Skip to content

Commit 233292b

Browse files
padelsbachpadelsbach
committed
Initial prototype of test refactor w/ runner, helper and test layers
1 parent 29c2888 commit 233292b

19 files changed

Lines changed: 2246 additions & 0 deletions

‎test-refactor/Makefile‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
## Makefile for wolfHSM test-refactor prototype
2+
## Mirrors test/Makefile conventions with minimal sources
3+
4+
## Project name
5+
BIN = wh_test_refactor
6+
7+
## Important directories
8+
PROJECT_DIR ?= .
9+
CONFIG_DIR ?= $(PROJECT_DIR)/../test/config
10+
WOLFSSL_DIR ?= ../../wolfssl
11+
WOLFHSM_DIR ?= ../
12+
WOLFHSM_PORT_DIR ?= $(WOLFHSM_DIR)/port/posix
13+
TEST_DIR ?= $(WOLFHSM_DIR)/test
14+
15+
BUILD_DIR ?= $(PROJECT_DIR)/Build
16+
17+
# Includes
18+
INC = -I$(PROJECT_DIR) \
19+
-I$(CONFIG_DIR) \
20+
-I$(TEST_DIR) \
21+
-I$(WOLFSSL_DIR) \
22+
-I$(WOLFHSM_DIR) \
23+
-I$(WOLFHSM_PORT_DIR)
24+
25+
# POSIX requires C source be defined before any header
26+
DEF += -D_POSIX_C_SOURCE=200809L
27+
28+
# Library configuration defines for user-supplied settings
29+
DEF += -DWOLFSSL_USER_SETTINGS -DWOLFHSM_CFG
30+
31+
# Enable POSIX test features and server
32+
DEF += -DWOLFHSM_CFG_TEST_POSIX
33+
DEF += -DWOLFHSM_CFG_ENABLE_CLIENT
34+
DEF += -DWOLFHSM_CFG_ENABLE_SERVER
35+
36+
# C standard
37+
CSTD ?= -std=c90
38+
39+
# Compiler flags
40+
CFLAGS_EXTRA = -Werror -Wall -Wextra
41+
CFLAGS_EXTRA += -ffunction-sections -fdata-sections
42+
CFLAGS_EXTRA += -MMD -MP
43+
44+
ARCHFLAGS ?=
45+
CFLAGS ?= $(ARCHFLAGS) $(CSTD) $(CFLAGS_EXTRA)
46+
LDFLAGS ?= $(ARCHFLAGS)
47+
48+
# Dead-strip unused sections
49+
OS_NAME := $(shell uname -s | tr A-Z a-z)
50+
ifeq ($(OS_NAME),darwin)
51+
LDFLAGS += -Wl,-dead_strip
52+
else
53+
LDFLAGS += -Wl,--gc-sections
54+
endif
55+
56+
## Optional flags (same as test/Makefile)
57+
58+
ifeq ($(DEBUG),1)
59+
