Skip to content

Commit c2653a4

Browse files
lrstewartdougch
lrstewart
and
dougch
authored
tests: policy snapshot test (#5309)
Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com>
1 parent b333aa4 commit c2653a4

File tree

120 files changed

+5160
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

120 files changed

+5160
-0
lines changed

‎.github/workflows/policy_snapshot.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Policy Snapshot Test
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
merge_group:
9+
types: [checks_requested]
10+
branches: [main]
11+
12+
env:
13+
GENERATE_SCRIPT: ./tests/policy_snapshot/generate.sh build/bin/policy
14+
COMMITTED_SNAPSHOTS: ./tests/policy_snapshot/snapshots
15+
GENERATED_SNAPSHOTS: ./tests/policy_snapshot/generated
16+
17+
jobs:
18+
snapshot:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: checkout s2n-tls
22+
uses: actions/checkout@v4
23+
24+
- name: build policy util
25+
run: |
26+
cmake -Bbuild
27+
cmake --build build -j $(nproc)
28+
29+
- name: generate snapshots
30+
run: |
31+
mkdir $GENERATED_SNAPSHOTS
32+
$GENERATE_SCRIPT $GENERATED_SNAPSHOTS
33+
34+
- name: compare snapshots
35+
run: |
36+
diff -u $COMMITTED_SNAPSHOTS $GENERATED_SNAPSHOTS
37+
38+
- name: report failure
39+
if: failure()
40+
run: |
41+
echo "Changes made to security policies!"
42+
echo "Regenerate the snapshot files by rebuilding 'policy' and running: "
43+
echo " $GENERATE_SCRIPT $COMMITTED_SNAPSHOTS"
44+
echo "and committing the results as part of your PR for review."
45+
exit 1
46+

‎tests/policy_snapshot/generate.sh‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/bin/bash
2+
3+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
4+
# SPDX-License-Identifier: Apache-2.0
5+
6+
set -eu
7+
8+
SNAPSHOTS_DIR_DEFAULT="./tests/policy_snapshot/snapshots"
9+
SECURITY_POLICIES_C_DEFAULT="./tls/s2n_security_policies.c"
10+
11+
function display_usage {
12+
echo "Usage: $0 <policy_path> [snapshots_dir] [s2n_security_policies]"
13+
echo
14+
echo "Arguments:"
15+
echo " policy_path Path to the policy util binary"
16+
echo " snapshots_dir Path to the snapshots directory"
17+
echo " (default: $SNAPSHOTS_DIR_DEFAULT)"
18+
echo " s2n_security_policies Path to the s2n_security_policies.c file"
19+
echo " (default: $SECURITY_POLICIES_C_DEFAULT)"
20+
echo
21+
exit 1
22+
}
23+
24+
if [ $# -lt 1 ] || [ $# -gt 3 ] || [ "$1" == "--help" ]; then
25+
display_usage
26+
fi
27+
28+
POLICY_BINARY="$1"
29+
SNAPSHOTS_DIR=${2:-$SNAPSHOTS_DIR_DEFAULT}
30+
SECURITY_POLICIES_C=${3:-$SECURITY_POLICIES_C_DEFAULT}
31+
32+
echo "Using snapshots directory: $SNAPSHOTS_DIR"
33+
echo "Using policy binary: $POLICY_BINARY"
34+
echo "Using security policy file: $SECURITY_POLICIES_C"
35+
36+
echo "Extracting security policy names..."
37+
POLICIES=$(grep -o '{ .version = "[^"]*"' $SECURITY_POLICIES_C \
38+
| sed 's/{ .version = "\(.*\)"/\1/' | grep -v "^null$")
39+
40+
COUNT=$(echo "$POLICIES" | wc -l)
41+
echo "Found $COUNT policies."
42+
43+
rm -f $SNAPSHOTS_DIR/*
44+
45+
for policy in $POLICIES; do
46+
$POLICY_BINARY $policy > $SNAPSHOTS_DIR/$policy
47+
echo "Generated snapshot for $policy..."
48+
done
49+
50+
echo
51+
echo "Snapshots successfully generated."
52+
exit 0

