#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.

set -e
pushd "$(pwd)"

usage() {
    echo "install_awslc_fips_2022.sh build_dir install_dir"
    exit 1
}

if [ "$#" -ne "2" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2

source codebuild/bin/jobs.sh

# There are currently no AWSLC release tags for the 2022 FIPS branch. The
# following is the latest commit in this branch as of 4/5/23:
# https://github.com/aws/aws-lc/commits/fips-2022-11-02
AWSLC_VERSION=03ea7816359a3e1babdf9f2cd0e694977c36ebbc

mkdir -p "$BUILD_DIR" || true
cd "$BUILD_DIR"
git clone https://github.com/aws/aws-lc.git
cd aws-lc
git checkout "${AWSLC_VERSION}"

build() {
    shared=$1
    cmake . -Bbuild -GNinja -DBUILD_SHARED_LIBS="${shared}" -DCMAKE_BUILD_TYPE=relwithdebinfo -DCMAKE_INSTALL_PREFIX="${INSTALL_DIR}" -DFIPS=1
    ninja -j "${JOBS}" -C build install
    ninja -C build clean
}

build 0
build 1

exit 0


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.

set -ex
pushd "$(pwd)"

usage() {
    echo "install_boringssl.sh build_dir install_dir"
    exit 1
}

if [ "$#" -ne "2" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
source codebuild/bin/jobs.sh
cd "$BUILD_DIR"

# Disable go proxy.  see https://github.com/golang/go/issues/33985
go env GOPRIVATE=*

# BoringSSL doesn't have tags or versions in the Github repo.
# This commit represents the latest version that S2N is compatible
# with. It prevents our build system from breaking when BoringSSL
# is updated, last done on 2022-12-30.
BSSL_VERSION=31bad2514d21f6207f3925ba56754611c462a873
mkdir boringssl
cd boringssl
git init
git remote add origin https://github.com/google/boringssl.git
git fetch origin --depth=1 $BSSL_VERSION
git reset --hard FETCH_HEAD

git checkout $BSSL_VERSION
mkdir ../build
cd ../build

cmake ../boringssl -DBUILD_SHARED_LIBS=1 -DCMAKE_BUILD_TYPE=Release
make -j $JOBS

# BoringSSL does not define any install configuration in their CMake config, copy the stuff we know we need
mkdir -p "${INSTALL_DIR}/lib"
mkdir -p "${INSTALL_DIR}/bin"
cp crypto/libcrypto.so "${INSTALL_DIR}/lib/libcrypto.so"
cp tool/bssl "${INSTALL_DIR}/bin/bssl"
cp -r ../boringssl/include "$INSTALL_DIR"

popd

exit 0


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
	echo "install_clang.sh download_dir install_dir os_name"
	exit 1
}

if [ "$#" -ne "3" ]; then
	usage
fi

CLANG_DOWNLOAD_DIR=$1
CLANG_INSTALL_DIR=$2
PLATFORM=$3

mkdir -p "$CLANG_DOWNLOAD_DIR"
cd "$CLANG_DOWNLOAD_DIR"

if [ "$PLATFORM" == "linux" ]; then
	# The Certificate used by chromium.googlesource.com is not in the default CA
	# list supported by git/curl on Ubuntu, but the certificate is in the
	# ca-certificates.crt file in Ubuntu, so set this env variable so that it is
	# picked up by git.
	export SSL_CERT_FILE=/usr/lib/ssl/certs/ca-certificates.crt
fi

export GIT_CURL_VERBOSE=1
echo "Downloading Clang..."
git clone https://chromium.googlesource.com/chromium/src/tools/clang

echo "Updating Clang..."
python3 "$CLANG_DOWNLOAD_DIR"/clang/scripts/update.py

# "third_party" directory is created above $CLANG_DOWNLOAD_DIR after running
# update, move it into $CLANG_DOWNLOAD_DIR once update is complete.
mv ../third_party "$CLANG_DOWNLOAD_DIR"

echo "Installed Clang Version: "
"$CLANG_DOWNLOAD_DIR"/third_party/llvm-build/Release+Asserts/bin/clang --version

# Install matching LLVM if FUZZ_COVERAGE is enabled
if [[ "$FUZZ_COVERAGE" == "true" ]]; then
	LLVM_INSTALL_DIR="$CLANG_INSTALL_DIR"/../llvm
	mkdir -p "$LLVM_INSTALL_DIR"
	python3 "$CLANG_DOWNLOAD_DIR"/clang/scripts/update.py --package="coverage_tools" --output-dir="$LLVM_INSTALL_DIR"
	ln -sf $LLVM_INSTALL_DIR/bin/llvm-cov /usr/bin/llvm-cov
	ln -sf $LLVM_INSTALL_DIR/bin/llvm-profdata /usr/bin/llvm-profdata
fi

mkdir -p "$CLANG_INSTALL_DIR" && cp -rf "$CLANG_DOWNLOAD_DIR"/third_party/llvm-build/Release+Asserts/* "$CLANG_INSTALL_DIR"


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
    echo "install_cppcheck.sh install_dir"
    exit 1
}

if [ "$#" -ne "1" ]; then
    usage
fi

INSTALL_DIR=$1
source codebuild/bin/jobs.sh

mkdir -p $INSTALL_DIR||true
cd "$INSTALL_DIR"
git clone --branch 2.3 --depth 1 https://github.com/danmar/cppcheck.git cppcheck-src
cd cppcheck-src

make -j $JOBS

mv cppcheck ..
mv cfg ..
cd ..
rm -rf cppcheck-src


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
    echo "install_ctverif.sh install_dir"
    exit 1
}

if [ "$#" -ne "1" ]; then
    usage
fi

INSTALL_DIR=$1

cd "$INSTALL_DIR"

#install smack
git clone https://github.com/smackers/smack.git -b develop
cd smack/bin
git checkout 45e1fc5
./build.sh

# Disabling ShellCheck using https://github.com/koalaman/shellcheck/wiki/Directive
# Turn of Warning in one line as https://github.com/koalaman/shellcheck/wiki/SC1090
# shellcheck disable=SC1090
source "$INSTALL_DIR"/smack.environment

#install ctverif
cd "$INSTALL_DIR"
git clone --depth 1 https://github.com/imdea-software/verifying-constant-time.git -b test-automation


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex
source codebuild/bin/s2n_setup_env.sh

 # Install latest version of clang, clang++, and llvm-symbolizer. Needed for fuzzing.
if [[ "$TESTS" == "fuzz" || "$TESTS" == "ALL" || "$LATEST_CLANG" == "true" ]]; then
    mkdir -p "$LATEST_CLANG_INSTALL_DIR"||true
    codebuild/bin/install_clang.sh "$(mktemp -d)" "$LATEST_CLANG_INSTALL_DIR" "$OS_NAME" > /dev/null ;
fi

# Download and Install LibFuzzer with latest clang
if [[ "$TESTS" == "fuzz" || "$TESTS" == "ALL" ]]; then
    mkdir -p "$LIBFUZZER_INSTALL_DIR" || true
    PATH=$LATEST_CLANG_INSTALL_DIR/bin:$PATH codebuild/bin/install_libFuzzer.sh "$(mktemp -d)" "$LIBFUZZER_INSTALL_DIR" "$OS_NAME" ;
fi

# Download and Install Openssl 1.1.1
if [[ ("$S2N_LIBCRYPTO" == "openssl-1.1.1") || ( "$TESTS" == "integrationv2" || "$TESTS" == "ALL" ) ]]; then
    if [[ ! -x "$OPENSSL_1_1_1_INSTALL_DIR/bin/openssl" ]]; then
      mkdir -p "$OPENSSL_1_1_1_INSTALL_DIR"||true
      codebuild/bin/install_openssl_1_1_1.sh "$(mktemp -d)" "$OPENSSL_1_1_1_INSTALL_DIR" "$OS_NAME" > /dev/null ;
    fi
fi

# Download and Install Openssl 3.0
if [[ "$S2N_LIBCRYPTO" == "openssl-3.0" && ! -d "$OPENSSL_3_0_INSTALL_DIR" ]]; then
    mkdir -p "$OPENSSL_3_0_INSTALL_DIR"
    codebuild/bin/install_openssl_3_0.sh "$(mktemp -d)" "$OPENSSL_3_0_INSTALL_DIR" "$OS_NAME" > /dev/null ;
fi

# Download and Install Openssl 1.0.2
if [[ "$S2N_LIBCRYPTO" == "openssl-1.0.2" && ! -d "$OPENSSL_1_0_2_INSTALL_DIR" ]]; then
    mkdir -p "$OPENSSL_1_0_2_INSTALL_DIR"||true
    codebuild/bin/install_openssl_1_0_2.sh "$(mktemp -d)" "$OPENSSL_1_0_2_INSTALL_DIR" "$OS_NAME" > /dev/null ;
fi

# Download and Install the Openssl FIPS module and Openssl 1.0.2-fips
if [[ "$S2N_LIBCRYPTO" == "openssl-1.0.2-fips" ]] && [[ ! -d "$OPENSSL_1_0_2_FIPS_INSTALL_DIR" ]]; then
    codebuild/bin/install_openssl_1_0_2_fips.sh "$(mktemp -d)" "$OPENSSL_1_0_2_FIPS_INSTALL_DIR" "$OS_NAME" ; fi

# Download and Install LibreSSL
if [[ "$S2N_LIBCRYPTO" == "libressl" && ! -d "$LIBRESSL_INSTALL_DIR" ]]; then
    mkdir -p "$LIBRESSL_INSTALL_DIR"||true
    codebuild/bin/install_libressl.sh "$(mktemp -d)" "$LIBRESSL_INSTALL_DIR" > /dev/null ;
fi

# Download and Install BoringSSL
if [[ "$S2N_LIBCRYPTO" == "boringssl" && ! -d "$BORINGSSL_INSTALL_DIR" ]]; then
    codebuild/bin/install_boringssl.sh "$(mktemp -d)" "$BORINGSSL_INSTALL_DIR" > /dev/null ;
fi

# Download and Install AWS-LC
if [[ "$S2N_LIBCRYPTO" == "awslc" && ! -d "$AWSLC_INSTALL_DIR" ]]; then
    codebuild/bin/install_awslc.sh "$(mktemp -d)" "$AWSLC_INSTALL_DIR" "0" > /dev/null ;
fi
if [[ "$S2N_LIBCRYPTO" == "awslc-fips" && ! -d "$AWSLC_FIPS_INSTALL_DIR" ]]; then
    codebuild/bin/install_awslc.sh "$(mktemp -d)" "$AWSLC_FIPS_INSTALL_DIR" "1" > /dev/null ;
fi
if [[ "$S2N_LIBCRYPTO" == "awslc-fips-2022" && ! -d "$AWSLC_FIPS_2022_INSTALL_DIR" ]]; then
    codebuild/bin/install_awslc_fips_2022.sh "$(mktemp -d)" "$AWSLC_FIPS_2022_INSTALL_DIR" > /dev/null ;
fi

if [[ "$TESTS" == "integrationv2" || "$TESTS" == "ALL" ]]; then
    # Install tox
    if [[ "$DISTRO" == "ubuntu" ]]; then
        if [[ ! -x `python3.9 -m tox --version` ]]; then
            python3.9 -m pip install tox
        fi
    else
        if [[ ! -x `which tox` ]]; then
            case "$DISTRO" in
            "amazon linux")
                yum install -y python3-pip
                python3 -m pip install --user tox ;;
            "apple")
                brew install python@3
                python3 -m pip install --user tox ;;
            *)
                echo "Unkown platform $DISTRO trying to install tox on $OS_NAME $ARCH"
                exit 1
                ;;
            esac
        fi
    fi

    if [[ ! -x "$OPENSSL_0_9_8_INSTALL_DIR/bin/openssl" ]]; then
      # Download and Install Openssl 0.9.8
      mkdir -p "$OPENSSL_0_9_8_INSTALL_DIR"||true
      codebuild/bin/install_openssl_0_9_8.sh "$(mktemp -d)" "$OPENSSL_0_9_8_INSTALL_DIR" "$OS_NAME" > /dev/null ;
    fi

    if [[ ! -x "$GNUTLS_INSTALL_DIR/bin/gnutls-cli" ]]; then
      # Download and Install GnuTLS for integration tests
      mkdir -p "$GNUTLS_INSTALL_DIR"||true
      codebuild/bin/install_gnutls.sh "$(mktemp -d)" "$GNUTLS_INSTALL_DIR" > /dev/null ;
    fi

    if [[ ! -x "$GNUTLS37_INSTALL_DIR/bin/gnutls-cli" ]]; then
      # Download and Install GnuTLS for integration tests
      mkdir -p "$GNUTLS37_INSTALL_DIR"||true
      codebuild/bin/install_gnutls37.sh "$(mktemp -d)" "$GNUTLS37_INSTALL_DIR" > /dev/null ;
    fi

    if [[ ! -x "$OQS_OPENSSL_1_1_1_INSTALL_DIR/bin/openssl" ]]; then
      # Download and Install OQS OpenSSL for integration tests
      mkdir -p "$OQS_OPENSSL_1_1_1_INSTALL_DIR" ||true
      codebuild/bin/install_oqs_openssl_1_1_1.sh "$(mktemp -d)" "$OQS_OPENSSL_1_1_1_INSTALL_DIR" "$OS_NAME" | head -50
    fi

    if [[ "$DISTRO" == "ubuntu" ]]; then
        # Install SSLyze for all Integration Tests on Ubuntu.
        # There is a nassl dependancy issue preventing this from working on on AL2 ARM (others?).
        if [[ "$S2N_NO_SSLYZE" != "true" ]]; then
            codebuild/bin/install_sslyze.sh
        fi

        if [[ ! -x "$APACHE2_INSTALL_DIR/apache2.conf" ]]; then
            codebuild/bin/install_apache2.sh codebuild/bin/apache2 "$APACHE2_INSTALL_DIR"
        fi
    fi
fi