DBGFLAGS = -ggdb -g3
60+
CFLAGS += $(DBGFLAGS)
61+
LDFLAGS += $(DBGFLAGS)
62+
DEF += -DWOLFHSM_CFG_DEBUG
63+
endif
64+
65+
ifeq ($(DEBUG_VERBOSE),1)
66+
DBGFLAGS = -ggdb -g3
67+
CFLAGS += $(DBGFLAGS)
68+
LDFLAGS += $(DBGFLAGS)
69+
DEF += -DWOLFHSM_CFG_DEBUG -DWOLFHSM_CFG_DEBUG_VERBOSE
70+
endif
71+
72+
ifeq ($(ASAN),1)
73+
CFLAGS += -fsanitize=address
74+
LDFLAGS += -fsanitize=address
75+
endif
76+
77+
## Source files
78+
79+
# wolfCrypt
80+
SRC_C += $(wildcard $(WOLFSSL_DIR)/wolfcrypt/src/*.c)
81+
82+
# wolfSSL TLS (needed by cert manager APIs)
83+
SRC_C += $(wildcard $(WOLFSSL_DIR)/src/*.c)
84+
85+
# wolfHSM library
86+
SRC_C += $(wildcard $(WOLFHSM_DIR)/src/*.c)
87+
88+
# POSIX port (timestamps, flash file, etc.)
89+
SRC_C += $(wildcard $(WOLFHSM_PORT_DIR)/*.c)
90+
91+
# Test-refactor sources (runner, tests, main)
92+
SRC_C += $(wildcard $(PROJECT_DIR)/*.c)
93+
94+
95+
## Build rules
96+
97+
FILENAMES_C = $(notdir $(SRC_C))
98+
OBJS_C = $(addprefix $(BUILD_DIR)/, $(FILENAMES_C:.c=.o))
99+
vpath %.c $(dir $(SRC_C))
100+
101+
.PHONY: build_app clean run
102+
103+
build_app: $(BUILD_DIR) $(BUILD_DIR)/$(BIN).elf
104+
@echo Build complete.
105+
106+
$(BUILD_DIR):
107+
mkdir -p $(BUILD_DIR)
108+
109+
# Workaround: pre-existing warnings in upstream files that
110+
# -Werror promotes to errors.
111+
$(BUILD_DIR)/internal.o: CFLAGS += -Wno-error=implicit-function-declaration
112+
$(BUILD_DIR)/wh_client_crypto.o: CFLAGS += -Wno-error=sign-compare
113+
114+
$(BUILD_DIR)/%.o: %.c
115+
@echo "Compiling: $(notdir $<)"
116+
$(CC) $(CFLAGS) $(DEF) $(INC) -c -o $@ $<
117+
118+
-include $(OBJS_C:.o=.d)
119+
120+
$(BUILD_DIR)/$(BIN).elf: $(OBJS_C)
121+
@echo "Linking: $(notdir $@)"
122+
$(CC) $(LDFLAGS) -o $@ $^ $(LIBS)
123+
124+
clean:
125+
@echo "Cleaning build files"
126+
@rm -rf $(BUILD_DIR)
127+
128+
run: build_app
129+
$(BUILD_DIR)/$(BIN).elf

