WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Address review: make the hang guards actually fire 

Three ways the bounds added here failed to do their job:

- get_first_free_port ended the scan cap with 'exit 1', but every caller
  runs it in a command substitution, so only the subshell died. The port
  variable came back empty, the next $((port + 1)) evaluated to 1, and the
  run limped on to a confusing wait_for_readyFile failure. Forcing the cap
  on ocsp-stapling.test: before, the script ran on and hung until an outer
  timeout killed it; now it exits 1 at the error. Return instead, and check
  the status at all 25 call sites across the six scripts.

- The macOS timeout shim was a shell function. Backgrounding a function
  forks a subshell, so $! was the subshell and cleanup killed that while
  the server it was meant to stop leaked. Use a prefix variable that
  expands to nothing when timeout(1) is absent, keeping $! the real pid.

- timeout -s KILL exits 137, not 124. Sites that read $? and treat any
  non-zero as 'feature not compiled in' turned a hang into exit 0, so the
  bound made a hang less visible than before. Add timed_out() and check it
  before those skip branches; use it for the version probes too, which
  matched any status >= 124.
pull/10900/head
Juliusz Sosinowicz 2026-08-13 15:51:09 +00:00
parent 44b1341119
commit 1fa1228ba1
21 changed files with 389 additions and 240 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
scripts/benchmark.test
View File

@ -4,8 +4,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
# if we can, isolate the network namespace to eliminate port collisions.
@ -117,7 +122,7 @@ if [ $1 -eq 1 ]
then
echo "Starting example client to benchmark connection average time"
# start client to benchmark average time for each connection using port
timeout -s KILL 2m ./examples/client/client -b $2 -p $bench_port $3
$TIMEOUT_KILL_2M ./examples/client/client -b $2 -p $bench_port $3
client_result=$?
fi
@ -126,7 +131,7 @@ if [ $1 -eq 2 ]
then
echo "Starting example client to benchmark throughput"
# start client in non-blocking mode, benchmark throughput using port
timeout -s KILL 2m ./examples/client/client -N -B $2 -p $bench_port $3
$TIMEOUT_KILL_2M ./examples/client/client -N -B $2 -p $bench_port $3
client_result=$?
fi

13
scripts/crl-revoked.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
@ -106,7 +111,7 @@ run_test() {
# starts the server on crl_port, -R generates ready file to be used as a
# mutex lock, -c loads the revoked certificate. We capture the processid
# into the variable server_pid
timeout -s KILL 2m ./examples/server/server -R "$ready_file" -p $crl_port \
$TIMEOUT_KILL_2M ./examples/server/server -R "$ready_file" -p $crl_port \
-c ${CERT_DIR}/server-revoked-cert.pem \
-k ${CERT_DIR}/server-revoked-key.pem &
server_pid=$!
@ -184,7 +189,7 @@ run_hashdir_test() {
# starts the server on crl_port, -R generates ready file to be used as a
# mutex lock, -c loads the revoked certificate. We capture the processid
# into the variable server_pid
timeout -s KILL 2m ./examples/server/server -R "$ready_file" -p $crl_port \
$TIMEOUT_KILL_2M ./examples/server/server -R "$ready_file" -p $crl_port \
-c ${CERT_DIR}/server-revoked-cert.pem \
-k ${CERT_DIR}/server-revoked-key.pem &
server_pid=$!

11
scripts/dtls.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_1M="timeout -s KILL 1m"
else
TIMEOUT_KILL_1M=""
fi
# This script can be run with several environment variables set dictating its
@ -100,7 +105,7 @@ run_test() { # usage: run_test "<testName>" "<udp-proxy args>" "<server args>" "
stdbuf -oL -eL $UDP_PROXY_BIN -p $PROXY_PORT -s 127.0.0.1:$SERVER_PORT $UDP_PROXY_EXTRA_ARGS $2 2>&1 | prepend "[udp-proxy] " &
sleep 0.2
# Wrap this command in a timeout so that a deadlock won't bring down the entire test
timeout -s KILL 1m stdbuf -oL -eL $WOLFSSL_ROOT/examples/client/client -u -p$PROXY_PORT $DTLS_VERSION $4 2>&1 | prepend "[client] "
$TIMEOUT_KILL_1M stdbuf -oL -eL $WOLFSSL_ROOT/examples/client/client -u -p$PROXY_PORT $DTLS_VERSION $4 2>&1 | prepend "[client] "
if [ $? != 0 ]; then
echo "***Test failed***"
((NUM_TESTS_FAILED++))

