Add CodeQL workflow for GitHub code scanning

.github/codeql-config.yml

@@ -0,0 +1,4 @@
+name: "S2N CodeQL Config"
+
+paths-ignore:
+  - tests/integration

.github/workflows/codeql.yml

@@ -0,0 +1,48 @@
+name: "CodeQL - Python"
+
+on:
+  push:
+    branches: [ "main" ]
+    paths-ignore:
+      - '**/tests/integration/*'
+  pull_request:
+    branches: [ "main" ]
+    paths-ignore:
+      - '**/tests/integration/*'
+  schedule:
+    - cron: "1 18 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Disabling c analysis (for now) as this takes ~2 hours to complete
+        language: [ python ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-and-quality
+          config-file: ./.github/codeql-config.yml
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+        if: ${{ matrix.language == 'c' || matrix.language == 'python' }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{ matrix.language }}"

scripts/s2n_safety_macros.py

@@ -739,9 +739,8 @@ def cleanup(contents):
 
 def write(f, contents):
     contents = cleanup(contents)
-    header_file = open(f, "w")
-    header_file.write(contents)
-    header_file.close()
+    with open(f, "w") as header_file:
+        header_file.write(contents)
 
 write("utils/s2n_safety_macros.h", header)
 

tests/integrationv2/common.py

@@ -1,7 +1,6 @@
 import os
 import re
 import subprocess
-import string
 import threading
 import itertools
 

tests/integrationv2/configuration.py

@@ -2,7 +2,7 @@
 
 from common import Certificates, Ciphers, Curves, Protocols, AvailablePorts
 from constants import TEST_SNI_CERT_DIRECTORY
-from providers import S2N, OpenSSL, BoringSSL, JavaSSL
+from providers import S2N, OpenSSL, JavaSSL
 
 
 # The boolean configuration will let a test run for True and False

tests/integrationv2/conftest.py

@@ -1,4 +1,3 @@
-import pytest
 from global_flags import set_flag, S2N_PROVIDER_VERSION, S2N_FIPS_MODE, S2N_NO_PQ
 
 

tests/integrationv2/fixtures.py

@@ -1,12 +1,10 @@
 import os
 import pytest
 import subprocess
-import threading
-import time
 
 from processes import ManagedProcess
 from providers import Provider
-from common import ProviderOptions, Protocols
+from common import ProviderOptions 
 
 
 @pytest.fixture

tests/integrationv2/processes.py

@@ -1,4 +1,3 @@
-import time
 import os
 import select
 import selectors

tests/integrationv2/providers.py

@@ -1,7 +1,7 @@
 import pytest
 import threading
 
-from common import ProviderOptions, Ciphers, Curves, Protocols, Certificates, Signatures
+from common import ProviderOptions, Ciphers, Curves, Protocols, Signatures
 from global_flags import get_flag, S2N_PROVIDER_VERSION, S2N_FIPS_MODE
 
 
@@ -47,9 +47,9 @@ def __init__(self, options: ProviderOptions):
 
         self.options = options
         if self.options.mode == Provider.ServerMode:
-            self.cmd_line = self.setup_server()
+            self.cmd_line = self.setup_server() # lgtm [py/init-calls-subclass]
         elif self.options.mode == Provider.ClientMode:
-            self.cmd_line = self.setup_client()
+            self.cmd_line = self.setup_client() # lgtm [py/init-calls-subclass]
 
     def setup_client(self):
         """
@@ -141,7 +141,7 @@ class S2N(Provider):
     def __init__(self, options: ProviderOptions):
         Provider.__init__(self, options)
 
-        self.send_with_newline = True
+        self.send_with_newline = True # lgtm [py/overwritten-inherited-attribute]
 
     @classmethod
     def get_send_marker(cls):
@@ -315,7 +315,7 @@ class OpenSSL(Provider):
     def __init__(self, options: ProviderOptions):
         Provider.__init__(self, options)
         # We print some OpenSSL logging that includes stderr
-        self.expect_stderr = True
+        self.expect_stderr = True # lgtm [py/overwritten-inherited-attribute]
 
     @classmethod
     def get_send_marker(cls):
@@ -623,8 +623,8 @@ class GnuTLS(Provider):
     def __init__(self, options: ProviderOptions):
         Provider.__init__(self, options)
 
-        self.expect_stderr = True
-        self.send_with_newline = True
+        self.expect_stderr = True # lgtm [py/overwritten-inherited-attribute]
+        self.send_with_newline = True # lgtm [py/overwritten-inherited-attribute]
 