‎tests/policy_snapshot/snapshots/20140601‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: 20140601
2+
min version: SSLv3
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
8+
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA
9+
- TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
10+
- TLS_RSA_WITH_AES_128_CBC_SHA256
11+
- TLS_RSA_WITH_AES_128_CBC_SHA
12+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
13+
- TLS_RSA_WITH_RC4_128_SHA
14+
- TLS_RSA_WITH_RC4_128_MD5
15+
signature schemes:
16+
- rsa_pkcs1_sha256
17+
- rsa_pkcs1_sha384
18+
- rsa_pkcs1_sha512
19+
- legacy_rsa_pkcs1_sha224
20+
- ecdsa_sha256
21+
- ecdsa_sha384
22+
- ecdsa_sha512
23+
- legacy_ecdsa_sha224
24+
- rsa_pkcs1_sha1
25+
- ecdsa_sha1
26+
curves:
27+
- secp256r1
28+
- secp384r1

‎tests/policy_snapshot/snapshots/20141001‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: 20141001
2+
min version: TLS1.0
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
8+
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA
9+
- TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
10+
- TLS_RSA_WITH_AES_128_CBC_SHA256
11+
- TLS_RSA_WITH_AES_128_CBC_SHA
12+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
13+
- TLS_RSA_WITH_RC4_128_SHA
14+
- TLS_RSA_WITH_RC4_128_MD5
15+
signature schemes:
16+
- rsa_pkcs1_sha256
17+
- rsa_pkcs1_sha384
18+
- rsa_pkcs1_sha512
19+
- legacy_rsa_pkcs1_sha224
20+
- ecdsa_sha256
21+
- ecdsa_sha384
22+
- ecdsa_sha512
23+
- legacy_ecdsa_sha224
24+
- rsa_pkcs1_sha1
25+
- ecdsa_sha1
26+
curves:
27+
- secp256r1
28+
- secp384r1

‎tests/policy_snapshot/snapshots/20150202‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: 20150202
2+
min version: TLS1.0
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
8+
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA
9+
- TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
10+
- TLS_RSA_WITH_AES_128_CBC_SHA256
11+
- TLS_RSA_WITH_AES_128_CBC_SHA
12+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
13+
signature schemes:
14+
- rsa_pkcs1_sha256
15+
- rsa_pkcs1_sha384
16+
- rsa_pkcs1_sha512
17+
- legacy_rsa_pkcs1_sha224
18+
- ecdsa_sha256
19+
- ecdsa_sha384
20+
- ecdsa_sha512
21+
- legacy_ecdsa_sha224
22+
- rsa_pkcs1_sha1
23+
- ecdsa_sha1
24+
curves:
25+
- secp256r1
26+
- secp384r1

‎tests/policy_snapshot/snapshots/20150214‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: 20150214
2+
min version: TLS1.0
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
8+
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
9+
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA
10+
- TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
11+
- TLS_RSA_WITH_AES_128_GCM_SHA256
12+
- TLS_RSA_WITH_AES_128_CBC_SHA256
13+
- TLS_RSA_WITH_AES_128_CBC_SHA
14+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
15+
signature schemes:
16+
- rsa_pkcs1_sha256
17+
- rsa_pkcs1_sha384
18+
- rsa_pkcs1_sha512
19+
- legacy_rsa_pkcs1_sha224
20+
- ecdsa_sha256
21+
- ecdsa_sha384
22+
- ecdsa_sha512
23+
- legacy_ecdsa_sha224
24+
- rsa_pkcs1_sha1
25+
- ecdsa_sha1
26+
curves:
27+
- secp256r1
28+
- secp384r1

