-
Notifications
You must be signed in to change notification settings - Fork 2.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Clean up & improve PK write test functions #7449
Conversation
Signed-off-by: Valerio Setti <[email protected]>
Signed-off-by: Valerio Setti <[email protected]>
Signed-off-by: Valerio Setti <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Going in the right direction, still found a few issues, mostly minor. Apparently the CI has complaints too, which I didn't check.
Signed-off-by: Valerio Setti <[email protected]>
Signed-off-by: Valerio Setti <[email protected]>
Signed-off-by: Valerio Setti <[email protected]>
Signed-off-by: Valerio Setti <[email protected]>
Signed-off-by: Valerio Setti <[email protected]>
Signed-off-by: Valerio Setti <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for addressing my feedback! LGTM!
Actually, I think we want to backport this to 2.28 - we're trying to keep testing aligned when possible, in order to facilitate backports for future bug fixes, which generally come with their regression test. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, although I think a bit about the testing times:
We're testing the same things over again in DER and PEM... How about testing with DER only if there's no MBEDTLS_PEM_PARSE_C
and MBEDTLS_PEM_WRITE_C
?
tests/data_files/Makefile
Outdated
@@ -999,6 +999,57 @@ ec_bp512_pub.comp.pem: ec_bp512_pub.pem | |||
$(OPENSSL) ec -pubin -in $< -out $@ -conv_form compressed | |||
all_final += ec_bp512_pub.comp.pem | |||
|
|||
################################################################ | |||
#### Convert PEM keys in DER format |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
#### Convert PEM keys in DER format | |
#### Convert PEM keys to DER format |
Let's not. There could be some mix-up in the parsing code that breaks DER parsing when PEM is enabled. The cost is negligible. |
Tests are failing on Windows. Interestingly enough, what's failing is the PEM tests, which were already present, not the DER tests which have just been added. I didn't investigate, but this smells CR+LF vs LF issues - we changed the way files are read I think, so this probably had an impact somehow? |
|
||
TEST_ASSERT(ilen == pem_len); | ||
TEST_ASSERT(memcmp((char *) buf, (char *) check_buf, ilen) == 0); | ||
ASSERT_COMPARE(start_buf, buf_len, check_buf, check_buf_len); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As Manuel suspects, this fails with PEM files on Windows because of its handling of text files. mbedtls_pk_write_key_pem
writes to the buffer, without going through the I/O layer, so newlines in start_buf
are a \n
character. mbedtls_pk_load_file
loads files in binary mode (it has no choice since it must support DER), so newlines in check_buf
are \n
on non-Windows but \r\n
on Windows (because Git treats PEM files as text, so it converts \n
to \r\n
upon checkout).
This wasn't a problem with the old code because it called fopen
in text mode to read check_buf
, so the I/O layer converted \r\n
in the file to \n
in memory. But of course that would have corrupted DER files.
I guess the solution is to remove CR characters from check_buf
if the format is PEM. Or keep calling fopen
directly, but choose text vs binary mode depending on whether the data is DER or PEM.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks a lot for your help! It really saved me a lot of time since I was not aware of this difference and I didn't have a Windows machine at hand.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We got hit by this on another PR not so long ago. While I understand why git it doing it, I still find it always surprising that what we check out (on Windows) is not byte-for-byte identical to what we commited (on Linux), at least with the default settings. Thanks Gilles for the reminder!
Signed-off-by: Valerio Setti <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM except for one truncated comment and one choice of libc function.
Signed-off-by: Valerio Setti <[email protected]>
Signed-off-by: Valerio Setti <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Reduce memory footprint for pkwrite's tests.
Resolves #7446
Gatekeeper checklist