13
scripts/dtlscid.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
@ -61,10 +66,10 @@ test_cid () {
echo "Running test_cid"
SERVER_FILE=$(mktemp)
CLIENT_FILE=$(mktemp)
timeout -s KILL 2m $WOLFSSL_ROOT/examples/server/server -v4 -u --cid $SCID 1> $SERVER_FILE &
$TIMEOUT_KILL_2M $WOLFSSL_ROOT/examples/server/server -v4 -u --cid $SCID 1> $SERVER_FILE &
SERVER_PID=$!
sleep 0.2
timeout -s KILL 2m $WOLFSSL_ROOT/examples/client/client -v4 -u --cid $CCID 1> $CLIENT_FILE
$TIMEOUT_KILL_2M $WOLFSSL_ROOT/examples/client/client -v4 -u --cid $CCID 1> $CLIENT_FILE
wait $SERVER_PID
SERVER_PID=
grep "Sending CID is ${HEXSCID}" $CLIENT_FILE > /dev/null

11
scripts/external.test
View File

@ -4,8 +4,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
SCRIPT_DIR="$(dirname "$0")"
@ -51,7 +56,7 @@ RESULT=$?
[ $RESULT -ne 0 ] && exit 0
# client test against the server
timeout -s KILL 2m ./examples/client/client -X -C -h $server -p 443 -g -A $ca
$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server -p 443 -g -A $ca
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1

11
scripts/google.test
View File

@ -4,8 +4,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
server=www.google.com
@ -37,7 +42,7 @@ RESULT=$?
# so treat it like the unreachable-server case above and skip instead of
# failing.
run_client() {
OUTPUT="$(timeout -s KILL 2m ./examples/client/client "$@" 2>&1)"
OUTPUT="$($TIMEOUT_KILL_2M ./examples/client/client "$@" 2>&1)"
RESULT=$?
echo "$OUTPUT"
if [ $RESULT -ne 0 ] && echo "$OUTPUT" | grep -q 'tcp connect failed'; then