     @staticmethod
     def cipher_to_priority_str(cipher):

tests/integrationv2/test_client_authentication.py

@@ -1,12 +1,9 @@
 import copy
-import os
 import pytest
-import time
 
-from configuration import (available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES,
-                           ALL_TEST_CERTS, PROTOCOLS)
+from configuration import (available_ports, ALL_TEST_CIPHERS, PROTOCOLS)
 from common import Certificates, ProviderOptions, Protocols, data_bytes
-from fixtures import managed_process
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL
 from utils import invalid_test_parameters, get_parameter_name, get_expected_s2n_version, to_bytes
 

tests/integrationv2/test_cross_compatibility.py

@@ -2,9 +2,9 @@
 import copy
 import os
 
-from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS, PROTOCOLS
+from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS 
 from common import ProviderOptions, Protocols, data_bytes
-from fixtures import managed_process
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL
 from utils import invalid_test_parameters, get_parameter_name, to_bytes
 

tests/integrationv2/test_dynamic_record_sizes.py

@@ -1,12 +1,9 @@
 import copy
-import os
 import pytest
-import subprocess
-import time
 
-from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS, PROVIDERS, PROTOCOLS
-from common import ProviderOptions, data_bytes, Protocols
-from fixtures import managed_process, custom_mtu
+from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS, PROTOCOLS
+from common import ProviderOptions, data_bytes 
+from fixtures import custom_mtu, managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL, Tcpdump
 from utils import invalid_test_parameters, get_parameter_name, get_expected_s2n_version, to_bytes
 

tests/integrationv2/test_early_data.py

@@ -1,13 +1,10 @@
 import copy
 import os
 import pytest
-import time
-from enum import Enum
-from collections import namedtuple
 
-from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS, PROTOCOLS, TLS13_CIPHERS
+from configuration import available_ports, ALL_TEST_CURVES, ALL_TEST_CERTS, TLS13_CIPHERS
 from common import ProviderOptions, Protocols, Curves, data_bytes
-from fixtures import managed_process
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N as S2NBase, OpenSSL as OpenSSLBase
 from utils import invalid_test_parameters, get_parameter_name, to_bytes
 
@@ -338,7 +335,7 @@ def test_s2n_server_with_early_data_rejected(managed_process, tmp_path, cipher,
                                              other_provider, early_data_size):
     ticket_file = str(tmp_path / TICKET_FILE)
     early_data_file = str(tmp_path / EARLY_DATA_FILE)
-    early_data = get_early_data_bytes(early_data_file, early_data_size)
+    get_early_data_bytes(early_data_file, early_data_size)
 
     options = ProviderOptions(
         port=next(available_ports),

tests/integrationv2/test_external_psk.py

@@ -1,10 +1,9 @@
-import copy
 import pytest
 
 from configuration import available_ports, TLS13_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS
 from common import ProviderOptions, Protocols, data_bytes
-from fixtures import managed_process
-from providers import Provider, S2N, OpenSSL
+from fixtures import managed_process # lgtm [py/unused-import]
+from providers import S2N, OpenSSL
 from utils import invalid_test_parameters, get_parameter_name, to_bytes
 from enum import Enum, auto
 

tests/integrationv2/test_fragmentation.py

@@ -3,7 +3,7 @@
 
 from configuration import available_ports, PROTOCOLS
 from common import ProviderOptions, Ciphers, Certificates, data_bytes
-from fixtures import managed_process
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL, GnuTLS
 from utils import invalid_test_parameters, get_parameter_name, get_expected_s2n_version, to_bytes
 

tests/integrationv2/test_happy_path.py

@@ -1,9 +1,9 @@
 import copy
 import pytest
 
-from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS, PROVIDERS, PROTOCOLS
-from common import ProviderOptions, Protocols, data_bytes
-from fixtures import managed_process
+from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS, PROTOCOLS
+from common import ProviderOptions, data_bytes
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL, JavaSSL, GnuTLS
 from utils import invalid_test_parameters, get_parameter_name, get_expected_s2n_version, to_bytes
 

tests/integrationv2/test_hello_retry_requests.py

@@ -1,12 +1,10 @@
 import copy
-import os
 import pytest
 import re
-import time
 
 from configuration import available_ports, TLS13_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS
 from common import ProviderOptions, Protocols, data_bytes, Curves
-from fixtures import managed_process
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL
 from utils import invalid_test_parameters, get_parameter_name, to_bytes
 
@@ -80,7 +78,7 @@ def test_hrr_with_s2n_as_client(managed_process, cipher, provider, other_provide
         results.assert_success()
         assert marker_part1 in results.stdout and marker_part2 in results.stdout
         # The "test_all" s2n security policy includes draft Hybrid PQ groups that Openssl server prints as hex values
-        assert re.search(b'Supported Elliptic Groups: [0x0-9A-F:]*X25519:P-256:P-384', results.stdout) is not None
+        assert re.search(b'Supported Elliptic Groups: [x0-9A-F:]*X25519:P-256:P-384', results.stdout) is not None
         assert to_bytes("Shared Elliptic groups: {}".format(
             server_options.curve)) in results.stdout
         assert random_bytes in results.stdout
@@ -196,7 +194,7 @@ def test_hrr_with_default_keyshare(managed_process, cipher, provider, other_prov
         results.assert_success()
         assert marker_part1 in results.stdout and marker_part2 in results.stdout
         # The "test_all" s2n security policy includes draft Hybrid PQ groups that Openssl server prints as hex values
-        assert re.search(b'Supported Elliptic Groups: [0x0-9A-F:]*X25519:P-256:P-384', results.stdout) is not None
+        assert re.search(b'Supported Elliptic Groups: [x0-9A-F:]*X25519:P-256:P-384', results.stdout) is not None
         assert to_bytes("Shared Elliptic groups: {}".format(
             server_options.curve)) in results.stdout
         assert random_bytes in results.stdout