‎test-refactor/README.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# test-refactor
2+
3+
Prototype of the refactored wolfHSM test infrastructure.
4+
5+
## Key differences from test/
6+
7+
- **Runner** (`wh_test_runner.h/c`): generic suite executor.
8+
Each suite is a struct with a name, NULL-terminated test
9+
array, and optional setup/cleanup. `WH_TEST_RUN_SUITE`
10+
macro drives execution from main.
11+
- **Helpers** (`wh_test_helpers.h/c`): portable init/cleanup
12+
for server-only and client-server contexts. Encapsulates
13+
flash, NVM, crypto, transport, and server/client wiring.
14+
- **Transport shim**: simplifies sequential tests. In single-process mode,
15+
a Recv wrapper pumps the server on `NOTREADY` so blocking client APIs
16+
work without manual `HandleRequestMessage` calls or
17+
separate threads.
18+
- **Platform split**: platform-specific code is isolated in two
19+
files (`wh_test_helpers_posix.c`, `wh_test_main.c`).
20+
Test modules are identical on all platforms.
21+
22+
## Suites implemented so far
23+
24+
| Suite | Pattern | Description |
25+
|-------|---------|-------------|
26+
| Flash RamSim | Standalone, no setup | Write-lock, erase, program, verify, blank-check |
27+
| NVM Flash | Standalone, custom setup | Flash unit ops, NVM add/overwrite/destroy/reclaim |
28+
| Cert (Server) | Server helper | Server-side cert add/verify/chain/erase |
29+
| ClientServer | CS helper | Echo round-trip, server info query |
30+
| ThreadSafe Stress | Wrapped existing test | Phased multi-thread contention (unchanged internals) |
31+
32+
## Remaining tests to port
33+
34+
| Suite | Pattern | Description |
35+
|-------|---------|-------------|
36+
| Comm | CS helper | Transport layer (mem, TCP, SHM) |
37+
| Crypto | CS helper | AES, RSA, ECC, CMAC, curve25519, ed25519, etc. |
38+
| Crypto Affinity | CS helper | Device ID operation routing |
39+
| SHE | CS helper | Secure Hardware Extension key load, crypto, secure boot |
40+
| Keywrap | CS helper | Key wrap/unwrap operations |
41+
| Log | Standalone, custom setup | Logging frontend, ringbuf, POSIX file backends |
42+
| Lock | Standalone, custom setup | Lock primitives with POSIX backend |
43+
| DMA | Standalone, custom setup | DMA address translation and allow-list |
44+
| Server Img Mgr | Server helper | Image manager verify/install/erase |
45+
| Timeout | CS helper | POSIX timeout enforcement |
46+
| wolfCrypt Test | CS helper | wolfCrypt test suite via wolfHSM transport |
47+
| MultiClient | Wrap or custom setup | 2 CS pairs, shared NVM, global/local key isolation |
48+
49+
## Platforms requiring update
50+
51+
Each platform with test infrastructure needs a
52+
`wh_test_helpers_<port>.c` and `wh_test_main.c`
53+
implementing the port API (see "Porting" below).
54+
55+
| Platform | Vendor | Test files |
56+
|----------|--------|------------|
57+
| POSIX | wolfSSL | `test-refactor/wh_test_helpers_posix.c` (done) |
58+
| Bernina | STMicro | `bernina-server/src/bh_test.c` |
59+
| SR6 | STMicro | (no test files found) |
60+
| TC3xx | Infineon | `port/client/wolfhsm_tests.c`, `port/server/ccb_tests.c` |
61+
| RH850 F1KM | Renesas | `rh850_test2_1/`, `rh850_test2_2/` |
62+
| PIC32CZ | Microchip | `czhsm-client/tests/`, `czhsm-server/` |
63+
| TDA4VH | TI | (no test files found) |
64+
| New Eagle | Customer | (no test files found) |
65+
66+
## File layout
67+
68+
```
69+
Portable (ships in wolfHSM):
70+
wh_test_runner.h/c - suite runner
71+
wh_test_helpers.h - helper API + config struct
72+
wh_test_helpers.c - helper implementation
73+
wh_test_helpers_port.h - functions each port must implement
74+
wh_test_*.c/h - test modules
75+
76+
Platform-specific (one set per platform):
77+
wh_test_helpers_posix.c - POSIX defaults, transport shim
78+
wh_test_main.c - suite selection, #ifdef gates
79+
Makefile - build rules
80+
```
81+
82+
## Porting to other platforms
83+
84+
1. Implement the two functions declared in
85+
`wh_test_helpers_port.h`:
86+
- `whTestHelper_Server_Init` -- call
87+
`whTestHelper_Server_InitWithConfig` with your flash,
88+
NVM, and transport backends.
89+
- `whTestHelper_CS_Init` -- call
90+
`whTestHelper_CS_InitWithConfig` then
91+
`whTestHelper_CS_AttachClient` with your client
92+
transport. On single-process targets, wrap the client
93+
transport Recv to pump the server on `NOTREADY`
94+
(see `wh_test_helpers_posix.c` for the pattern).
95+
2. Provide a `main()` that calls `WH_TEST_RUN_SUITE` for
96+
each suite, gated by the appropriate `#ifdef`s.
97+
3. Add the portable `.c` files and your port files to your
98+
build system.
99+
100+
See `wh_test_helpers_posix.c` as a reference implementation.
101+
102+
## Build and run (POSIX)
103+
104+
```
105+
make run
106+
make run DEBUG=1
107+
make run THREADSAFE=1 # enables stress test gate
108+
```