35
scripts/ocsp-responder-openssl-interop.test
View File

@ -11,8 +11,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
if ! test -n "$WOLFSSL_OPENSSL_TEST"; then
@ -159,7 +164,9 @@ get_first_free_port() {
scanned=$((scanned+1))
if [ "$scanned" -ge 100 ]; then
echo "ERROR: no free port found after scanning 100 ports" 1>&2
exit 1
# return, not exit: every caller runs this in a command
# substitution, where exit would only end the subshell.
return 1
fi
done
echo "$ret"
@ -202,7 +209,7 @@ query_ocsp() {
printf " TEST %2d: %-55s " "$tests_run" "$desc"
local output
output=$(timeout -s KILL 2m $OPENSSL ocsp \
output=$($TIMEOUT_KILL_2M $OPENSSL ocsp \
-issuer "$issuer" \
-cert "$cert" \
-url "http://127.0.0.1:$_port/" \
@ -234,11 +241,11 @@ query_ocsp() {
base_port=$((((($$ + $RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
port1=$(get_first_free_port $base_port) # OCSP responder: intermediate1-ca
port2=$(get_first_free_port $((port1 + 1))) # OCSP responder: intermediate2-ca
port3=$(get_first_free_port $((port2 + 1))) # OCSP responder: intermediate3-ca
port4=$(get_first_free_port $((port3 + 1))) # OCSP responder: root-ca
port5=$(get_first_free_port $((port4 + 1))) # TLS server
port1=$(get_first_free_port $base_port) || exit 1 # OCSP responder: intermediate1-ca
port2=$(get_first_free_port $((port1 + 1))) || exit 1 # OCSP responder: intermediate2-ca
port3=$(get_first_free_port $((port2 + 1))) || exit 1 # OCSP responder: intermediate3-ca
port4=$(get_first_free_port $((port3 + 1))) || exit 1 # OCSP responder: root-ca
port5=$(get_first_free_port $((port4 + 1))) || exit 1 # TLS server
# Responder 1: intermediate1-ca (server1=valid, server2=revoked)
log1=$(mktemp "${TMPDIR:-/tmp}/ocsp_resp1.XXXXXX")
@ -417,7 +424,7 @@ echo "=== Negative tests: unsupported features ==="
tests_run=$((tests_run+1))
printf " TEST %2d: %-55s " "$tests_run" "SHA-384 hash -> good"
output=$(timeout -s KILL 2m $OPENSSL ocsp \
output=$($TIMEOUT_KILL_2M $OPENSSL ocsp \
-sha384 \
-issuer "$OCSP_DIR/intermediate1-ca-cert.pem" \
-cert "$OCSP_DIR/server1-cert.pem" \
@ -455,7 +462,7 @@ printf " TEST %2d: %-55s " "$tests_run" "Authorized responder"
# Query using OpenSSL - asks about intermediate1-ca which was issued by root-ca
# Response will be signed by ocsp-responder-cert (authorized responder)
output=$(timeout -s KILL 2m $OPENSSL ocsp \
output=$($TIMEOUT_KILL_2M $OPENSSL ocsp \
-issuer "$OCSP_DIR/root-ca-cert.pem" \
-cert "$OCSP_DIR/intermediate1-ca-cert.pem" \
-url "http://127.0.0.1:$port5/" \
@ -490,7 +497,7 @@ echo "=== Unknown certificate tests ==="
tests_run=$((tests_run+1))
printf " TEST %2d: %-55s " "$tests_run" "Wrong issuer: server3 to responder 1 (wrong issuer)"
output=$(timeout -s KILL 2m $OPENSSL ocsp \
output=$($TIMEOUT_KILL_2M $OPENSSL ocsp \
-issuer "$OCSP_DIR/intermediate1-ca-cert.pem" \
-cert "$OCSP_DIR/server3-cert.pem" \
-url "http://127.0.0.1:$port1/" \
@ -517,7 +524,7 @@ fi
tests_run=$((tests_run+1))
printf " TEST %2d: %-55s " "$tests_run" "Wrong issuer: server1 to responder 2 (wrong issuer)"
output=$(timeout -s KILL 2m $OPENSSL ocsp \
output=$($TIMEOUT_KILL_2M $OPENSSL ocsp \
-issuer "$OCSP_DIR/intermediate2-ca-cert.pem" \
-cert "$OCSP_DIR/server1-cert.pem" \
-url "http://127.0.0.1:$port2/" \
@ -550,7 +557,7 @@ tests_run=$((tests_run+1))
printf " TEST %2d: %-55s " "$tests_run" "Multiple requests (should return OCSP error)"
# Using multiple -cert options creates one OCSP request with multiple certificate IDs
output=$(timeout -s KILL 2m $OPENSSL ocsp \
output=$($TIMEOUT_KILL_2M $OPENSSL ocsp \
-issuer "$OCSP_DIR/intermediate1-ca-cert.pem" \
-cert "$OCSP_DIR/server1-cert.pem" \
-cert "$OCSP_DIR/server2-cert.pem" \