# Install SAW, Z3, and Yices for formal verification
if [[ "$SAW" == "true" || "$TESTS" == "ALL" ]]; then
    mkdir -p "$SAW_INSTALL_DIR"||true
    codebuild/bin/install_saw.sh "$(mktemp -d)" "$SAW_INSTALL_DIR" > /dev/null ;

    mkdir -p "$Z3_INSTALL_DIR"||true
    codebuild/bin/install_z3_yices.sh "$(mktemp -d)" "$Z3_INSTALL_DIR" > /dev/null ;
fi

if [[ ! -x `which cmake` ]]; then
    case "$DISTRO" in
    "ubuntu")
        apt-get -y install cmake
        ;;
    "amazon linux")
        yum install -y cmake3
        update-alternatives --install /usr/bin/cmake cmake /usr/bin/cmake3 30
        ;;
    "apple")
        brew install cmake
        ;;
    *)
        echo "Unknown platform for cmake."
        ;;
    esac
fi

if [[ "$TESTS" == "benchmark" || "$TESTS" == "ALL" ]]; then
    if [[ ! -x "$GB_INSTALL_DIR/lib/libbenchmark.a" ]]; then
        mkdir -p "$GB_INSTALL_DIR"||true
        codebuild/bin/install_googlebenchmark.sh "$(mktemp -d)" "$GB_INSTALL_DIR" "$OS_NAME" > /dev/null ;
    fi
fi


#!/bin/bash
#
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e
source codebuild/bin/s2n_setup_env.sh

usage() {
    echo "install_gnutls.sh build_dir install_dir os_name"
    exit 1
}

if [ "$#" -ne "2" ]; then
    usage
fi

GNUTLS_BUILD_DIR=$1
GNUTLS_INSTALL_DIR=$2

source codebuild/bin/jobs.sh

# libgmp is needed for libnettle
case "$DISTRO" in
  "ubuntu")
    sudo apt-get -qq install libgmp3-dev -y
    ;;
  "amazon linux")
    sudo yum install -y gmp-devel
    ;;
"darwin" )
    # Installing an existing package is a "failure" in brew
    brew install gmp || true
    ;;
*)
    echo "Invalid platform! $OS_NAME"
    usage
    ;;
esac

cd "$GNUTLS_BUILD_DIR"

# libnettle is a dependency of GnuTLS
# Originally from: https://ftp.gnu.org/gnu/nettle/nettle-3.3.tar.gz
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2017-08-29_nettle-3.3.tar.gz --output nettle-3.3.tar.gz
tar -xzf nettle-3.3.tar.gz
cd nettle-3.3
./configure --prefix="$GNUTLS_INSTALL_DIR"/nettle
make -j $JOBS
make -j $JOBS install
cd ..

# Install GnuTLS
# Originally from: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-3.5.5.tar.xz
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2017-08-29_gnutls-3.5.5.tar.xz --output gnutls-3.5.5.tar.xz
tar -xJf gnutls-3.5.5.tar.xz
cd gnutls-3.5.5
./configure LD_FLAGS="-R$GNUTLS_INSTALL_DIR/nettle/lib -L$GNUTLS_INSTALL_DIR/nettle/lib -lnettle -lhogweed" \
            NETTLE_LIBS="-R$GNUTLS_INSTALL_DIR/nettle/lib -L$GNUTLS_INSTALL_DIR/nettle/lib -lnettle" \
            NETTLE_CFLAGS="-I$GNUTLS_INSTALL_DIR/nettle/include" \
            HOGWEED_LIBS="-R$GNUTLS_INSTALL_DIR/nettle/lib -L$GNUTLS_INSTALL_DIR/nettle/lib -lhogweed" \
            HOGWEED_CFLAGS="-I$GNUTLS_INSTALL_DIR/nettle/include" \
            --without-p11-kit \
            --with-included-libtasn1 \
            --prefix="$GNUTLS_INSTALL_DIR"
make -j $JOBS
make -j $JOBS install


#!/bin/bash
#
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e
source codebuild/bin/s2n_setup_env.sh

usage() {
    echo "install_gnutls37.sh build_dir install_dir os_name"
    exit 1
}

if [ "$#" -ne "2" ]; then
    usage
fi

GNUTLS_BUILD_DIR=$1
GNUTLS_INSTALL_DIR=$2

source codebuild/bin/jobs.sh

# libgmp is needed for libnettle
case "$DISTRO" in
  "ubuntu")
    sudo apt-get -qq install libgmp3-dev -y
    ;;
  "amazon linux")
    sudo yum install -y gmp-devel
    ;;
"darwin" )
    # Installing an existing package is a "failure" in brew
    brew install gmp || true
    ;;
*)
    echo "Invalid platform! $OS_NAME"
    usage
    ;;
esac

cd "$GNUTLS_BUILD_DIR"

# Originally from: https://ftp.gnu.org/gnu/nettle/
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2021-01-04_nettle-3.7.tar.gz --output nettle-3.7.tar.gz
tar -xzf nettle-3.7.tar.gz
cd nettle-3.7
./configure --prefix="$GNUTLS_INSTALL_DIR"/nettle \
            --disable-openssl \
            --enable-shared
make -j $JOBS
make -j $JOBS install
cd ..

# Install GnuTLS
# Originally from: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2022-01-18_gnutls-3.7.3.tar.xz --output gnutls-3.7.3.tar.xz
tar -xJf gnutls-3.7.3.tar.xz
cd gnutls-3.7.3
PKG_CONFIG_PATH="$GNUTLS_INSTALL_DIR"/nettle/lib/pkgconfig:$PKG_CONFIG_PATH \
  ./configure --prefix="$GNUTLS_INSTALL_DIR" \
              --without-p11-kit \
              --with-included-libtasn1 \
              --with-included-unistring
make -j $JOBS
make -j $JOBS install


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
	echo "install_googlebenchmark.sh download_dir install_dir os_name"
	exit 1
}

if [ "$#" -ne "3" ]; then
	usage
fi

GB_DOWNLOAD_DIR=$1
GB_INSTALL_DIR=$2
PLATFORM=$3

mkdir -p "$GB_DOWNLOAD_DIR"
cd "$GB_DOWNLOAD_DIR"

export GIT_CURL_VERBOSE=1
echo "Downloading Google Benchmark..."
git clone https://github.com/google/benchmark.git
git clone https://github.com/google/googletest.git benchmark/googletest
cd benchmark
mkdir build && cd build
cmake ../ -DCMAKE_BUILD_TYPE=Release
make

mkdir -p "$GB_INSTALL_DIR"/include && cp -rf "$GB_DOWNLOAD_DIR"/benchmark/include/benchmark "$GB_INSTALL_DIR"/include/
mkdir -p "$GB_INSTALL_DIR"/lib && cp -rf "$GB_DOWNLOAD_DIR"/benchmark/build/src/*.a "$GB_INSTALL_DIR"/lib/


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#
set -ex

usage() {
	echo "install_libFuzzer.sh download_dir install_dir os_name"
	exit 1
}

if [ "$#" -ne "3" ]; then
	usage
fi

LIBFUZZER_DOWNLOAD_DIR=$1
LIBFUZZER_INSTALL_DIR=$2
export PLATFORM=$3

mkdir -p "$LIBFUZZER_DOWNLOAD_DIR"
cd "$LIBFUZZER_DOWNLOAD_DIR"

git clone https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer
cd Fuzzer
git checkout 651ead
cd ..

echo "Compiling LibFuzzer..."
clang++ -c -g -v -O2 -lstdc++ -std=c++11 Fuzzer/*.cpp -IFuzzer
ar ruv libFuzzer.a Fuzzer*.o

echo "Copying libFuzzer.a to $LIBFUZZER_INSTALL_DIR"
mkdir -p "$LIBFUZZER_INSTALL_DIR"/lib && cp libFuzzer.a "$LIBFUZZER_INSTALL_DIR"/lib

# Run AFL instead of libfuzzer if AFL_FUZZ is set. Not compatible with fuzz coverage.
if [[ "$AFL_FUZZ" == "true" && "$FUZZ_COVERAGE" != "true" ]]; then
	# Clusterfuzz's bash script changed from AFL to AFL++ on April 1, 2021; this
	# commit (ac5ac9e4604ea03cfd643185ad1e3800e952ea44) pins the script to an older version
	# of Clusterfuzz until we support AFL++.
	mkdir -p "$LIBFUZZER_INSTALL_DIR" && curl https://raw.githubusercontent.com/google/clusterfuzz/ac5ac9e4604ea03cfd643185ad1e3800e952ea44/docs/setting-up-fuzzing/build_afl.bash > "$LIBFUZZER_INSTALL_DIR"/build_afl.bash
	chmod +x "$LIBFUZZER_INSTALL_DIR"/build_afl.bash
	cd "$LIBFUZZER_INSTALL_DIR"
	"$LIBFUZZER_INSTALL_DIR"/build_afl.bash
	cd -
fi


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
    echo "install_libressl.sh build_dir install_dir"
    exit 1
}

if [ "$#" -ne "2" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
source codebuild/bin/jobs.sh

cd "$BUILD_DIR"
# Originally from https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.4.3.tar.gz
curl https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2022-12-01_libressl-3.6.1.tar.gz > libressl-3.6.1.tar.gz
tar -xzvf libressl-3.6.1.tar.gz
cd libressl-3.6.1
./configure --prefix="$INSTALL_DIR"
make -j $JOBS CFLAGS=-fPIC install


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex
pushd "$(pwd)"

usage() {
    echo "install_openssl_0_9_8.sh build_dir install_dir os_name"
    exit 1
}

if [ "$#" -ne "3" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
PLATFORM=$3

cd "$BUILD_DIR"
wget https://www.openssl.org/source/old/0.9.x/openssl-0.9.8zh.tar.gz
tar xzvf openssl-0.9.8zh.tar.gz
cd openssl-0.9.8zh

if [ "$PLATFORM" == "linux" ]; then
    CONFIGURE="./config -d"
elif [ "$PLATFORM" == "osx" ]; then
    CONFIGURE="./Configure darwin64-x86_64-cc"
else
    echo "Invalid platform! $PLATFORM"
    usage
fi

