Skip to content

Commit

Permalink
Add constant-time test to make check and make Travis fail if it fails
Browse files Browse the repository at this point in the history
Moreover, this changes the way Travis runs the constant-time tests
by adding a `--error-exitcode=1` parameter to valgrind. Without that
parameter, valgrind simply passes the exit code through, even in the
case of valgrind errors. That is, Travis would succeed even if
valgrind found problems.
  • Loading branch information
real-or-random committed Mar 5, 2020
1 parent e9fccd4 commit 72a3327
Show file tree
Hide file tree
Showing 5 changed files with 18 additions and 3 deletions.
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ libtool
*.lo
*.o
*~
*.log
*.trs
src/libsecp256k1-config.h
src/libsecp256k1-config.h.in
src/ecmult_static_context.h
Expand Down
2 changes: 1 addition & 1 deletion .travis.yml
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ script:
travis_wait 30 valgrind --error-exitcode=42 ./exhaustive_tests;
fi
- if [ -n "$CTIMETEST" ]; then
libtool --mode=execute valgrind ./valgrind_ctime_test &> valgrind_ctime_test.log;
./valgrind_ctime_test.sh &> valgrind_ctime_test.log;
fi

after_script:
Expand Down
3 changes: 2 additions & 1 deletion Makefile.am
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ tests_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/src -I$(top_srcdir)/include $
if VALGRIND_ENABLED
tests_CPPFLAGS += -DVALGRIND
noinst_PROGRAMS += valgrind_ctime_test
TESTS += valgrind_ctime_test.sh
valgrind_ctime_test_SOURCES = src/valgrind_ctime_test.c
valgrind_ctime_test_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
endif
Expand Down Expand Up @@ -141,7 +142,7 @@ src/ecmult_static_context.h: $(gen_context_BIN)
CLEANFILES = $(gen_context_BIN) src/ecmult_static_context.h
endif

EXTRA_DIST = autogen.sh src/gen_context.c src/basic-config.h
EXTRA_DIST = autogen.sh valgrind_ctime_test.sh src/gen_context.c src/basic-config.h

if ENABLE_MODULE_ECDH
include src/modules/ecdh/Makefile.am.include
Expand Down
2 changes: 1 addition & 1 deletion src/valgrind_ctime_test.c
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ int main(void) {
if (!RUNNING_ON_VALGRIND) {
fprintf(stderr, "This test can only usefully be run inside valgrind.\n");
fprintf(stderr, "Usage: libtool --mode=execute valgrind ./valgrind_ctime_test\n");
exit(1);
exit(99); /* indicates "ERROR" in make check */
}

/** In theory, testing with a single secret input should be sufficient:
Expand Down
12 changes: 12 additions & 0 deletions valgrind_ctime_test.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/sh

libtool --mode=execute valgrind --error-exitcode=1 ./valgrind_ctime_test "$@"

case $? in
127) # "command not found", i.e., either libtool or valgrind not installed
exit 77 # map this to "SKIP" (=77) for make check
;;
*)
exit $?
;;
esac

0 comments on commit 72a3327

Please sign in to comment.