23
scripts/ocsp-stapling-with-ca-as-responder.test
View File

@ -4,8 +4,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
SCRIPT_DIR="$(dirname "$0")"
@ -215,7 +220,9 @@ get_first_free_port() {
scanned=$((scanned+1))
if [ "$scanned" -ge 100 ]; then
echo "ERROR: no free port found after scanning 100 ports" 1>&2
exit 1
# return, not exit: every caller runs this in a command
# substitution, where exit would only end the subshell.
return 1
fi
done
echo "$ret"
@ -223,8 +230,8 @@ get_first_free_port() {
}
base_port=$((((($$ + $RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
port1=$(get_first_free_port $base_port)
port2=$(get_first_free_port $((port1 + 1)))
port1=$(get_first_free_port $base_port) || exit 1
port2=$(get_first_free_port $((port1 + 1))) || exit 1
# create a port to use with openssl ocsp responder
@ -237,7 +244,7 @@ if [ ! -f "$ready_file" ]; then
else
printf '%s\n' "Random port selected: $port1"
# Use client connection to shutdown the server cleanly
timeout -s KILL 2m ./examples/client/client -p $port1
$TIMEOUT_KILL_2M ./examples/client/client -p $port1
create_new_cnf $port1
fi
sleep 0.1
@ -275,7 +282,7 @@ printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS ------------------------"
-p $port2 &
wolf_pid2=$!
wait_for_readyFile "$ready_file2" $wolf_pid2 $port2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 \
-p $port2
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection failed" && exit 1
@ -289,7 +296,7 @@ remove_single_rF "$ready_file2"
-p $port2 &
wolf_pid2=$!
wait_for_readyFile "$ready_file2" $wolf_pid2 $port2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 \
-p $port2
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1