$CONFIGURE --prefix="$INSTALL_DIR"

make depend
make -j8
make install

popd

exit 0


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex
pushd "$(pwd)"

usage() {
    echo "install_openssl_1_0_2.sh build_dir install_dir os_name"
    exit 1
}

if [ "$#" -ne "3" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
OS_NAME=$3
source codebuild/bin/jobs.sh

mkdir -p $BUILD_DIR
cd "$BUILD_DIR"
curl --retry 3 -L https://github.com/openssl/openssl/archive/OpenSSL_1_0_2-stable.zip --output openssl-OpenSSL_1_0_2-stable.zip
unzip openssl-OpenSSL_1_0_2-stable.zip
cd openssl-OpenSSL_1_0_2-stable

if [ "$OS_NAME" == "linux" ]; then
    CONFIGURE="./config -d"
elif [ "$OS_NAME" == "osx" ]; then
    CONFIGURE="./Configure darwin64-x86_64-cc"
else
    echo "Invalid platform! $OS_NAME"
    usage
fi

mkdir -p $INSTALL_DIR
$CONFIGURE shared -g3 -fPIC no-libunbound no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-sctp no-ssl-trace \
         no-store no-zlib no-hw no-mdc2 no-seed no-idea enable-ec_nistp_64_gcc_128 no-camellia no-bf no-ripemd \
         no-dsa no-ssl2 no-capieng -DSSL_FORBID_ENULL -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS \
         --prefix="$INSTALL_DIR"

make -j $JOBS depend
make -j $JOBS
make -j $JOBS install_sw

popd

exit 0


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex
pushd "$(pwd)"

usage() {
    echo "install_openssl_1_0_2_fips.sh build_dir install_dir os_name"
    exit 1
}

if [ "$#" -ne "3" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
OS_NAME=$3

if [ "$OS_NAME" == "linux" ]; then
    CONFIGURE="./config -d"
elif [ "$OS_NAME" == "osx" ]; then
    echo "WARNING: FIPS and MacOS is not officially supported. This build should only be used for local debugging."
    echo "See: http://openssl.6102.n7.nabble.com/Openssl-Fips-build-for-Mac-OSX-64-bit-td44716.html"
    CONFIGURE="./Configure darwin64-x86_64-cc"
else
    echo "Invalid platform! $OS_NAME"
    usage
fi

# Install the FIPS object module in accordance with OpenSSL FIPS 140-2 Security Policy Annex A.
#     https://www.openssl.org/docs/fips/SecurityPolicy-2.0.pdf
# This installation is not FIPS compliant as we do not own the build system architecture.
# It may only be used for testing purposes.
#
# There is no 'latest' download URL for the FIPS object modules
cd "$BUILD_DIR"
# Originally from: http://www.openssl.org/source/openssl-fips-2.0.13.tar.gz
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2017-08-31_openssl-fips-2.0.13.tar.gz --output openssl-fips-2.0.13.tar.gz
gunzip -c openssl-fips-2.0.13.tar.gz | tar xf -
rm openssl-fips-2.0.13.tar.gz
cd openssl-fips-2.0.13
mkdir ../OpensslFipsModule
FIPSDIR="$(pwd)/../OpensslFipsModule"
export FIPSDIR
chmod +x ./Configure
$CONFIGURE
make
make install

cd "$BUILD_DIR"
curl --retry 3 -L https://github.com/openssl/openssl/archive/OpenSSL_1_0_2-stable.zip --output openssl-OpenSSL_1_0_2-stable.zip
unzip openssl-OpenSSL_1_0_2-stable.zip
cd openssl-OpenSSL_1_0_2-stable

FIPS_OPTIONS="fips --with-fipsdir=$FIPSDIR shared"

$CONFIGURE $FIPS_OPTIONS -g3 -fPIC no-libunbound no-gmp no-jpake no-krb5 no-md2 no-rc5 \
         no-rfc3779 no-sctp no-ssl-trace no-store no-zlib no-hw no-mdc2 no-seed no-idea \
         enable-ec_nistp_64_gcc_128 no-camellia no-bf no-ripemd no-dsa no-ssl2 no-capieng -DSSL_FORBID_ENULL \
         -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS --prefix="$INSTALL_DIR"

make depend
make
make install_sw

popd

exit 0


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex
pushd "$(pwd)"

usage() {
    echo "install_openssl_1_1_1.sh build_dir install_dir os_name"
    exit 1
}

if [ "$#" -ne "3" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
OS_NAME=$3
source codebuild/bin/jobs.sh
RELEASE=1_1_1-stable

mkdir -p $BUILD_DIR
cd "$BUILD_DIR"
curl --retry 3 -L https://github.com/openssl/openssl/archive/OpenSSL_${RELEASE}.zip --output OpenSSL_${RELEASE}.zip
unzip OpenSSL_${RELEASE}.zip
cd openssl-OpenSSL_${RELEASE}

if [ "$OS_NAME" == "linux" ]; then
    CONFIGURE="./config -d"
elif [[ "$OS_NAME" == "osx" || "$OS_NAME" == "darwin" ]]; then
    CONFIGURE="./Configure darwin64-x86_64-cc"
else
    echo "Invalid platform! $OS_NAME"
    usage
fi

mkdir -p $INSTALL_DIR
# Use g3 to get debug symbols in libcrypto to chase memory leaks
$CONFIGURE shared -g3 -fPIC              \
         no-md2 no-rc5 no-rfc3779 no-sctp no-ssl-trace no-zlib     \
         no-hw no-mdc2 no-seed no-idea enable-ec_nistp_64_gcc_128 no-camellia\
         no-bf no-ripemd no-dsa no-ssl2 no-ssl3 no-capieng                  \
         -DSSL_FORBID_ENULL -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS      \
         --prefix="$INSTALL_DIR"

make -j $JOBS depend
make -j $JOBS
make -j $JOBS install_sw

popd

exit 0


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex
pushd "$(pwd)"

usage() {
    echo "install_openssl_3_0.sh build_dir install_dir os_name"
    exit 1
}

if [ "$#" -ne "3" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
OS_NAME=$3
source codebuild/bin/jobs.sh
RELEASE=3.0.7

mkdir -p $BUILD_DIR
cd "$BUILD_DIR"
curl --retry 3 -L https://github.com/openssl/openssl/archive/refs/tags/openssl-${RELEASE}.zip --output OpenSSL_${RELEASE}.zip
unzip OpenSSL_${RELEASE}.zip
cd openssl-openssl-${RELEASE}

CONFIGURE="./Configure "

mkdir -p $INSTALL_DIR
# Use g3 to get debug symbols in libcrypto to chase memory leaks
$CONFIGURE shared -g3 -fPIC              \
         no-md2 no-rc5 no-rfc3779 no-sctp no-ssl-trace no-zlib     \
         no-hw no-mdc2 no-seed no-idea enable-ec_nistp_64_gcc_128 no-camellia\
         no-bf no-ripemd no-dsa no-ssl2 no-ssl3 no-capieng no-dtls          \
         -DSSL_FORBID_ENULL -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS      \
         --prefix="$INSTALL_DIR"

make -j $JOBS
make -j $JOBS test
make -j $JOBS install

popd

# sym-link lib -> lib64 since codebuild assumes /lib path
pushd $INSTALL_DIR
ln -s lib64 lib
popd

exit 0


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex

usage() {
    echo "install_oqs_openssl_1_1_1.sh build_dir install_dir platform"
    exit 1
}

if [ "$#" -ne "3" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
PLATFORM=$3

cd "$BUILD_DIR"

# Download OQS OpenSSL Source code
git clone --branch OQS-OpenSSL_1_1_1-stable https://github.com/open-quantum-safe/openssl.git

# Download and Build OQS library, and copy "lib" and "include" artifacts into OQS OpenSSL directory
git clone https://github.com/open-quantum-safe/liboqs.git
cd liboqs

# Use commit that supports Kyber round 3; hybrid draft spec version 5
git checkout cf6d8a059e446d24e2af06949d83605ae0f4f414

mkdir build && cd build
cmake -GNinja -DCMAKE_INSTALL_PREFIX=${BUILD_DIR}/openssl/oqs ..
ninja
ninja install

# Complete the OpenSSL Build
cd "$BUILD_DIR"/openssl

# Pin to OQS-OpenSSL commit that is compatible with Kyber round 3; hybrid draft spec version 5 LibOQS implementation
git checkout 613d1bea7afa23dc11f340e75990cb47d77711e9

if [ "$PLATFORM" == "linux" ]; then
    CONFIGURE="./config -d"
elif [ "$PLATFORM" == "osx" ]; then
    CONFIGURE="./Configure darwin64-x86_64-cc"
else
    echo "Invalid platform! $PLATFORM"
    usage
fi

# Use g3 to get debug symbols in libcrypto to chase memory leaks
$CONFIGURE -g3 -fPIC              \
         no-md2 no-rc5 no-rfc3779 no-sctp no-ssl-trace no-zlib     \
         no-hw no-mdc2 no-seed no-idea enable-ec_nistp_64_gcc_128 no-camellia \
         no-bf no-ripemd no-dsa no-ssl2 no-ssl3 no-capieng                  \
         -DSSL_FORBID_ENULL -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS      \
         --prefix="$INSTALL_DIR"

make depend
make -j
make install_sw

exit 0


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
    echo "install_prlimit.sh download_dir install_dir"
    exit 1
}

if [ "$#" -ne "2" ]; then
    usage
fi

BUILD_DIR=$1
INSTALL_DIR=$2
source codebuild/bin/jobs.sh

sudo apt-get install -y libncurses5-dev

cd "$BUILD_DIR"
# Originally from: https://www.kernel.org/pub/linux/utils/util-linux/v2.25/util-linux-2.25.2.tar.gz
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2017-08-29_util-linux-2.25.2.tar.gz --output util-linux-2.25.2.tar.gz
tar -xzvf util-linux-2.25.2.tar.gz
cd util-linux-2.25.2
./configure ADJTIME_PATH=/var/lib/hwclock/adjtime \
    --disable-chfn-chsh \
    --disable-login \
    --disable-nologin \
    --disable-su \
    --disable-setpriv \
    --disable-runuser \
    --disable-pylibmount \
    --disable-static \
    --without-python \
    --without-systemd \
    --disable-makeinstall-chown \
    --without-systemdsystemunitdir \
    --without-ncurses \
    --prefix="$INSTALL_DIR" || cat config.log

make -j $JOBS > /dev/null
make -j $JOBS install > /dev/null


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#
#!/bin/bash

set -e

if [ "$#" -ne 3 ]; then
    echo "install_python.sh libcrypto_root build_dir install_dir"
    exit 1
fi

LIBCRYPTO_ROOT=$1
BUILD_DIR=$2
INSTALL_DIR=$3
source codebuild/bin/jobs.sh

cd "$BUILD_DIR"
# Originally from: https://www.python.org/ftp/python/3.6.0/Python-3.6.0.tgz
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2017-08-29_Python-3.6.0.tgz --output Python-3.6.0.tgz
tar xzf Python-3.6.0.tgz
cd Python-3.6.0
 CPPFLAGS="-I$LIBCRYPTO_ROOT/include" LDFLAGS="-Wl,-rpath,$LIBCRYPTO_ROOT/lib -L$LIBCRYPTO_ROOT/lib" ./configure --prefix="$INSTALL_DIR"
make -j $JOBS
make -j $JOBS install


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.

set -ex
pushd "$(pwd)"

usage() {
    echo "install_s2n_head.sh build_dir"
    exit 1
}

if [ "$#" -ne "1" ]; then
    usage
fi

BUILD_DIR=$1
source codebuild/bin/jobs.sh
cd "$BUILD_DIR"

# Clone the most recent s2n commit
git clone --depth=1 https://github.com/aws/s2n-tls s2n_head
cmake ./s2n_head -Bbuild -DCMAKE_PREFIX_PATH="$LIBCRYPTO_ROOT" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
cmake --build ./build -- -j $JOBS

# Copy new executables to bin directory
cp -f "$BUILD_DIR"/build/bin/s2nc "$BASE_S2N_DIR"/bin/s2nc_head
cp -f "$BUILD_DIR"/build/bin/s2nd "$BASE_S2N_DIR"/bin/s2nd_head

popd

exit 0


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -xe

usage() {
	echo "install_saw.sh download_dir install_dir"
	exit 1
}

if [ "$#" -ne "2" ]; then
	usage
fi

DOWNLOAD_DIR=$1
INSTALL_DIR=$2

if [ -x "$INSTALL_DIR/bin/saw" ]; then
	echo "Saw already installed at $INSTALL_DIR/bin/saw";
	exit 0;
fi

mkdir -p "$DOWNLOAD_DIR"
cd "$DOWNLOAD_DIR"

