\))/g) {
64                $curve_supports_ecdsa{$curve} = 1;
65            }
66            last;
67        }
68    }
69    close(CHECK_CONFIG);
70}
71
72system( "cp $config_h $config_h.bak" ) and die;
73sub abort {
74    system( "mv $config_h.bak $config_h" ) and warn "$config_h not restored\n";
75    # use an exit code between 1 and 124 for git bisect (die returns 255)
76    warn $_[0];
77    exit 1;
78}
79
80# Disable all the curves. We'll then re-enable them one by one.
81for my $curve (@curves) {
82    system( "scripts/config.pl unset $curve" )
83        and abort "Failed to disable $curve\n";
84}
85# Depends on a specific curve. Also, ignore error if it wasn't enabled.
86system( "scripts/config.pl unset MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED" );
87system( "scripts/config.pl unset MBEDTLS_ECJPAKE_C" );
88
89# Test with only $curve enabled, for each $curve.
90for my $curve (@curves) {
91    system( "make clean" ) and die;
92
93    print "\n******************************************\n";
94    print "* Testing with only curve: $curve\n";
95    print "******************************************\n";
96    $ENV{MBEDTLS_TEST_CONFIGURATION} = "$curve";
97
98    system( "scripts/config.pl set $curve" )
99        and abort "Failed to enable $curve\n";
100
101    my $ecdsa = $curve_supports_ecdsa{$curve} ? "set" : "unset";
102    for my $dep (qw(MBEDTLS_ECDSA_C
103                    MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
104                    MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)) {
105        system( "scripts/config.pl $ecdsa $dep" )
106            and abort "Failed to $ecdsa $dep\n";
107    }
108
109    system( "CFLAGS='-Werror -Wall -Wextra' make" )
110        and abort "Failed to build: only $curve\n";
111    system( "make test" )
112        and abort "Failed test suite: only $curve\n";
113
114    system( "scripts/config.pl unset $curve" )
115        and abort "Failed to disable $curve\n";
116}
117
118system( "cp $config_h.bak $config_h" ) and die "$config_h not restored\n";
119
120# Test with $curve disabled but the others enabled, for each $curve.
121for my $curve (@curves) {
122    system( "cp $config_h.bak $config_h" ) and die "$config_h not restored\n";
123    system( "make clean" ) and die;
124
125    # depends on a specific curve. Also, ignore error if it wasn't enabled
126    system( "scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED" );
127
128    print "\n******************************************\n";
129    print "* Testing without curve: $curve\n";
130    print "******************************************\n";
131    $ENV{MBEDTLS_TEST_CONFIGURATION} = "-$curve";
132
133    system( "scripts/config.py unset $curve" )
134        and abort "Failed to disable $curve\n";
135
136    system( "CFLAGS='-Werror -Wall -Wextra' make" )
137        and abort "Failed to build: all but $curve\n";
138    system( "make test" )
139        and abort "Failed test suite: all but $curve\n";
140
141}
142
143system( "mv $config_h.bak $config_h" ) and die "$config_h not restored\n";
144system( "make clean" ) and die;
145exit 0;
146