107
scripts/ocsp-stapling-with-wolfssl-responder.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
@ -361,7 +366,9 @@ get_first_free_port() {
scanned=$((scanned+1))
if [ "$scanned" -ge 100 ]; then
echo "ERROR: no free port found after scanning 100 ports" 1>&2
exit 1
# return, not exit: every caller runs this in a command
# substitution, where exit would only end the subshell.
return 1
fi
done
echo "$ret"
@ -369,11 +376,11 @@ get_first_free_port() {
}
base_port=$((((($$ + $RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
port1=$(get_first_free_port $base_port) # OCSP responder: intermediate1-ca
port2=$(get_first_free_port $((port1 + 1))) # OCSP responder: intermediate2-ca
port3=$(get_first_free_port $((port2 + 1))) # OCSP responder: intermediate3-ca
port4=$(get_first_free_port $((port3 + 1))) # OCSP responder: root-ca
port5=$(get_first_free_port $((port4 + 1))) # TLS server
port1=$(get_first_free_port $base_port) || exit 1 # OCSP responder: intermediate1-ca
port2=$(get_first_free_port $((port1 + 1))) || exit 1 # OCSP responder: intermediate2-ca
port3=$(get_first_free_port $((port2 + 1))) || exit 1 # OCSP responder: intermediate3-ca
port4=$(get_first_free_port $((port3 + 1))) || exit 1 # OCSP responder: root-ca
port5=$(get_first_free_port $((port4 + 1))) || exit 1 # TLS server
# Verify ports by starting and stopping dummy servers
# 1:
@ -414,10 +421,10 @@ printf '%s\n' "OCSP responder ports: $port1 $port2 $port3 $port4"
printf '%s\n' "TLS server port: $port5"
printf '%s\n' "-----------------------------------"
# Use client connections to cleanly shutdown the servers
timeout -s KILL 2m ./examples/client/client -p $port1
timeout -s KILL 2m ./examples/client/client -p $port2
timeout -s KILL 2m ./examples/client/client -p $port3
timeout -s KILL 2m ./examples/client/client -p $port4
$TIMEOUT_KILL_2M ./examples/client/client -p $port1
$TIMEOUT_KILL_2M ./examples/client/client -p $port2
$TIMEOUT_KILL_2M ./examples/client/client -p $port3
$TIMEOUT_KILL_2M ./examples/client/client -p $port4
create_new_cnf $port1 $port2 $port3 $port4
# Start wolfSSL OCSP responders (CA signs responses directly)
@ -468,12 +475,12 @@ if [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS -------------------------"
# client test against our own server - GOOD CERT
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server1-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server1-cert.pem \
-k certs/ocsp/server1-key.pem -R $ready_file5 \
-p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port5
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
printf '%s\n\n' "Test PASSED!"
@ -481,13 +488,13 @@ if [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE 2 SHOULD REVOKE -----------------------"
# client test against our own server - REVOKED CERT
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server2-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server2-cert.pem \
-k certs/ocsp/server2-key.pem -R $ready_file5 \
-p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
sleep 0.1
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port5
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port5
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection 2 succeeded $RESULT" \
&& exit 1
@ -499,12 +506,12 @@ if [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE 3 TLS13 SHOULD PASS -----------------"
# client test against our own server - GOOD CERT
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server1-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server1-cert.pem \
-k certs/ocsp/server1-key.pem -v 4 \
-R $ready_file5 -p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
-p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 3 failed" && exit 1
@ -513,12 +520,12 @@ if [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE 4 TLS13 MUST-STAPLE SHOULD PASS -----"
# client test against our own server, must staple - GOOD CERT
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server1-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server1-cert.pem \
-k certs/ocsp/server1-key.pem -v 4 \
-R $ready_file5 -p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1m -v 4 -F 1 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1m -v 4 -F 1 \
-p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 4 failed" && exit 1
@ -527,12 +534,12 @@ if [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE 5 TLS13 SHOULD REVOKE ---------------"
# client test against our own server - REVOKED CERT
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server2-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server2-cert.pem \
-k certs/ocsp/server2-key.pem -v 4 \
-R $ready_file5 -p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
-p $port5
RESULT=$?
[ $RESULT -ne 1 ] && \
@ -546,12 +553,12 @@ if [ "$stapling_v1" == "yes" ]; then
if [[ "$dtls12" == "yes" ]]; then
printf '%s\n\n' "------------- TEST CASE DTLS12-1 SHOULD PASS ----------------"
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server1-cert.pem -R $ready_file5 \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server1-cert.pem -R $ready_file5 \
-k certs/ocsp/server1-key.pem -u -v 3 \
-p $port5 &
server_pid5=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 3 \
-W 1 -p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client DTLS12 connection failed" && exit 1
@ -562,12 +569,12 @@ if [ "$stapling_v1" == "yes" ]; then
if [ "$dtls13" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE DTLS13-1 SHOULD PASS ----------------"
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server1-cert.pem -R $ready_file5 \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server1-cert.pem -R $ready_file5 \
-k certs/ocsp/server1-key.pem -u -v 4 \
-p $port5 &
server_pid5=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 4 \
-W 1 -p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client DTLS13 connection failed" && exit 1
@ -588,12 +595,12 @@ if [ "$stapling_v2" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE V2-1 SHOULD PASS ----------------------"
# client test against our own server - GOOD CERTS
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server3-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server3-cert.pem \