#download saw binaries
curl --retry 3 https://s2n-public-test-dependencies.s3.us-west-2.amazonaws.com/saw-0.9.0.99-Linux-x86_64.tar.gz --output saw.tar.gz

mkdir -p saw && tar -xzf saw.tar.gz --strip-components=1 -C saw
mkdir -p "$INSTALL_DIR" && mv saw/* "$INSTALL_DIR"

"$INSTALL_DIR"/bin/saw --version


#!/bin/bash
#
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e
source codebuild/bin/s2n_setup_env.sh

usage() {
    echo "install_shellcheck.sh"
    exit 1
}

install_shellcheck() {
   wget "https://github.com/koalaman/shellcheck/releases/download/v0.7.1/shellcheck-v0.7.1.linux.$ARCH.tar.xz" -O /tmp/shellcheck.tar.xz
   tar -Jxf /tmp/shellcheck.tar.xz -C /tmp
   mv /tmp/shellcheck-v*/shellcheck /usr/local/bin/
   chmod 755 /usr/local/bin/shellcheck
}

if [ "$#" -ne "0" ]; then
    usage
fi

case "$OS_NAME" in
  "amazon linux"|"linux")
    which shellcheck || install_shellcheck
    ;;
  "darwin" )
    brew install shellcheck || true ;
    ;;
  *)
    echo "Unknown platform"
    exit 255
    ;;
esac


#!/bin/bash
# Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e
set -x

usage() {
    echo "install_sidetrail.sh install_dir"
    exit 1
}

if [ "$#" -ne "1" ]; then
    usage
fi

INSTALL_DIR=$1

cd "$INSTALL_DIR"

#install smack
git clone https://github.com/danielsn/smack.git -b sidewinder-debug
cd smack/bin

clang --version
which clang

./build.sh

# Disabling ShellCheck using https://github.com/koalaman/shellcheck/wiki/Directive
# Turn of Warning in one line as https://github.com/koalaman/shellcheck/wiki/SC1090
# shellcheck disable=SC1090
source "$INSTALL_DIR"/smack.environment

#install ctverif
cd "$INSTALL_DIR"
git clone --depth 1 https://github.com/imdea-software/verifying-constant-time.git -b test-automation


#!/bin/bash
# Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e
set -x

#Figlet is required for ctverif printing
sudo apt-get install -y figlet

#Install boogieman
gem install bam-bam-boogieman
which bam

#Install the apt-get dependencies from the smack build script: this way they will still be there
#when we get things from cache
DEPENDENCIES="git cmake python-yaml python-psutil unzip wget python3-yaml"
DEPENDENCIES+=" mono-complete libz-dev libedit-dev"
DEPENDENCIES+=" clang-3.9 llvm-3.9 llvm-3.9-dev"

# Adding MONO repository
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
echo "deb http://download.mono-project.com/repo/ubuntu trusty main" | sudo tee /etc/apt/sources.list.d/mono-official.list

sudo apt-get update -o Acquire::CompressionTypes::Order::=gz
sudo apt-get install -y ${DEPENDENCIES}
pip install pyyaml

LLVM_SHORT_VERSION=3.9

sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${LLVM_SHORT_VERSION} 30
sudo update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-${LLVM_SHORT_VERSION} 30
sudo update-alternatives --install /usr/bin/llvm-config llvm-config /usr/bin/llvm-config-${LLVM_SHORT_VERSION} 30
sudo update-alternatives --install /usr/bin/llvm-link llvm-link /usr/bin/llvm-link-${LLVM_SHORT_VERSION} 30
sudo update-alternatives --install /usr/bin/llvm-dis llvm-dis /usr/bin/llvm-dis-${LLVM_SHORT_VERSION} 30

which clang
clang --version
clang-3.9 --version

mkdir -p ~/override_clang
ln -s /usr/bin/clang          ~/override_clang/clang
ln -s /usr/bin/clang++        ~/override_clang/clang++
ln -s /usr/bin/llvm-config   ~/override_clang/llvm-config
ln -s /usr/bin/llvm-link      ~/override_clang/llvm-link
ln -s /usr/bin/llvm-dis       ~/override_clang/llvm-dis
sudo chmod +x ~/override_clang/*

export PATH="$HOME/override_clang/:${PATH}"
which clang
clang --version
clang-3.9 --version

which python
python --version
pip install psutil


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e
. codebuild/bin/s2n_setup_env.sh

aarch64_install() {
        echo "sslyze has a dependency on nassl, which will not build on ARM."
}

case "$ARCH" in
  "aarch64")
        aarch64_install
        exit 1
        ;;
  *)
        python3 -m pip install --user --upgrade pip setuptools
        # Version 3.0.0 introduces backwards incompatible changes in the JSON we parse.
        # TODO: unpin the sslyze version and update the json parsing sslyze output.
        python3 -m pip install --user "sslyze<3.0.0"
        sudo ln -s /root/.local/bin/sslyze /usr/bin/sslyze || true
        which sslyze
        sslyze --version
        ;;
esac


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

# Shim code to get local docker/ec2 instances bootstraped like a CodeBuild instance.
# Not actually used by CodeBuild.

source codebuild/bin/s2n_setup_env.sh

set -e

github_apt(){
  curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | gpg --dearmor -o /usr/share/keyrings/githubcli-archive-keyring.gpg
  echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list
  apt update -y
  apt install -y gh
}
get_rust() {
  apt install -y clang-10 sudo
  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
  source $HOME/.cargo/env
  rustup default nightly
}

base_packages() {
  echo "Installing repositories and base packages"
  apt update -y
  apt install -y software-properties-common
  add-apt-repository ppa:ubuntu-toolchain-r/test -y
  add-apt-repository ppa:longsleep/golang-backports -y
  apt-get update -o Acquire::CompressionTypes::Order::=gz

  DEPENDENCIES="unzip make indent iproute2 kwstyle libssl-dev net-tools tcpdump valgrind lcov m4 nettle-dev nettle-bin pkg-config psmisc gcc g++ zlibc zlib1g-dev python3-pip python3-testresources llvm curl shellcheck git tox cmake libtool ninja-build golang-go quilt jq apache2"
  if [[ -n "${GCC_VERSION:-}" ]] && [[ "${GCC_VERSION:-}" != "NONE" ]]; then
    DEPENDENCIES+=" gcc-$GCC_VERSION g++-$GCC_VERSION";
  fi
  if ! command -v python3.9 &> /dev/null; then
    add-apt-repository ppa:deadsnakes/ppa -y
    DEPENDENCIES+=" python3.9 python3.9-distutils";
  fi

  apt-get -y install --no-install-recommends ${DEPENDENCIES}
}

base_packages
github_apt
get_rust

# If prlimit is not on our current PATH, download and compile prlimit manually. s2n needs prlimit to memlock pages
if ! type prlimit > /dev/null && [[ ! -d "$PRLIMIT_INSTALL_DIR" ]]; then
    mkdir -p "$PRLIMIT_INSTALL_DIR";
    codebuild/bin/install_prlimit.sh "$(mktemp -d)" "$PRLIMIT_INSTALL_DIR";
fi

if [[ "$TESTS" == "ctverif" || "$TESTS" == "ALL" ]] && [[ ! -d "$CTVERIF_INSTALL_DIR" ]]; then
    mkdir -p "$CTVERIF_INSTALL_DIR" && codebuild/bin/install_ctverif.sh "$CTVERIF_INSTALL_DIR" > /dev/null ; fi

if [[ "$TESTS" == "sidetrail" || "$TESTS" == "ALL" ]] ; then
    codebuild/bin/install_sidetrail_dependencies.sh ; fi

if [[ "$TESTS" == "sidetrail" || "$TESTS" == "ALL" ]] && [[ ! -d "$SIDETRAIL_INSTALL_DIR" ]]; then
    mkdir -p "$SIDETRAIL_INSTALL_DIR" && codebuild/bin/install_sidetrail.sh "$SIDETRAIL_INSTALL_DIR" > /dev/null ; fi


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
	echo "install_z3_yices.sh download_dir install_dir"
	exit 1
}

if [ "$#" -ne "2" ]; then
	usage
fi

DOWNLOAD_DIR=$1
INSTALL_DIR=$2

mkdir -p "$DOWNLOAD_DIR"
cd "$DOWNLOAD_DIR"

#download z3 and yices
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/yices-2.6.1-x86_64-pc-linux-gnu-static-gmp.tar.gz --output yices.tar.gz
tar -xf yices.tar.gz

curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/z3-4.8.8-x64-ubuntu-16.04.zip --output z3.zip
unzip z3.zip

mkdir -p "$INSTALL_DIR"/bin
mv z3-4.8.8-x64-ubuntu-16.04/bin/* "$INSTALL_DIR"/bin
mv yices-2.6.1/bin/* "$INSTALL_DIR"/bin
chmod +x  "$INSTALL_DIR"/bin/*

"$INSTALL_DIR"/bin/yices-smt2 --version
"$INSTALL_DIR"/bin/yices --version
"$INSTALL_DIR"/bin/z3 --version


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

# Find if the environment has more than 8 cores
JOBS=8
if [[ -x "$(command -v nproc)" ]]; then
    UNITS=$(nproc);
    if [[ $UNITS -gt $JOBS ]]; then
        JOBS=$UNITS;
    fi
fi


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
    echo "run_cppcheck.sh install_dir"
    exit 1
}

if [ "$#" -ne "1" ]; then
    usage
fi

INSTALL_DIR=$1

CPPCHECK_EXECUTABLE=${INSTALL_DIR}/cppcheck

FAILED=0
$CPPCHECK_EXECUTABLE --version
$CPPCHECK_EXECUTABLE --std=c99 --error-exitcode=-1 --quiet --force -j 8 --enable=all --template='[{file}:{line}]: ({severity}:{id}) {message}' --inline-suppr --suppressions-list=codebuild/bin/cppcheck_suppressions.txt -I . -I ./tests api bin crypto error stuffer ./tests/unit tls utils || FAILED=1
if [ $FAILED == 1 ];
then
	printf "\\033[31;1mFAILED cppcheck\\033[0m\\n"
	exit -1
else
	printf "\\033[32;1mPASSED cppcheck\\033[0m\\n"
fi


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

usage() {
    echo "run_ctverif.sh install_dir"
    exit 1
}

if [ "$#" -ne "1" ]; then
    usage
fi

INSTALL_DIR=$1
export CTVERIF_DIR="${1}/verifying-constant-time"
SMACK_DIR="${1}/smack"

#Put the dependencies are on the path

# Disabling ShellCheck using https://github.com/koalaman/shellcheck/wiki/Directive
# Turn of Warning in one line as https://github.com/koalaman/shellcheck/wiki/SC1090
# shellcheck disable=SC1090
source "${INSTALL_DIR}/smack.environment"
export PATH="${SMACK_DIR}/bin:${SMACK_DIR}/build:${PATH}"
#Test that they are really there
which smack || echo "can't find smack"
which boogie || echo "can't find z3"
which llvm2bpl || echo "can't find llvm2bpl"

#copy the current version of the file to the test
cd "${BASE_S2N_DIR}/tests/ctverif"
cp "${BASE_S2N_DIR}/utils/s2n_safety.c" .
make clean

#run the test.  We expect both to pass, and none to fail
FAILED=0
EXPECTED_PASS=2
EXPECTED_FAIL=0
make 2>&1 | ./count_success.pl $EXPECTED_PASS $EXPECTED_FAIL || FAILED=1

if [ $FAILED == 1 ];
then
	printf "\\033[31;1mFAILED ctverif\\033[0m\\n"
	exit -1
else
	printf "\\033[32;1mPASSED ctverif\\033[0m\\n"
fi


#! /bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -eu

which KWStyle

S2N_FILES=$(find "$PWD" -type f -name "s2n_*.[ch]" | grep -v "test")
FAILED=0

for file in $S2N_FILES; do
    set +e
    ERROR_LIST=$(KWStyle -gcc -v -xml codebuild/bin/KWStyle.xml "$file")
    set -e
    if [ "$ERROR_LIST" != "" ] ;
    then
        echo "$ERROR_LIST"
        FAILED=1
    fi
done

if [ $FAILED == 1 ];
then
    printf "\\033[31;1mFAILED kwstyle\\033[0m\\n"
    exit -1
else
    printf "\\033[32;1mPASSED kwstyle\\033[0m\\n"
fi