tests/integrationv2/test_key_update.py

@@ -2,11 +2,10 @@
 import pytest
 
 from configuration import available_ports, TLS13_CIPHERS
-from common import ProviderOptions, Protocols, data_bytes, Ciphers
-from fixtures import managed_process
+from common import ProviderOptions, Protocols, data_bytes 
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL
 from utils import invalid_test_parameters, get_parameter_name
-from global_flags import get_flag, S2N_PROVIDER_VERSION
 
 
 def test_nothing():

tests/integrationv2/test_npn.py

@@ -3,7 +3,7 @@
 
 from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, MINIMAL_TEST_CERTS, PROTOCOLS
 from common import ProviderOptions, Protocols
-from fixtures import managed_process
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import OpenSSL, S2N, Provider
 from utils import invalid_test_parameters, get_parameter_name, to_bytes
 

tests/integrationv2/test_ocsp.py

@@ -1,10 +1,10 @@
 import pytest
 
 from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, PROTOCOLS
-from common import ProviderOptions, Protocols, data_bytes, Certificates
-from fixtures import managed_process
+from common import ProviderOptions, data_bytes, Certificates
+from fixtures import managed_process # lgtm [py/unused-import]
 from constants import TEST_OCSP_DIRECTORY
-from providers import Provider, S2N, OpenSSL, JavaSSL, GnuTLS
+from providers import Provider, S2N, OpenSSL, GnuTLS
 from utils import invalid_test_parameters, get_parameter_name
 from global_flags import get_flag, S2N_PROVIDER_VERSION
 

tests/integrationv2/test_pq_handshake.py

@@ -1,12 +1,12 @@
 import pytest
 import os
 
-from configuration import available_ports, PROVIDERS, PROTOCOLS
-from common import Ciphers, ProviderOptions, Protocols, data_bytes, KemGroups, Certificates, pq_enabled
-from fixtures import managed_process
+from configuration import available_ports 
+from common import Ciphers, ProviderOptions, Protocols, KemGroups, Certificates, pq_enabled
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL
 from utils import invalid_test_parameters, get_parameter_name, to_bytes
-from global_flags import get_flag, S2N_PROVIDER_VERSION, S2N_FIPS_MODE
+from global_flags import get_flag, S2N_PROVIDER_VERSION 
 
 CIPHERS = [
     None,  # `None` will default to the appropriate `test_all` cipher preference in the S2N client provider

tests/integrationv2/test_renegotiate.py

@@ -3,8 +3,8 @@
 import random
 
 from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, MINIMAL_TEST_CERTS, PROTOCOLS
-from common import ProviderOptions, Protocols, Curves
-from fixtures import managed_process
+from common import ProviderOptions, Protocols
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL
 from utils import invalid_test_parameters, get_parameter_name
 

tests/integrationv2/test_renegotiate_apache.py

@@ -3,7 +3,7 @@
 
 from configuration import ALL_TEST_CURVES
 from common import ProviderOptions
-from fixtures import managed_process
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N
 from utils import invalid_test_parameters, get_parameter_name
 from constants import TEST_CERT_DIRECTORY

tests/integrationv2/test_session_resumption.py

@@ -1,11 +1,10 @@
 import copy
 import os
 import pytest
-import time
 
 from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS, PROTOCOLS, TLS13_CIPHERS
 from common import ProviderOptions, Protocols, data_bytes
-from fixtures import managed_process
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL
 from utils import invalid_test_parameters, get_parameter_name, get_expected_s2n_version, to_bytes
 

tests/integrationv2/test_signature_algorithms.py

@@ -1,9 +1,9 @@
 import copy
 import pytest
 
-from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CURVES, ALL_TEST_CERTS
-from common import ProviderOptions, Protocols, Ciphers, Certificates, Signatures, data_bytes
-from fixtures import managed_process
+from configuration import available_ports, ALL_TEST_CIPHERS, ALL_TEST_CERTS
+from common import ProviderOptions, Protocols, Certificates, Signatures, data_bytes
+from fixtures import managed_process # lgtm [py/unused-import]
 from providers import Provider, S2N, OpenSSL, GnuTLS
 from utils import invalid_test_parameters, get_parameter_name, get_expected_s2n_version, to_bytes