50 lines
2.4 KiB
Python
50 lines
2.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Compile the entire production diagnostic module with deterministic public-API fakes.
|
|
|
|
No TLS, network, scheduler, hardware or real heap/stack measurement is simulated.
|
|
Lock assertions and injected interleavings test the bounded publication contract.
|
|
"""
|
|
import os
|
|
from pathlib import Path
|
|
import re
|
|
import subprocess
|
|
import tempfile
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
HERE = Path(__file__).resolve().parent
|
|
|
|
def without_includes(path):
|
|
return '\n'.join(line for line in path.read_text().splitlines()
|
|
if not line.startswith(('#include', '#pragma once')))
|
|
|
|
server = (ROOT / 'src/web_server.c').read_text()
|
|
wrappers = []
|
|
for name in ('traced_ticket_handler', 'traced_websocket_handler',
|
|
'traced_admin_ticket_handler', 'traced_admin_upgrade_handler'):
|
|
match = re.search(r'static esp_err_t ' + name + r'\(httpd_req_t \*request\)\n\{.*?\n\}', server, re.S)
|
|
assert match, name
|
|
wrappers.append(match.group())
|
|
# Diagnostics itself must remain observation-only. The server composes the
|
|
# independent, always-on idle policy before diagnostic publication.
|
|
assert 'config.user_cb = tls_session_callback;' in server
|
|
assert 'web_httpd_idle_tls(arg);\n web_diagnostics_tls(arg);' in server
|
|
assert 'config.httpd.close_fn' not in server and 'config.httpd.open_fn' not in server
|
|
source = (ROOT / 'src/web_diagnostics.c').read_text()
|
|
for forbidden in ('httpd_queue_work', 'httpd_get_client_list', 'esp_event_handler_register',
|
|
'httpd_req_get_', 'request->uri', 'request->user_ctx', 'request->sess_ctx',
|
|
'malloc(', 'calloc(', 'xTaskCreate', 'ESP_LOG', 'esp_log_level_set'):
|
|
assert forbidden not in source, forbidden
|
|
|
|
with tempfile.TemporaryDirectory(prefix='web-diagnostics-') as directory:
|
|
directory = Path(directory)
|
|
unit = directory / 'test.c'
|
|
unit.write_text((HERE / 'fakes.h').read_text() + '\n' +
|
|
without_includes(ROOT / 'src/web_diagnostics.h') + '\n' +
|
|
without_includes(ROOT / 'src/web_diagnostics.c') + '\n' +
|
|
'\n'.join(wrappers) + '\n' + (HERE / 'test.c').read_text())
|
|
executable = directory / 'test'
|
|
subprocess.run([os.environ.get('CC', 'cc'), '-std=c11', '-Wall', '-Wextra', '-Werror',
|
|
str(unit), '-o', str(executable)], check=True)
|
|
subprocess.run([str(executable)], check=True)
|
|
print('PASS: production integration/secrecy source guards (1 group)')
|