-k certs/ocsp/server3-key.pem -R $ready_file5 \
-p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
-p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection V2-1 failed" && exit 1
@ -601,12 +608,12 @@ if [ "$stapling_v2" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE V2-2 SHOULD PASS ----------------------"
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server3-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server3-cert.pem \
-k certs/ocsp/server3-key.pem -R $ready_file5 \
-p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
-p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection V2-2 failed" && exit 1
@ -615,12 +622,12 @@ if [ "$stapling_v2" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE V2-3 SHOULD REVOKE --------------------"
# client test against our own server - REVOKED SERVER CERT
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server4-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server4-cert.pem \
-k certs/ocsp/server4-key.pem -R $ready_file5 \
-p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
-p $port5
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection V2-3 succeeded $RESULT" && exit 1
@ -629,11 +636,11 @@ if [ "$stapling_v2" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE V2-4 SHOULD REVOKE --------------------"
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server4-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server4-cert.pem \
-k certs/ocsp/server4-key.pem -R $ready_file5 \
-p $port5 &
sleep 0.1
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
-p $port5
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection V2-4 succeeded $RESULT" && exit 1
@ -643,12 +650,12 @@ if [ "$stapling_v2" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE V2-5 SHOULD PASS ----------------------"
# client test against our own server - REVOKED INTERMEDIATE CERT
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server5-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server5-cert.pem \
-k certs/ocsp/server5-key.pem -R $ready_file5 \
-p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
-p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection V2-5 failed $RESULT" && exit 1
@ -656,12 +663,12 @@ if [ "$stapling_v2" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE V2-6 SHOULD REVOKE --------------------"
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server5-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server5-cert.pem \
-k certs/ocsp/server5-key.pem -R $ready_file5 \
-p $port5 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
-p $port5
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection V2-6 succeeded $RESULT" && exit 1
@ -672,12 +679,12 @@ if [ "$stapling_v2" == "yes" ]; then
if [[ "$dtls12" == "yes" ]]; then
printf '%s\n\n' "------------- TEST CASE DTLS12-V2 SHOULD PASS ----------------"
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server3-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server3-cert.pem \
-k certs/ocsp/server3-key.pem -R $ready_file5 \
-p $port5 -u -v 3 &
server_pid5=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -u -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -u -v 3 \
-p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client DTLS12 v2 connection failed" && exit 1
@ -698,12 +705,12 @@ if [ "$tls13" == "yes" ] && [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE T13-1 SHOULD PASS --------------------"
# client test against our own server - GOOD CERTS
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server3-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server3-cert.pem \
-k certs/ocsp/server3-key.pem -R $ready_file5 \
-p $port5 -v 4 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection T13-1 failed" && exit 1
@ -712,12 +719,12 @@ if [ "$tls13" == "yes" ] && [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE T13-2 SHOULD REVOKE ------------------"
# client test against our own server - REVOKED SERVER CERT
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server4-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server4-cert.pem \
-k certs/ocsp/server4-key.pem -R $ready_file5 \
-p $port5 -v 4 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p $port5
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection T13-2 succeeded $RESULT" && exit 1
@ -727,12 +734,12 @@ if [ "$tls13" == "yes" ] && [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE T13-3 SHOULD REVOKE ------------------"
# client test against our own server - REVOKED INTERMEDIATE CERT
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server5-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server5-cert.pem \
-k certs/ocsp/server5-key.pem -R $ready_file5 \
-p $port5 -v 4 &
server_pid5=$!
wait_for_readyFile $ready_file5 $server_pid5 $port5
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p $port5
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection T13-3 succeeded $RESULT" && exit 1
@ -743,12 +750,12 @@ if [ "$tls13" == "yes" ] && [ "$stapling_v1" == "yes" ]; then
if [ "$dtls13" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE DTLS13-V2 SHOULD PASS ----------------"
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server3-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server3-cert.pem \
-k certs/ocsp/server3-key.pem -R $ready_file5 \
-p $port5 -u -v 4 &
server_pid5=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -u -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -u -v 4 \
-p $port5
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client DTLS13 connection failed" && exit 1
@ -756,12 +763,12 @@ if [ "$tls13" == "yes" ] && [ "$stapling_v1" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE DTLS13-V2-REVOKE SHOULD REVOKE -------"
remove_single_rF $ready_file5
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server4-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server4-cert.pem \
-k certs/ocsp/server4-key.pem -R $ready_file5 \
-p $port5 -v 4 &
server_pid5=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p $port5
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client DTLS13 connection succeeded $RESULT" && exit 1