‎tests/policy_snapshot/snapshots/20150306‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: 20150306
2+
min version: TLS1.0
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
8+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
9+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
10+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
11+
- TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
12+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
13+
- TLS_RSA_WITH_AES_128_GCM_SHA256
14+
- TLS_RSA_WITH_AES_128_CBC_SHA256
15+
- TLS_RSA_WITH_AES_128_CBC_SHA
16+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
17+
signature schemes:
18+
- rsa_pkcs1_sha256
19+
- rsa_pkcs1_sha384
20+
- rsa_pkcs1_sha512
21+
- legacy_rsa_pkcs1_sha224
22+
- ecdsa_sha256
23+
- ecdsa_sha384
24+
- ecdsa_sha512
25+
- legacy_ecdsa_sha224
26+
- rsa_pkcs1_sha1
27+
- ecdsa_sha1
28+
curves:
29+
- secp256r1
30+
- secp384r1

‎tests/policy_snapshot/snapshots/20160411‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: 20160411
2+
min version: TLS1.0
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
8+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
9+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
10+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
11+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
12+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
13+
- TLS_RSA_WITH_AES_128_CBC_SHA
14+
- TLS_RSA_WITH_AES_128_GCM_SHA256
15+
- TLS_RSA_WITH_AES_256_GCM_SHA384
16+
- TLS_RSA_WITH_AES_128_CBC_SHA256
17+
- TLS_RSA_WITH_AES_256_CBC_SHA
18+
- TLS_RSA_WITH_AES_256_CBC_SHA256
19+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
20+
signature schemes:
21+
- rsa_pkcs1_sha256
22+
- rsa_pkcs1_sha384
23+
- rsa_pkcs1_sha512
24+
- legacy_rsa_pkcs1_sha224
25+
- ecdsa_sha256
26+
- ecdsa_sha384
27+
- ecdsa_sha512
28+
- legacy_ecdsa_sha224
29+
- rsa_pkcs1_sha1
30+
- ecdsa_sha1
31+
curves:
32+
- secp256r1
33+
- secp384r1

‎tests/policy_snapshot/snapshots/20160804‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: 20160804
2+
min version: TLS1.0
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
8+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
9+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
10+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
11+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
12+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
13+
- TLS_RSA_WITH_AES_128_GCM_SHA256
14+
- TLS_RSA_WITH_AES_256_GCM_SHA384
15+
- TLS_RSA_WITH_AES_128_CBC_SHA
16+
- TLS_RSA_WITH_AES_128_CBC_SHA256
17+
- TLS_RSA_WITH_AES_256_CBC_SHA
18+
- TLS_RSA_WITH_AES_256_CBC_SHA256
19+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
20+
signature schemes:
21+
- rsa_pkcs1_sha256
22+
- rsa_pkcs1_sha384
23+
- rsa_pkcs1_sha512
24+
- legacy_rsa_pkcs1_sha224
25+
- ecdsa_sha256
26+
- ecdsa_sha384
27+
- ecdsa_sha512
28+
- legacy_ecdsa_sha224
29+
- rsa_pkcs1_sha1
30+
- ecdsa_sha1
31+
curves:
32+
- secp256r1
33+
- secp384r1

‎tests/policy_snapshot/snapshots/20160824‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: 20160824
2+
min version: TLS1.0
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
8+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
9+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
10+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
11+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
12+
- TLS_RSA_WITH_AES_128_GCM_SHA256
13+
- TLS_RSA_WITH_AES_128_CBC_SHA256
14+
- TLS_RSA_WITH_AES_128_CBC_SHA
15+
signature schemes:
16+
- rsa_pkcs1_sha256
17+
- rsa_pkcs1_sha384
18+
- rsa_pkcs1_sha512
19+
- legacy_rsa_pkcs1_sha224
20+
- ecdsa_sha256
21+
- ecdsa_sha384
22+
- ecdsa_sha512
23+
- legacy_ecdsa_sha224
24+
- rsa_pkcs1_sha1
25+
- ecdsa_sha1
26+
curves:
27+
- secp256r1
28+
- secp384r1

0 commit comments

Comments
 (0)