‎test-refactor/wh_test_cert.c‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
/*
2+
* Copyright (C) 2026 wolfSSL Inc.
3+
*
4+
* This file is part of wolfHSM.
5+
*
6+
* wolfHSM is free software; you can redistribute it and/or modify
7+
* it under the terms of the GNU General Public License as published by
8+
* the Free Software Foundation; either version 3 of the License, or
9+
* (at your option) any later version.
10+
*
11+
* wolfHSM is distributed in the hope that it will be useful,
12+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14+
* GNU General Public License for more details.
15+
*
16+
* You should have received a copy of the GNU General Public License
17+
* along with wolfHSM. If not, see <http://www.gnu.org/licenses/>.
18+
*/
19+
/*
20+
* test-refactor/wh_test_cert.c
21+
*
22+
* Server-side certificate test suite. Exercises the cert
23+
* manager through direct server API calls. Uses the shared
24+
* server helper for setup/cleanup.
25+
*/
26+
27+
#include "wolfhsm/wh_settings.h"
28+
29+
#if defined(WOLFHSM_CFG_CERTIFICATE_MANAGER) \
30+
&& !defined(WOLFHSM_CFG_NO_CRYPTO)
31+
32+
#include "wolfhsm/wh_error.h"
33+
#include "wolfhsm/wh_server.h"
34+
#include "wolfhsm/wh_server_cert.h"
35+
36+
#include "wh_test_common.h"
37+
#include "wh_test_helpers.h"
38+
#include "wh_test_cert.h"
39+
#include "wh_test_cert_data.h"
40+
41+
42+
/*
43+
* Add trusted roots, verify valid and invalid certs/chains,
44+
* then remove roots.
45+
*/
46+
static int test_cert_verify(void* ctx)
47+
{
48+
whServerContext* server =
49+
whTestHelper_Server_GetServer(ctx);
50+
const whNvmId rootA = 1;
51+
const whNvmId rootB = 2;
52+
53+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertInit(server));
54+
55+
/* Add trusted roots */
56+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertAddTrusted(
57+
server, rootA, WH_NVM_ACCESS_ANY,
58+
WH_NVM_FLAGS_NONMODIFIABLE,
59+
NULL, 0, ROOT_A_CERT, ROOT_A_CERT_len));
60+
61+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertAddTrusted(
62+
server, rootB, WH_NVM_ACCESS_ANY,
63+
WH_NVM_FLAGS_NONMODIFIABLE,
64+
NULL, 0, ROOT_B_CERT, ROOT_B_CERT_len));
65+
66+
/* Valid single cert (intermediate against its root) */
67+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertVerify(
68+
server, INTERMEDIATE_A_CERT, INTERMEDIATE_A_CERT_len,
69+
rootA, WH_CERT_FLAGS_NONE,
70+
WH_NVM_FLAGS_USAGE_ANY, NULL));
71+
72+
/* Invalid: leaf without intermediate -- must fail */
73+
WH_TEST_ASSERT_RETURN(
74+
WH_ERROR_CERT_VERIFY == wh_Server_CertVerify(
75+
server, LEAF_A_CERT, LEAF_A_CERT_len,
76+
rootA, WH_CERT_FLAGS_NONE,
77+
WH_NVM_FLAGS_USAGE_ANY, NULL));
78+
79+
/* Invalid: intermediate against wrong root */
80+
WH_TEST_ASSERT_RETURN(
81+
WH_ERROR_CERT_VERIFY == wh_Server_CertVerify(
82+
server, INTERMEDIATE_B_CERT,
83+
INTERMEDIATE_B_CERT_len,
84+
rootA, WH_CERT_FLAGS_NONE,
85+
WH_NVM_FLAGS_USAGE_ANY, NULL));
86+
87+
/* Valid chains */
88+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertVerify(
89+
server, RAW_CERT_CHAIN_A, RAW_CERT_CHAIN_A_len,
90+
rootA, WH_CERT_FLAGS_NONE,
91+
WH_NVM_FLAGS_USAGE_ANY, NULL));
92+
93+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertVerify(
94+
server, RAW_CERT_CHAIN_B, RAW_CERT_CHAIN_B_len,
95+
rootB, WH_CERT_FLAGS_NONE,
96+
WH_NVM_FLAGS_USAGE_ANY, NULL));
97+
98+
/* Cross-chain: must fail */
99+
WH_TEST_ASSERT_RETURN(
100+
WH_ERROR_CERT_VERIFY == wh_Server_CertVerify(
101+
server, RAW_CERT_CHAIN_A, RAW_CERT_CHAIN_A_len,
102+
rootB, WH_CERT_FLAGS_NONE,
103+
WH_NVM_FLAGS_USAGE_ANY, NULL));
104+
105+
WH_TEST_ASSERT_RETURN(
106+
WH_ERROR_CERT_VERIFY == wh_Server_CertVerify(
107+
server, RAW_CERT_CHAIN_B, RAW_CERT_CHAIN_B_len,
108+
rootA, WH_CERT_FLAGS_NONE,
109+
WH_NVM_FLAGS_USAGE_ANY, NULL));
110+
111+
/* Remove trusted roots */
112+
WH_TEST_RETURN_ON_FAIL(
113+
wh_Server_CertEraseTrusted(server, rootA));
114+
WH_TEST_RETURN_ON_FAIL(
115+
wh_Server_CertEraseTrusted(server, rootB));
116+
117+
return 0;
118+
}
119+
120+
121+
static whTestFn _tests[] = {
122+
test_cert_verify,
123+
NULL
124+
};
125+
126+
whTestSuite whTestSuite_Cert =
127+
WH_TEST_SUITE_SERVER("Cert (Server)", _tests);
128+
129+
#endif

0 commit comments

Comments
 (0)