47
scripts/ocsp-stapling.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
@ -287,7 +292,9 @@ get_first_free_port() {
scanned=$((scanned+1))
if [ "$scanned" -ge 100 ]; then
echo "ERROR: no free port found after scanning 100 ports" 1>&2
exit 1
# return, not exit: every caller runs this in a command
# substitution, where exit would only end the subshell.
return 1
fi
done
echo "$ret"
@ -295,15 +302,15 @@ get_first_free_port() {
}
base_port=$((((($$ + RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
port1=$(get_first_free_port $base_port)
port2=$(get_first_free_port $((port1 + 1)))
port3=$(get_first_free_port $((port2 + 1)))
port1=$(get_first_free_port $base_port) || exit 1
port2=$(get_first_free_port $((port1 + 1))) || exit 1
port3=$(get_first_free_port $((port2 + 1))) || exit 1
# test interop fail case
ready_file=$PWD/wolf_ocsp_readyF$$
printf '%s\n' "ready file: \"$ready_file\""
timeout -s KILL 2m ./examples/server/server -b -p "$port1" -o -R "$ready_file" &
$TIMEOUT_KILL_2M ./examples/server/server -b -p "$port1" -o -R "$ready_file" &
wolf_pid=$!
wait_for_readyFile "$ready_file" "$wolf_pid" "$port1"
if [ ! -f "$ready_file" ]; then
@ -341,7 +348,7 @@ if [ ! -f "$ready_file" ]; then
else
printf '%s\n' "Random port selected: $port2"
# Use client connection to shutdown the server cleanly
timeout -s KILL 2m ./examples/client/client -p "$port2"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port2"
create_new_cnf "$port2"
fi
sleep 0.1
@ -357,7 +364,7 @@ ca=./certs/external/ca_collection.pem
if [[ -z "${WOLFSSL_EXTERNAL_TEST-}" || "$WOLFSSL_EXTERNAL_TEST" == "0" ]]; then
echo "Skipping OCSP test on $server (set WOLFSSL_EXTERNAL_TEST=1 to run)"
elif [[ "$V4V6" == "4" ]]; then
retry_with_backoff 3 timeout -s KILL 2m ./examples/client/client -C -h "$server" -p 443 -A "$ca" -g -W 1
retry_with_backoff 3 $TIMEOUT_KILL_2M ./examples/client/client -C -h "$server" -p 443 -A "$ca" -g -W 1
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
else
@ -392,7 +399,7 @@ printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS ------------------------"
-k certs/ocsp/server1-key.pem -p "$port3" &
wolf_pid3=$!
wait_for_readyFile "$ready_file2" "$wolf_pid3" "$port3"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p "$port3"
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p "$port3"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
printf '%s\n\n' "Test PASSED!"
@ -405,7 +412,7 @@ remove_single_rF "$ready_file2"
wolf_pid3=$!
wait_for_readyFile "$ready_file2" "$wolf_pid3" "$port3"
sleep 0.1
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p "$port3"
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p "$port3"
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection 2 succeeded $RESULT" \
&& exit 1
@ -421,7 +428,7 @@ printf '%s\n\n' "Test successfully REVOKED!"
-p "$port3" &
wolf_pid3=$!
wait_for_readyFile "$ready_file2" "$wolf_pid3" "$port3"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
-p "$port3"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 3 failed" && exit 1
@ -435,7 +442,7 @@ printf '%s\n\n' "Test successfully REVOKED!"
-p "$port3" &
wolf_pid3=$!
wait_for_readyFile "$ready_file2" "$wolf_pid3" "$port3"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1m -v 4 -F 1 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1m -v 4 -F 1 \
-p "$port3"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 4 failed" && exit 1
@ -449,7 +456,7 @@ printf '%s\n\n' "Test successfully REVOKED!"
-p "$port3" &
wolf_pid3=$!
wait_for_readyFile "$ready_file2" "$wolf_pid3" "$port3"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
-p "$port3"
RESULT=$?
[ $RESULT -ne 1 ] && \
@ -471,7 +478,7 @@ if ./examples/client/client -? 2>&1 | grep -q 'DTLSv1.2'; then
wolf_pid3=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 3 \
-W 1 -p "$port3"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 5 failed" && exit 1
@ -486,7 +493,7 @@ fi
-p "$port3" &
wolf_pid3=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 4 \
-W 1 -p "$port3"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 5 failed" && exit 1
@ -562,7 +569,7 @@ done
printf '%s\n\n' "------------- TEST CASE 6 SHOULD PASS ----------------------"
# client asks for OCSP staple but doesn't fail when none returned
timeout -s KILL 2m ./examples/client/client -p "$port" -g -v 3 -W 1
$TIMEOUT_KILL_2M ./examples/client/client -p "$port" -g -v 3 -W 1
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 6 failed" && exit 1
@ -570,7 +577,7 @@ printf '%s\n\n' "Test PASSED!"
printf '%s\n\n' "------------- TEST CASE 7 SHOULD UNKNOWN -------------------"
# client asks for OCSP staple but doesn't fail when none returned
timeout -s KILL 2m ./examples/client/client -p "$port" -g -v 3 -W 1m
$TIMEOUT_KILL_2M ./examples/client/client -p "$port" -g -v 3 -W 1m
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection 7 succeeded $RESULT" \
@ -584,7 +591,7 @@ wolfssl_tls13=$?
if [ "$openssl_tls13" = "0" ] && [ "$wolfssl_tls13" = "0" ]; then
printf '%s\n\n' "------------- TEST CASE 8 SHOULD PASS --------------------"
# client asks for OCSP staple but doesn't fail when none returned
timeout -s KILL 2m ./examples/client/client -p "$port" -g -v 4 -W 1
$TIMEOUT_KILL_2M ./examples/client/client -p "$port" -g -v 4 -W 1
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 8 failed" && exit 1
@ -592,7 +599,7 @@ if [ "$openssl_tls13" = "0" ] && [ "$wolfssl_tls13" = "0" ]; then
printf '%s\n\n' "------------- TEST CASE 9 SHOULD UNKNOWN -----------------"
# client asks for OCSP staple but doesn't fail when none returned
timeout -s KILL 2m ./examples/client/client -p "$port" -g -v 4 -W 1m
$TIMEOUT_KILL_2M ./examples/client/client -p "$port" -g -v 4 -W 1m
RESULT=$?
[ $RESULT -ne 1 ] \

