ssl-opt.sh requirement checker

[gilles-peskine-arm]

When reviewing #4695, I started to write increasingly complex perl one-long-liners to check that the new requires_xxx calls matched the needs. Eventually I decided that this was getting too complex for one-liners, so here's a reasonably well-structured script that does some analysis of requires_xxx calls vs run_test parameters.

This script has a framework that can be extended easily, but currently it only checks a few easy-to-identify boolean options and requires_max_content_len (with false positives).

Typical usage (from a worktree with the ssl-opt.sh you want to check — note that the script defaults to checking its own worktree, not the worktree of the current directory):

../worktrees/check-ssl-opt-initial/tests/scripts/check_ssl_opt.py tests/ssl-opt.sh

This is nowhere near production ready and I currently have no plans to do further work except to add further ad hoc checks or improve the documentation (I'll try to do that while it's still reasonably fresh in my mind). I think that rather than improve this script, we can improve the logic inside ssl-opt.sh itself to reduce the number of ad hoc requirements. There's already logic to analyze ciphersuite= on the command line, and even with the limitations of shell scripting, it would be easy to analyze several other options.

The output as of a0c54c3 is

DTLS fragmenting: openssl server, DTLS 1.2;requires_max_content_len 2048 but max_frag_len=0, mtu=512
DTLS fragmenting: 3d, gnutls server, DTLS 1.2;requires_max_content_len 2048 but max_frag_len=0, mtu=512
DTLS fragmenting: 3d, openssl server, DTLS 1.2;requires_max_content_len 2048 but max_frag_len=0, mtu=512
Handshake memory usage initial (MFL 16384 - default);requires_max_content_len 16384 for no discernible reason
Handshake memory usage initial (MFL 16384 - default);requires_max_content_len 16384 but max_frag_len=0, mtu=0
Handshake memory usage (MFL 4096);max_frag_len=4096 but no requires_max_content_len
Handshake memory usage (MFL 2048);max_frag_len=2048 but no requires_max_content_len
Handshake memory usage (MFL 1024);max_frag_len=1024 but no requires_max_content_len
Handshake memory usage (MFL 512);max_frag_len=512 but no requires_max_content_len

and I am satisfied that these are false positives due to limitations of the analysis in this script (it doesn't understand the diversity of requirements related to mtu values, and it doesn't figure out the “factored out” requires_max_content_len call for the "Handshake memory usage" scripts).

[tom-daubney-arm]

As part of our review of historical PRs we have made the decision to convert older PRs that have not been updated in 3 months into drafts until they are worked on again.