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex

usage() {
    echo "run_sidetrail.sh install_dir s2n_dir"
    exit 1
}

runSingleTest() {
    cd "${BASE_S2N_DIR}/tests/sidetrail/working/${1}"
    ./copy_as_needed.sh
    make clean
    make 2>&1 | tee out.txt

    ../../count_success.pl 1 0 out.txt
}

runNegativeTest() {
    cd "${BASE_S2N_DIR}/tests/sidetrail/working/${1}"
    ./copy_as_needed.sh
    make clean
    make 2>&1 | tee out.txt

    ../../count_success.pl 0 1 out.txt
}

if [[ "$#" -ne "2" ]]; then
    usage
fi

INSTALL_DIR=$1
SMACK_DIR="${1}/smack"
BASE_S2N_DIR=$2

#Put the dependencies on the path

# Disabling ShellCheck using https://github.com/koalaman/shellcheck/wiki/Directive
# Turn of Warning in one line as https://github.com/koalaman/shellcheck/wiki/SC1090
# shellcheck disable=SC1090
source "${INSTALL_DIR}/smack.environment"
export PATH="${SMACK_DIR}/bin:${SMACK_DIR}/build:${PATH}"
#Test that they are really there
which smack || echo "can't find smack"
which boogie || echo "can't find z3"
which llvm2bpl || echo "can't find llvm2bpl"
which clang
clang --version
echo $BOOGIE
echo $CORRAL

runNegativeTest "s2n-record-read-cbc-negative-test"
runSingleTest "s2n-cbc" # Takes 6m 30s
runSingleTest "s2n-record-read-aead"
runSingleTest "s2n-record-read-cbc"
runSingleTest "s2n-record-read-composite"
runSingleTest "s2n-record-read-stream"


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -eu

apache2_config() {
    cert_dir="$1"
    command="$2"
    echo "apache2: ${command}"

    APACHE_SERVER_ROOT="$APACHE2_INSTALL_DIR" \
    APACHE_RUN_USER=www-data \
    APACHE_RUN_GROUP=www-data \
    APACHE_PID_FILE="${APACHE2_INSTALL_DIR}/run/apache2.pid" \
    APACHE_RUN_DIR="${APACHE2_INSTALL_DIR}/run" \
    APACHE_LOCK_DIR="${APACHE2_INSTALL_DIR}/lock" \
    APACHE_LOG_DIR="${APACHE2_INSTALL_DIR}/log" \
    APACHE_CERT_DIR="${cert_dir}" \
    apache2 -k "${command}" -f "${APACHE2_INSTALL_DIR}/apache2.conf"
}

apache2_stop() {
    cert_dir="$1"
    apache2_config "${cert_dir}" stop
}

apache2_start() {
    if [[ ! -f "$APACHE2_INSTALL_DIR/apache2.conf" ]]; then
        echo "apache2 not installed"
        exit 1
    fi

    cert_dir="$1"
    apache2_config "${cert_dir}" start

    # Stop the apache server after tests finish, even if an error occurs
    trap 'apache2_stop "${cert_dir}"' ERR EXIT
}


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

source codebuild/bin/s2n_setup_env.sh

# Use prlimit to set the memlock limit to unlimited for linux. OSX is unlimited by default
# Codebuild Containers aren't allowing prlimit changes (and aren't being caught with the usual cgroup check)
if [[ "$OS_NAME" == "linux" && -n "$CODEBUILD_BUILD_ARN" ]]; then
    PRLIMIT_LOCATION=`which prlimit`
    sudo -E ${PRLIMIT_LOCATION} --pid "$$" --memlock=unlimited:unlimited;
fi

# Set the version of GCC as Default if it's required
if [[ -n "$GCC_VERSION" ]] && [[ "$GCC_VERSION" != "NONE" ]]; then
    alias gcc=$(which gcc-$GCC_VERSION);
fi

# Find if the environment has more than 8 cores
JOBS=8
if [[ -x "$(command -v nproc)" ]]; then
    UNITS=$(nproc);
    if [[ $UNITS -gt $JOBS ]]; then
        JOBS=$UNITS;
    fi
fi

make clean;

echo "Using $JOBS jobs for make..";
echo "running with libcrypto: ${S2N_LIBCRYPTO}, gcc_version: ${GCC_VERSION}"

if [[ "$OS_NAME" == "linux" && "$TESTS" == "valgrind" ]]; then
    # For linux make a build with debug symbols and run valgrind
    # We have to output something every 9 minutes, as some test may run longer than 10 minutes
    # and will not produce any output
    while sleep 9m; do echo "=====[ $SECONDS seconds still running ]====="; done &

    if [[ "$S2N_LIBCRYPTO" == "openssl-1.1.1" || "$S2N_LIBCRYPTO" == "awslc" ]]; then
        # https://github.com/aws/s2n-tls/issues/3758
        # Run valgrind in pedantic mode (--errors-for-leak-kinds=all)
        echo "running task pedantic_valgrind"
        S2N_DEBUG=true make -j $JOBS pedantic_valgrind
    else
        S2N_DEBUG=true make -j $JOBS valgrind
    fi

    kill %1
fi

CMAKE_PQ_OPTION="S2N_NO_PQ=False"
if [[ -n "$S2N_NO_PQ" ]]; then
    CMAKE_PQ_OPTION="S2N_NO_PQ=True"
fi

test_linked_libcrypto() {
    s2n_executable="$1"
    so_path="${LIBCRYPTO_ROOT}/lib/libcrypto.so"
    echo "Testing for linked libcrypto: ${so_path}"
    echo "ldd:"
    ldd "${s2n_executable}"
    ldd "${s2n_executable}" | grep "${so_path}" || \
        { echo "Linked libcrypto is incorrect."; exit 1; }
    echo "Test succeeded!"
}

setup_apache_server() {
    # Start the apache server if the list of tests isn't defined, meaning all tests
    # are to be run, or if the renegotiate test is included in the list of tests.
    if [[ -z $TOX_TEST_NAME ]] || [[ "${TOX_TEST_NAME}" == *"test_renegotiate_apache"* ]]; then
        source codebuild/bin/s2n_apache2.sh
        APACHE_CERT_DIR="$(pwd)/tests/pems"

        apache2_start "${APACHE_CERT_DIR}"
    fi
}

run_integration_v2_tests() {
    setup_apache_server
    "$CB_BIN_DIR/install_s2n_head.sh" "$(mktemp -d)"
    cmake . -Bbuild \
            -DCMAKE_PREFIX_PATH=$LIBCRYPTO_ROOT \
            -D${CMAKE_PQ_OPTION} \
            -DS2N_BLOCK_NONPORTABLE_OPTIMIZATIONS=True \
            -DBUILD_SHARED_LIBS=on \
            -DS2N_INTEG_TESTS=on \
            -DPython3_EXECUTABLE=$(which python3)
    cmake --build ./build --clean-first -- -j $(nproc)
    test_linked_libcrypto ./build/bin/s2nc
    test_linked_libcrypto ./build/bin/s2nd
    cp -f ./build/bin/s2nc "$BASE_S2N_DIR"/bin/s2nc
    cp -f ./build/bin/s2nd "$BASE_S2N_DIR"/bin/s2nd
    cd ./build/
    for test_name in $TOX_TEST_NAME; do
      test="${test_name//test_/}"
      echo "Running... ctest --no-tests=error --output-on-failure --verbose -R ^integrationv2_${test}$"
      ctest --no-tests=error --output-on-failure --verbose -R ^integrationv2_${test}$
    done
}

run_unit_tests() {
    cmake . -Bbuild \
            -DCMAKE_PREFIX_PATH=$LIBCRYPTO_ROOT \
            -D${CMAKE_PQ_OPTION} \
            -DS2N_BLOCK_NONPORTABLE_OPTIMIZATIONS=True \
            -DBUILD_SHARED_LIBS=on \
            -DEXPERIMENTAL_TREAT_WARNINGS_AS_ERRORS=on
    cmake --build ./build -- -j $(nproc)
    test_linked_libcrypto ./build/bin/s2nc
    cmake --build build/ --target test -- ARGS="-L unit --output-on-failure -j $(nproc)"
}

# Run Multiple tests on one flag.
if [[ "$TESTS" == "ALL" || "$TESTS" == "sawHMACPlus" ]] && [[ "$OS_NAME" == "linux" ]]; then make -C tests/saw tmp/verify_HMAC.log tmp/verify_drbg.log failure-tests; fi

# Run Individual tests
if [[ "$TESTS" == "ALL" || "$TESTS" == "unit" ]]; then run_unit_tests; fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "interning" ]]; then ./codebuild/bin/test_libcrypto_interning.sh; fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "exec_leak" ]]; then ./codebuild/bin/test_exec_leak.sh; fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "asan" ]]; then make clean; S2N_ADDRESS_SANITIZER=1 make -j $JOBS ; fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "integrationv2" ]]; then run_integration_v2_tests; fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "crt" ]]; then ./codebuild/bin/build_aws_crt_cpp.sh $(mktemp -d) $(mktemp -d); fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "sharedandstatic" ]]; then ./codebuild/bin/test_install_shared_and_static.sh $(mktemp -d); fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "dynamicload" ]]; then ./codebuild/bin/test_dynamic_load.sh $(mktemp -d); fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "fuzz" ]]; then (make clean && make fuzz) ; fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "benchmark" ]]; then (make clean && make benchmark) ; fi
if [[ "$TESTS" == "sawHMAC" ]] && [[ "$OS_NAME" == "linux" ]]; then make -C tests/saw/ tmp/verify_HMAC.log ; fi
if [[ "$TESTS" == "sawDRBG" ]]; then make -C tests/saw tmp/verify_drbg.log ; fi
if [[ "$TESTS" == "ALL" || "$TESTS" == "tls" ]]; then make -C tests/saw tmp/verify_handshake.log ; fi
if [[ "$TESTS" == "sawHMACFailure" ]]; then make -C tests/saw failure-tests ; fi


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

source codebuild/bin/s2n_setup_env.sh
# Use prlimit to set the memlock limit to unlimited for linux. OSX is unlimited by default
# Codebuild Containers aren't allowing prlimit changes (and aren't being caught with the usual cgroup check)
if [[ "$OS_NAME" == "linux" && -n "$CODEBUILD_BUILD_ARN" ]]; then
    PRLIMIT_LOCATION=`which prlimit`
    sudo -E ${PRLIMIT_LOCATION} --pid "$$" --memlock=unlimited:unlimited;
fi

CMAKE_PQ_OPTION="S2N_NO_PQ=False"
if [[ -n "$S2N_NO_PQ" ]]; then
    CMAKE_PQ_OPTION="S2N_NO_PQ=True"
fi

# Linker flags are a workaround for openssl
case "$TESTS" in
  "unit") cmake . -Bbuild -DCMAKE_EXE_LINKER_FLAGS="-lcrypto -lz" -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -D${CMAKE_PQ_OPTION} -DS2N_BLOCK_NONPORTABLE_OPTIMIZATIONS=True
          cmake --build ./build -j $(nproc)
          cmake --build ./build --target test -- ARGS="-L unit --output-on-failure"
	  ;;
  *) echo "Unknown test"
     exit 1;;
esac


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -ex

source codebuild/bin/s2n_setup_env.sh

# Install missing test dependencies. If the install directory already exists, cached artifacts will be used
# for that dependency.

if [[ ! -d test-deps ]]; then
    mkdir test-deps ;
fi

#Install & Run shell check before installing dependencies
echo "Installing ShellCheck..."
codebuild/bin/install_shellcheck.sh
echo "Running ShellCheck..."
find ./codebuild -type f -name '*.sh' -exec shellcheck -Cnever -s bash {} \;

if [[ "$OS_NAME" == "linux" ]]; then
    codebuild/bin/install_ubuntu_dependencies.sh;
fi

if [[ "$OS_NAME" == "darwin" ]]; then
    codebuild/bin/install_osx_dependencies.sh;
fi

codebuild/bin/install_default_dependencies.sh

echo "Success"


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#
set -ex

# Add all of our test dependencies to the PATH. Use Openssl 1.1.1 so the latest openssl is used for s_client
# integration tests.
export PATH=$PYTHON_INSTALL_DIR/bin:$OPENSSL_1_1_1_INSTALL_DIR/bin:$GNUTLS_INSTALL_DIR/bin:$SAW_INSTALL_DIR/bin:$Z3_INSTALL_DIR/bin:$SCAN_BUILD_INSTALL_DIR/bin:$PRLIMIT_INSTALL_DIR/bin:$LATEST_CLANG_INSTALL_DIR/bin:`pwd`/codebuild/bin:~/.local/bin:$PATH
export LD_LIBRARY_PATH=$OPENSSL_1_1_1_INSTALL_DIR/lib:$LD_LIBRARY_PATH;
export DYLD_LIBRARY_PATH=$OPENSSL_1_1_1_INSTALL_DIR/lib:$LD_LIBRARY_PATH;


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

# TODO: Flag user if they didn't source this, values won't stick.

source codebuild/bin/s2n_set_build_preset.sh

# Setup Default Build Config
: "${S2N_LIBCRYPTO:=openssl-1.1.1}"
: "${BUILD_S2N:=false}"
: "${GCC_VERSION:=NONE}"
: "${LATEST_CLANG:=false}"
: "${TESTS:=unit}"
: "${S2N_COVERAGE:=false}"
: "${LD_LIBRARY_PATH:=NONE}"

# Setup the cache directory paths.
# Set Env Variables with defaults if they aren't already set
: "${BASE_S2N_DIR:=$(pwd)}"
: "${TEST_DEPS_DIR:=$BASE_S2N_DIR/test-deps}"
: "${PYTHON_INSTALL_DIR:=$TEST_DEPS_DIR/python}"
: "${GNUTLS_INSTALL_DIR:=$TEST_DEPS_DIR/gnutls}"
: "${GNUTLS37_INSTALL_DIR:=$TEST_DEPS_DIR/gnutls37}"
: "${PRLIMIT_INSTALL_DIR:=$TEST_DEPS_DIR/prlimit}"
: "${SAW_INSTALL_DIR:=$TEST_DEPS_DIR/saw}"
: "${Z3_INSTALL_DIR:=$TEST_DEPS_DIR/z3}"
: "${LIBFUZZER_INSTALL_DIR:=$TEST_DEPS_DIR/libfuzzer}"
: "${LATEST_CLANG_INSTALL_DIR:=$TEST_DEPS_DIR/clang}"
: "${SCAN_BUILD_INSTALL_DIR:=$TEST_DEPS_DIR/scan-build}"
: "${OPENSSL_0_9_8_INSTALL_DIR:=$TEST_DEPS_DIR/openssl-0.9.8}"
: "${OPENSSL_1_1_1_INSTALL_DIR:=$TEST_DEPS_DIR/openssl-1.1.1}"
: "${OPENSSL_3_0_INSTALL_DIR:=$TEST_DEPS_DIR/openssl-3.0}"
: "${OPENSSL_1_0_2_INSTALL_DIR:=$TEST_DEPS_DIR/openssl-1.0.2}"
: "${OQS_OPENSSL_1_1_1_INSTALL_DIR:=$TEST_DEPS_DIR/oqs_openssl-1.1.1}"
: "${OPENSSL_1_0_2_FIPS_INSTALL_DIR:=$TEST_DEPS_DIR/openssl-1.0.2-fips}"
: "${BORINGSSL_INSTALL_DIR:=$TEST_DEPS_DIR/boringssl}"
: "${AWSLC_INSTALL_DIR:=$TEST_DEPS_DIR/awslc}"
: "${AWSLC_FIPS_INSTALL_DIR:=$TEST_DEPS_DIR/awslc-fips}"
: "${AWSLC_FIPS_2022_INSTALL_DIR:=$TEST_DEPS_DIR/awslc-fips-2022}"
: "${LIBRESSL_INSTALL_DIR:=$TEST_DEPS_DIR/libressl}"
: "${CPPCHECK_INSTALL_DIR:=$TEST_DEPS_DIR/cppcheck}"
: "${CTVERIF_INSTALL_DIR:=$TEST_DEPS_DIR/ctverif}"
: "${SIDETRAIL_INSTALL_DIR:=$TEST_DEPS_DIR/sidetrail}"
: "${GB_INSTALL_DIR:=$TEST_DEPS_DIR/gb}"
: "${APACHE2_INSTALL_DIR:=$TEST_DEPS_DIR/apache2}"
: "${FUZZ_TIMEOUT_SEC:=10}"

# Set some environment vars for OS, Distro and architecture.
# Standardized as part of systemd http://0pointer.de/blog/projects/os-release
# Samples:
#  OS_NAME = "linux"
#  DISTRO="ubuntu"
#  VERSION_ID = "18.04"
#  VERSION_CODENAME = "bionic"
if [[ -f "/etc/os-release" ]]; then
  # AL2 doesn't provide a codename.
  . /etc/os-release
  export DISTRO=$(echo "$NAME"|tr "[:upper:]" "[:lower:]")
  export VERSION_ID=${VERSION_ID:-"unknown"}
  export VERSION_CODENAME=${VERSION_CODENAME:-"unknown"}
elif [[ -x "/usr/bin/sw_vers" ]]; then
  export DISTRO="apple"
  export VERSION_ID=$(sw_vers -productVersion|sed 's/:[[:space:]]*/=/g')
  export VERSION_CODENAME="unknown"  # not queriable via CLI
else
  export DISTRO="unknown"
  export VERSION_ID="unknown"
  export VERSION_CODENAME="unknown"
fi
export OS_NAME=$(uname -s|tr "[:upper:]" "[:lower:]")
export ARCH=$(uname -m)

# Export all Env Variables
export S2N_LIBCRYPTO
export BUILD_S2N
export GCC_VERSION
export LATEST_CLANG
export TESTS
export BASE_S2N_DIR
export TEST_DEPS_DIR
export PYTHON_INSTALL_DIR
export GNUTLS_INSTALL_DIR
export GNUTLS37_INSTALL_DIR
export PRLIMIT_INSTALL_DIR
export SAW_INSTALL_DIR
export Z3_INSTALL_DIR
export LIBFUZZER_INSTALL_DIR
export LATEST_CLANG_INSTALL_DIR
export SCAN_BUILD_INSTALL_DIR
export OPENSSL_0_9_8_INSTALL_DIR
export OPENSSL_1_1_1_INSTALL_DIR
export OPENSSL_3_0_INSTALL_DIR
export OPENSSL_1_0_2_INSTALL_DIR
export OPENSSL_1_0_2_FIPS_INSTALL_DIR
export OQS_OPENSSL_1_1_1_INSTALL_DIR
export BORINGSSL_INSTALL_DIR
export AWSLC_INSTALL_DIR
export AWSLC_FIPS_INSTALL_DIR
export AWSLC_FIPS_2022_INSTALL_DIR
export LIBRESSL_INSTALL_DIR
export CPPCHECK_INSTALL_DIR
export CTVERIF_INSTALL_DIR
export SIDETRAIL_INSTALL_DIR
export OPENSSL_1_1_X_MASTER_INSTALL_DIR
export FUZZ_TIMEOUT_SEC
export GB_INSTALL_DIR
export OS_NAME
export S2N_CORKED_IO
export S2N_NO_PQ
# For use by criterion/ci run reports
export AWS_S3_URL="s3://s2n-tls-logs/release/"

# S2N_COVERAGE should not be used with fuzz tests, use FUZZ_COVERAGE instead
if [[ "$S2N_COVERAGE" == "true" && "$TESTS" == "fuzz" ]]; then
    export S2N_COVERAGE="false"
    export FUZZ_COVERAGE="true"
fi

# Select the libcrypto to build s2n against. If this is unset, default to the latest stable version(Openssl 1.1.1)
if [[ -z $S2N_LIBCRYPTO ]]; then export LIBCRYPTO_ROOT=$OPENSSL_1_1_1_INSTALL_DIR ; fi
if [[ "$S2N_LIBCRYPTO" == "openssl-1.1.1" ]]; then export LIBCRYPTO_ROOT=$OPENSSL_1_1_1_INSTALL_DIR ; fi
if [[ "$S2N_LIBCRYPTO" == "openssl-3.0" ]]; then export LIBCRYPTO_ROOT=$OPENSSL_3_0_INSTALL_DIR ; fi
if [[ "$S2N_LIBCRYPTO" == "openssl-1.0.2" ]]; then export LIBCRYPTO_ROOT=$OPENSSL_1_0_2_INSTALL_DIR ; fi
if [[ "$S2N_LIBCRYPTO" == "openssl-1.0.2-fips" ]]; then
    export LIBCRYPTO_ROOT=$OPENSSL_1_0_2_FIPS_INSTALL_DIR ;
    export S2N_TEST_IN_FIPS_MODE=1 ;
fi
if [[ "$S2N_LIBCRYPTO" == "boringssl" ]]; then export LIBCRYPTO_ROOT=$BORINGSSL_INSTALL_DIR ; fi

if [[ "$S2N_LIBCRYPTO" == "awslc" ]]; then export LIBCRYPTO_ROOT=$AWSLC_INSTALL_DIR ; fi
if [[ "$S2N_LIBCRYPTO" == "awslc-fips" ]]; then
  export LIBCRYPTO_ROOT=$AWSLC_FIPS_INSTALL_DIR ;
  export S2N_TEST_IN_FIPS_MODE=1 ;
fi
if [[ "$S2N_LIBCRYPTO" == "awslc-fips-2022" ]]; then
  export LIBCRYPTO_ROOT=$AWSLC_FIPS_2022_INSTALL_DIR
  export S2N_TEST_IN_FIPS_MODE=1
fi

if [[ "$S2N_LIBCRYPTO" == "libressl" ]]; then export LIBCRYPTO_ROOT=$LIBRESSL_INSTALL_DIR ; fi

# Create a link to the selected libcrypto. This shouldn't be needed when LIBCRYPTO_ROOT is set, but some tests
# have the "libcrypto-root" directory path hardcoded.
rm -rf libcrypto-root && ln -s "$LIBCRYPTO_ROOT" libcrypto-root

# Set the libfuzzer to use for fuzz tests
export LIBFUZZER_ROOT=$LIBFUZZER_INSTALL_DIR

#check if the path contains test dep X, if not and X exists, add to path
path_overrides="$PYTHON_INSTALL_DIR/bin
$OPENSSL_1_1_1_INSTALL_DIR/bin
$GNUTLS_INSTALL_DIR/bin
$SAW_INSTALL_DIR/bin
$Z3_INSTALL_DIR/bin
$SCAN_BUILD_INSTALL_DIR/bin
$PRLIMIT_INSTALL_DIR/bin
$LATEST_CLANG_INSTALL_DIR/bin
`pwd`/codebuild/bin
~/.local/bin"

testdeps_path(){
    echo -ne "checking $1 is in the path..."
    if [[ ! "$PATH" =~ "$1" ]]; then
        if [[ -d "$1" ]]; then
            export PATH="$1:$PATH"
            echo -e "added"
        else
            echo -e "doesn't exist"
        fi
    else
        echo -e "already in path"
    fi
}

for i in $path_overrides; do testdeps_path "$i" ;done

# Just recording in the output for debugging.
if [ -f "/etc/lsb-release" ]; then
  cat /etc/lsb-release
fi

# Translate our custom variables into full paths to the compiler.
set_cc(){
  if [ -z ${GCC_VERSION:-} -o ${GCC_VERSION} = "NONE" ]; then
    echo "No GCC_VERSION set"
    if [ ${LATEST_CLANG:-} = "true" ]; then
      echo "LATEST_CLANG is ${LATEST_CLANG}"
      if [ -d ${LATEST_CLANG_INSTALL_DIR:-} ]; then
        export CC=${LATEST_CLANG_INSTALL_DIR}/bin/clang
        export CXX=${LATEST_CLANG_INSTALL_DIR}/bin/clang++
        echo "CC set to ${CC}"
        echo "CXX set to ${CXX}"
      else
        echo "Could not find a clang installation $LATEST_CLANG_INSTALL_DIR"
      fi
    fi
  else
    echo "GCC_VERSION is ${GCC_VERSION}"
    export CC=$(which gcc-${GCC_VERSION})
    export CXX=$(which g++-${GCC_VERSION})
    echo "CC set to ${CC}"
    echo "CXX set to ${CXX}"
  fi
}
set_cc

echo "UID=$UID"
echo "OS_NAME=$OS_NAME"
echo "S2N_LIBCRYPTO=$S2N_LIBCRYPTO"
echo "LIBCRYPTO_ROOT=$LIBCRYPTO_ROOT"
echo "BUILD_S2N=$BUILD_S2N"
echo "GCC_VERSION=$GCC_VERSION"
echo "LATEST_CLANG=$LATEST_CLANG"
echo "TESTS=$TESTS"
echo "PATH=$PATH"
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH"


#!/bin/bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.

case "${S2N_BUILD_PRESET-default}" in
    "awslc_gcc4-8")
        : "${S2N_LIBCRYPTO:=awslc}"
        : "${GCC_VERSION:=4.8}"
        ;;
    "awslc_gcc9")
        : "${S2N_LIBCRYPTO:=awslc}"
        : "${GCC_VERSION:=9}"
        ;;
    "awslc-fips_gcc4-8")
        : "${S2N_LIBCRYPTO:=awslc-fips}"
        : "${GCC_VERSION:=4.8}"
        ;;
    "awslc-fips_gcc9")
        : "${S2N_LIBCRYPTO:=awslc-fips}"
        : "${GCC_VERSION:=9}"
        ;;
    "awslc-fips-2022_gcc6")
        : "${S2N_LIBCRYPTO:=awslc-fips-2022}"
        : "${GCC_VERSION:=6}"
        ;;
    "libressl_gcc6")
        : "${S2N_LIBCRYPTO:=libressl}"
        : "${GCC_VERSION:=6}"
        ;;
    "libressl_gcc9")
        : "${S2N_LIBCRYPTO:=libressl}"
        : "${GCC_VERSION:=9}"
        ;;
    "boringssl")
        : "${S2N_LIBCRYPTO:=boringssl}"
        : "${GCC_VERSION:=9}"
        ;;
    "openssl-1.0.2")
        : "${S2N_LIBCRYPTO:=openssl-1.0.2}"
        : "${GCC_VERSION:=6}"
        ;;
    "openssl-1.0.2-fips")
        : "${S2N_LIBCRYPTO:=openssl-1.0.2-fips}"
        : "${GCC_VERSION:=6}"
        ;;
    "openssl-1.1.1_gcc4-8")
        : "${S2N_LIBCRYPTO:=openssl-1.1.1}"
        : "${GCC_VERSION:=4.8}"
        ;;
    "openssl-1.1.1_gcc6")
        : "${S2N_LIBCRYPTO:=openssl-1.1.1}"
        : "${GCC_VERSION:=6}"
        : "${S2N_CORKED_IO:=true}"
        ;;
    "openssl-1.1.1_gcc6_softcrypto")
        : "${S2N_LIBCRYPTO:=openssl-1.1.1}"
        : "${GCC_VERSION:=6}"
        : "${OPENSSL_ia32cap:=~0x200000200000000}"
        ;;
    "openssl-1.1.1_gcc9")
        : "${S2N_LIBCRYPTO:=openssl-1.1.1}"
        : "${GCC_VERSION:=9}"
        ;;
    "openssl-3.0")
        : "${S2N_LIBCRYPTO:=openssl-3.0}"
        : "${GCC_VERSION:=9}"
        ;;
esac


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

# This script compiles s2n-tls as a shared library and compiles a test
# without linking to the library. This enables us to test behavior when
# s2n-tls is dynamically loaded.

WORK_DIR=$1

if [ ! -z "$NIX_STORE" ]; then
    OPENSSL=$(which openssl)
    LIBCRYPTO_ROOT=$(nix-store --query $OPENSSL)
else
    source codebuild/bin/s2n_setup_env.sh
fi

S2N_BUILD_ARGS=(-H. -DCMAKE_PREFIX_PATH=$LIBCRYPTO_ROOT -DBUILD_TESTING=OFF)

# create installation dir with libs2n.so
if [ ! -d $WORK_DIR/s2n-install-shared ]; then
    (set -x; cmake -B$WORK_DIR/s2n-build-shared -DCMAKE_INSTALL_PREFIX=$WORK_DIR/s2n-install-shared -DBUILD_SHARED_LIBS=ON ${S2N_BUILD_ARGS[@]})
    (set -x; cmake --build $WORK_DIR/s2n-build-shared --target install -- -j $(nproc))
fi

# Compile the test file
$CC -Wl,-rpath $LIBCRYPTO_ROOT -o s2n_dynamic_load_test codebuild/bin/s2n_dynamic_load_test.c -ldl -lpthread

LDD_OUTPUT=$(ldd s2n_dynamic_load_test)

# Confirm executable doesn't have libs2n.so loaded
if echo "$LDD_OUTPUT" | grep -q libs2n; then
    echo "test failure: libs2n should not appear in ldd output"
    exit 1
fi

# Run the test with the path to libs2n
echo "Running s2n_dynamic_load_test"
LD_LIBRARY_PATH=$LIBCRYPTO_ROOT/lib ./s2n_dynamic_load_test $WORK_DIR/s2n-install-shared/lib/libs2n.so
returncode=$?
if [ $returncode -ne 0 ]; then
    echo "test failure: s2n_dynamic_load_test did not succeed"
    exit 1
fi
echo "Passed s2n_dynamic_load_test"


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

# Test that all file descriptors are properly cleaned up when `exec`ing from
# from an initialized s2n-tls process.

source codebuild/bin/s2n_setup_env.sh
source codebuild/bin/jobs.sh

function build() {
  echo "=== BUILDING $1 ==="
  cmake . -B$1 -DCMAKE_PREFIX_PATH=$TARGET_LIBCRYPTO_PATH ${@:2}
  cmake --build $1 -- -j $JOBS
}

function fail() {
    echo "test failure: $1"
    exit 1
}

function write_exec_app() {
cat <<EOF > build/detect_exec_leak.c
#include <s2n.h>
#include "unistd.h"

int main() {
    s2n_init();
    execl("build/bin/detect_exec_leak_finish", "", NULL);
    return 0;
}
EOF
}

function write_exec_finish_app() {
cat <<EOF > build/detect_exec_leak_finish.c
#include <s2n.h>

int main() {
    s2n_init();
    s2n_cleanup();

    /* close std* file descriptors so valgrind output is less noisy */
    fclose(stdin);
    fclose(stdout);
    fclose(stderr);
    return 0;
}
EOF
}

# download libcrypto if its not available
TARGET_LIBCRYPTO="${S2N_LIBCRYPTO//[-.]/_}"
TARGET_LIBCRYPTO_PATH="${TEST_DEPS_DIR}/${S2N_LIBCRYPTO}"
if [ ! -f $TARGET_LIBCRYPTO_PATH/lib/libcrypto.a ]; then
    ./codebuild/bin/install_${TARGET_LIBCRYPTO}.sh $TARGET_LIBCRYPTO_PATH/src $TARGET_LIBCRYPTO_PATH linux
fi

# build s2n-tls
build build -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on

# compile the test app for exec leak test
mkdir -p build/valgrind_log_dir
write_exec_app
write_exec_finish_app
cc -Iapi build/detect_exec_leak.c build/lib/libs2n.so -o build/bin/detect_exec_leak
cc -Iapi build/detect_exec_leak_finish.c build/lib/libs2n.so -o build/bin/detect_exec_leak_finish

# run valgrind with track-fds enabled
valgrind_log_dir=valgrind_log_dir
for test_file in detect_exec_leak detect_exec_leak_finish; do
    LD_LIBRARY_PATH="build/lib:$TARGET_LIBCRYPTO_PATH/lib:$LD_LIBRARY_PATH" S2N_VALGRIND=1 \
        valgrind --leak-check=full --show-leak-kinds=all --errors-for-leak-kinds=all \
        --run-libc-freeres=yes -q --gen-suppressions=all --track-fds=yes \
        --leak-resolution=high --undef-value-errors=no --trace-children=yes \
        --suppressions=tests/unit/valgrind.suppressions --log-file="build/$valgrind_log_dir/$test_file" \
    	  build/bin/$test_file

    # search for all leaked file descriptors, excluding the valgrind_log_dir file
    cat build/$valgrind_log_dir/$test_file | \
        grep "Open file descriptor" | \
        grep --invert-match $valgrind_log_dir \
        && fail "file leak detected while running $test_file"
done

echo pass


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#
set -eo pipefail

usage() {
    echo "test_install_shared_and_static.sh build_dir"
    echo "Checks that installed s2n-config.cmake chooses appropriately between shared and static."
    echo "Note that you MUST build against the version of libcrypto that's actually installed on the system,"
    echo "because installing libs2n.so forces it to use the system's libcrypto.so."
    exit 1
}

if [ "$#" -ne 1 ]; then
    usage
fi

WORK_DIR=$1

source codebuild/bin/s2n_setup_env.sh
source codebuild/bin/jobs.sh

COMMON_S2N_BUILD_ARGS=(-H. -DCMAKE_PREFIX_PATH=$LIBCRYPTO_ROOT -DBUILD_TESTING=OFF)

# create installation dir with libs2n.so
if [ ! -d $WORK_DIR/s2n-install-shared ]; then
    (set -x; cmake -B$WORK_DIR/s2n-build-shared -DCMAKE_INSTALL_PREFIX=$WORK_DIR/s2n-install-shared -DBUILD_SHARED_LIBS=ON ${COMMON_S2N_BUILD_ARGS[@]})
    (set -x; cmake --build $WORK_DIR/s2n-build-shared --target install -- -j $JOBS)
fi

# create installation dir with libs2n.a
if [ ! -d $WORK_DIR/s2n-install-static ]; then
    (set -x; cmake -B$WORK_DIR/s2n-build-static -DCMAKE_INSTALL_PREFIX=$WORK_DIR/s2n-install-static -DBUILD_SHARED_LIBS=OFF ${COMMON_S2N_BUILD_ARGS[@]})
    (set -x; cmake --build $WORK_DIR/s2n-build-static --target install -- -j $JOBS)
fi

# create installation dir with both libs2n.so and libs2n.a
if [ ! -d $WORK_DIR/s2n-install-both ]; then
    (set -x; cmake -B$WORK_DIR/s2n-build-shared-both -DCMAKE_INSTALL_PREFIX=$WORK_DIR/s2n-install-both -DBUILD_SHARED_LIBS=ON ${COMMON_S2N_BUILD_ARGS[@]})
    (set -x; cmake --build $WORK_DIR/s2n-build-shared-both --target install -- -j $JOBS)

    (set -x; cmake -B$WORK_DIR/s2n-build-static-both -DCMAKE_INSTALL_PREFIX=$WORK_DIR/s2n-install-both -DBUILD_SHARED_LIBS=OFF  ${COMMON_S2N_BUILD_ARGS[@]})
    (set -x; cmake --build $WORK_DIR/s2n-build-static-both --target install -- -j $JOBS)
fi

# write out source of a small cmake project, containing:
# - mylib: a library that uses s2n
# - myapp: executable that uses mylib
rm -rf $WORK_DIR/myapp-src
mkdir -p $WORK_DIR/myapp-src

cat <<EOF > $WORK_DIR/myapp-src/mylib.c
extern int s2n_init(void);

void mylib_init(void) {
    s2n_init();
}
EOF

cat <<EOF > $WORK_DIR/myapp-src/myapp.c
extern void mylib_init(void);

int main() {
    mylib_init();
}
EOF

cat <<EOF > $WORK_DIR/myapp-src/CMakeLists.txt
cmake_minimum_required (VERSION 3.0)
project (myapp C)

add_library(mylib mylib.c)
find_package(s2n REQUIRED)
target_link_libraries(mylib PRIVATE AWS::s2n)

add_executable(myapp myapp.c)
target_link_libraries(myapp PRIVATE mylib)
EOF

# build myapp and mylib, confirm that expected type of libs2n is used
build_myapp() {
    local BUILD_SHARED_LIBS=$1 # ("BUILD_SHARED_LIBS=ON" or "BUILD_SHARED_LIBS=OFF")
    local S2N_INSTALL_DIR=$2 # which s2n-install dir should be used
    local LIBS2N_EXPECTED=$3 # ("libs2n.so" or "libs2n.a") which type of libs2n is expected to be used

    echo "---------------------------------------------------------------------"
    echo "building myapp with $BUILD_SHARED_LIBS looking-in:$S2N_INSTALL_DIR should-use:$LIBS2N_EXPECTED"

    local MYAPP_BUILD_DIR=$WORK_DIR/myapp-build
    rm -rf $MYAPP_BUILD_DIR/

    local S2N_INSTALL_PATH=$(realpath $WORK_DIR/$S2N_INSTALL_DIR)

    (set -x; cmake -H$WORK_DIR/myapp-src -B$MYAPP_BUILD_DIR -D$BUILD_SHARED_LIBS "-DCMAKE_PREFIX_PATH=$S2N_INSTALL_PATH;$LIBCRYPTO_ROOT")
    (set -x; cmake --build $MYAPP_BUILD_DIR)

    LDD_OUTPUT=$(ldd $MYAPP_BUILD_DIR/myapp)
    echo "$LDD_OUTPUT"

    if echo "$LDD_OUTPUT" | grep -q libs2n.so; then
        local LIBS2N_ACTUAL=libs2n.so
    else
        local LIBS2N_ACTUAL=libs2n.a
    fi

    if [ $LIBS2N_ACTUAL != $LIBS2N_EXPECTED ]; then
        echo "test failure: used $LIBS2N_ACTUAL, but expected to use $LIBS2N_EXPECTED"
        exit 1
    fi
}

# if only shared libs2n.so is available, that's what should get used
build_myapp BUILD_SHARED_LIBS=ON s2n-install-shared libs2n.so
build_myapp BUILD_SHARED_LIBS=OFF s2n-install-shared libs2n.so

# if only static libs2n.a is available, that's what should get used
build_myapp BUILD_SHARED_LIBS=ON s2n-install-static libs2n.a
build_myapp BUILD_SHARED_LIBS=OFF s2n-install-static libs2n.a

# if both libs2n.so and libs2n.a are available...
build_myapp BUILD_SHARED_LIBS=ON s2n-install-both libs2n.so # should choose libs2n.so
build_myapp BUILD_SHARED_LIBS=OFF s2n-install-both libs2n.a # should choose libs2n.a


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

set -e

source codebuild/bin/s2n_setup_env.sh
source codebuild/bin/jobs.sh

# build 2 different version of libcrypto to make it easy to break the application if
# interning doesn't work as expected
WHICH_LIBCRYPTO=$(echo "${S2N_LIBCRYPTO:-"openssl-1.1.1"}")
TARGET_LIBCRYPTO="${WHICH_LIBCRYPTO//[-.]/_}"
TARGET_LIBCRYPTO_PATH="${TEST_DEPS_DIR}/${WHICH_LIBCRYPTO}"
OPENSSL_1_0="$OPENSSL_1_0_2_INSTALL_DIR"
if [ ! -f $OPENSSL_1_0/lib/libcrypto.a ]; then
  ./codebuild/bin/install_openssl_1_0_2.sh $OPENSSL_1_0/src $OPENSSL_1_0 linux
fi
if [ ! -f $TARGET_LIBCRYPTO_PATH/lib/libcrypto.a ]; then
  if [ "$TARGET_LIBCRYPTO" == "awslc" ]; then
    ./codebuild/bin/install_${TARGET_LIBCRYPTO}.sh $TARGET_LIBCRYPTO_PATH/src $TARGET_LIBCRYPTO_PATH 0
  else
    ./codebuild/bin/install_${TARGET_LIBCRYPTO}.sh $TARGET_LIBCRYPTO_PATH/src $TARGET_LIBCRYPTO_PATH linux
  fi
fi

COMMON_FLAGS="-DCMAKE_PREFIX_PATH=$TARGET_LIBCRYPTO_PATH -DCMAKE_BUILD_TYPE=RelWithDebInfo"
LTO_FLAGS="-DS2N_LTO=on"

# use LTO-aware commands if possible
if [ -x "$(command -v gcc-ar)" ]; then
  LTO_FLAGS+=" -DCMAKE_AR=$(which gcc-ar) -DCMAKE_NM=$(which gcc-nm) -DCMAKE_RANLIB=$(which gcc-ranlib)"
fi

function fail() {
    echo "test failure: $1"
    exit 1
}

function write_app() {
cat <<EOF > $1
#include <s2n.h>
#include <openssl/bn.h>

int main() {
    s2n_init();
    BN_CTX_new();
    return 0;
}
EOF
}

function build() {
  echo "=== BUILDING $1 ==="
  cmake . -B$1 $COMMON_FLAGS ${@:2}
  cmake --build $1 -- -j $JOBS
}

function tests() {
  echo "=== TESTING $1 ==="
  make -C $1 test ARGS="-j $JOBS -L unit"
}

##################
# Dynamic builds #
##################

# build a default version to test what happens without interning
build build/shared-default -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
ldd ./build/shared-default/lib/libs2n.so | grep -q libcrypto || fail "shared-default: libcrypto was not linked"

# ensure libcrypto interning works with shared libs and no testing
build build/shared -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=off -DS2N_INTERN_LIBCRYPTO=on
# s2n should not publicly depend on libcrypto
ldd ./build/shared/lib/libs2n.so | grep -q libcrypto && fail "shared: libcrypto was not interned"

# ensure libcrypto interning works with shared libs, LTO and no testing
# NOTE: interning+LTO+testing doesn't currently work
build build/shared-lto -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=off -DS2N_INTERN_LIBCRYPTO=on $LTO_FLAGS
# s2n should not publicly depend on libcrypto
ldd ./build/shared-lto/lib/libs2n.so | grep -q libcrypto && fail "shared-lto: libcrypto was not interned"

# ensure libcrypto interning works with shared libs and testing
build build/shared-testing -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on -DS2N_INTERN_LIBCRYPTO=on
# s2n should not publicly depend on libcrypto
ldd ./build/shared-testing/lib/libs2n.so | grep -q libcrypto && fail "shared-testing: libcrypto was not interned"
# run the tests and make sure they all pass with the prefixed version
tests build/shared-testing
# load the wrong version of libcrypto and the tests should still pass
LD_PRELOAD=$OPENSSL_1_0/lib/libcrypto.so tests build/shared-testing

# ensure the small app will compile with both versions of openssl without any linking issues
for build in shared shared-lto; do
  # create a small app that links against both s2n and libcrypto
  write_app build/$build/app.c

  for target in $OPENSSL_1_0 $TARGET_LIBCRYPTO_PATH; do
    echo "testing $build linking with $target"
    mkdir -p $target/bin
    cc -fPIE -Iapi -I$target/include build/$build/app.c build/$build/lib/libs2n.so $target/lib/libcrypto.a -lpthread -ldl -o $target/bin/test-app
    # make sure the app doesn't crash
    LD_LIBRARY_PATH="build/$build/lib:$target/lib:$LD_LIBRARY_PATH" $target/bin/test-app
  done
done

##################
# Static builds  #
##################

# ensure libcrypto interning works with static libs
# NOTE: static builds don't vary based on testing being enabled
build build/static -DBUILD_SHARED_LIBS=off -DBUILD_TESTING=on -DS2N_INTERN_LIBCRYPTO=on
tests build/static

# TODO figure out how to get static-lto+interning builds working

# ensure the small app will compile with both versions of openssl without any linking issues
for build in static; do
  # create a small app that links against both s2n and libcrypto
  write_app build/$build/app.c

  for target in $OPENSSL_1_0 $TARGET_LIBCRYPTO_PATH; do
    echo "testing $build linking with $target"
    mkdir -p $target/bin
    cc -fPIE -Iapi -I$target/include build/$build/app.c build/$build/lib/libs2n.a $target/lib/libcrypto.a -lpthread -ldl -o $target/bin/test-app
    nm $target/bin/test-app | grep -q 'T s2n$BN_CTX_new' || fail "$target: libcrypto symbols were not prefixed"
    nm $target/bin/test-app | grep -q 'T BN_CTX_new' || fail "$target: libcrypto was not linked in application"
    # make sure the app doesn't crash
    $target/bin/test-app
  done
done

##################
# Runtime tests  #
##################

run_connection_test() {
    local TARGET="$1"
    LD_PRELOAD=$OPENSSL_1_0/lib/libcrypto.so ./build/$TARGET/bin/s2nd -c default_tls13 localhost 4433 &> /dev/null &
    local SERVER_PID=$!
    LD_PRELOAD=$OPENSSL_1_0/lib/libcrypto.so ./build/$TARGET/bin/s2nc -i -c default_tls13 localhost 4433 | tee build/client.log
    kill $SERVER_PID &> /dev/null || true

    # ensure a TLS 1.3 session was negotiated
    echo "checking for TLS 1.3"
    grep -q "Actual protocol version: 34" build/client.log
}

# without interning, the connection should fail when linking the wrong version of libcrypto
echo "running pair: TLS 1.3 failure expected"
run_connection_test shared-default && fail "TLS 1.3 handshake was expected to fail"

# with interning, the connection should succeed even though we've linked the wrong version of libcrypto
echo "running pair: TLS 1.3 success expected"
run_connection_test shared-testing || fail "TLS 1.3 handshake was expected to succeed"

echo "SUCCESS!"


#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#  http://aws.amazon.com/apache2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#
set -e

# Utility functions
get_latest_release(){
    local LATEST_RELEASE_URL=$(gh api /repos/aws/s2n-tls/releases/latest|jq -r '.tarball_url')
    local LATEST_RELEASE_VER=$(echo "${LATEST_RELEASE_URL}" | sed 's|.*/||')
    echo "${LATEST_RELEASE_VER}"
}

gh_login(){
    # Takes secrets manager key as an argument
    # This GH personal access token must have 'repo' permissions to work.
    gh auth status || aws secretsmanager get-secret-value --secret-id "$1" --query 'SecretString' --output text |jq -r '.secret_key'| gh auth login --with-token

    #gh auth status
}

criterion_install_deps(){
    make install
    source "$HOME"/.cargo/env
    make -C bindings/rust
}

usage(){
    echo -e "Usage:\n\tget_latest_release: returns just the latest v.N.N.N version"
    echo -e "\tgh_login <Secret Name> : retrieves a GitHub PAT from secrest manager and logs into GitHub.\n"
}

if [[ "${BASH_SOURCE[0]}" == "${0}"  ]]; then
    case "${1:-}" in
        "gh_login")
            gh_login "${2:-}";;
        "get_latest_release")
            get_latest_release
            echo "$LATEST_RELEASE_VER";;
        *)  usage;
    esac
fi


#/usr/bin/env bash

set -e

TOPLEVEL=$(git rev-parse --show-toplevel)

BLOB=${1:-main}

pushd $TOPLEVEL > /dev/null

duvet \
  report \
  --spec-pattern 'compliance/specs/**/*.toml' \
  --source-pattern '(*=,*#)api/**/*.[ch]' \
  --source-pattern '(*=,*#)bin/**/*.[ch]' \
  --source-pattern '(*=,*#)crypto/**/*.[ch]' \
  --source-pattern '(*=,*#)error/**/*.[ch]' \
  --source-pattern '(*=,*#)pq-crypto/**/*.[ch]' \
  --source-pattern '(*=,*#)stuffer/**/*.[ch]' \
  --source-pattern '(*=,*#)tests/**/*.[ch]' \
  --source-pattern '(*=,*#)tls/**/*.[ch]' \
  --source-pattern '(*=,*#)utils/**/*.[ch]' \
  --require-tests false \
  --blob-link "https://github.com/aws/s2n/blob/$BLOB" \
  --issue-link 'https://github.com/aws/s2n/issues' \
  --no-cargo \
  --html compliance/report.html

echo "report available in compliance/report.html"

popd > /dev/null


#/usr/bin/env bash

duvet extract https://tools.ietf.org/rfc/rfc5869 # HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
duvet extract https://tools.ietf.org/rfc/rfc8446 # The Transport Layer Security (TLS) Protocol Version 1.3
duvet extract https://tools.ietf.org/rfc/rfc8448 # Example Handshake Traces for TLS 1.3
duvet extract https://tools.ietf.org/rfc/rfc7627 # Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension
duvet extract https://tools.ietf.org/rfc/rfc5746 # Transport Layer Security (TLS) Renegotiation Indication Extension
duvet extract https://tools.ietf.org/rfc/rfc4492 # Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)