55
scripts/ocsp-stapling2.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
@ -270,7 +275,9 @@ get_first_free_port() {
scanned=$((scanned+1))
if [ "$scanned" -ge 100 ]; then
echo "ERROR: no free port found after scanning 100 ports" 1>&2
exit 1
# return, not exit: every caller runs this in a command
# substitution, where exit would only end the subshell.
return 1
fi
done
echo "$ret"
@ -278,11 +285,11 @@ get_first_free_port() {
}
base_port=$((((($$ + RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
port1=$(get_first_free_port "$base_port")
port2=$(get_first_free_port $((port1 + 1)))
port3=$(get_first_free_port $((port2 + 1)))
port4=$(get_first_free_port $((port3 + 1)))
port5=$(get_first_free_port $((port4 + 1)))
port1=$(get_first_free_port "$base_port") || exit 1
port2=$(get_first_free_port $((port1 + 1))) || exit 1
port3=$(get_first_free_port $((port2 + 1))) || exit 1
port4=$(get_first_free_port $((port3 + 1))) || exit 1
port5=$(get_first_free_port $((port4 + 1))) || exit 1
# 1:
./examples/server/server -R "$ready_file1" -p "$port1" &
@ -322,10 +329,10 @@ printf '%s' "Random ports selected: $port1 $port2"
printf '%s\n' " $port3 $port4"
printf '%s\n' "-----------------------------------"
# Use client connections to cleanly shutdown the servers
timeout -s KILL 2m ./examples/client/client -p "$port1"
timeout -s KILL 2m ./examples/client/client -p "$port2"
timeout -s KILL 2m ./examples/client/client -p "$port3"
timeout -s KILL 2m ./examples/client/client -p "$port4"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port1"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port2"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port3"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port4"
create_new_cnf "$port1" "$port2" "$port3" \
"$port4"
@ -387,7 +394,7 @@ printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS ------------------------"
-p "$port5" &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
-p "$port5"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
@ -400,7 +407,7 @@ remove_single_rF "$ready_file5"
-p "$port5" &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
-p "$port5"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 2 failed" && exit 1
@ -414,7 +421,7 @@ remove_single_rF "$ready_file5"
-p "$port5" &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
-p "$port5"
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
@ -426,7 +433,7 @@ remove_single_rF "$ready_file5"
-k certs/ocsp/server4-key.pem -R "$ready_file5" \
-p "$port5" &
sleep 0.1
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
-p "$port5"
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
@ -440,7 +447,7 @@ remove_single_rF "$ready_file5"
-p "$port5" &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
-p "$port5"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 3 failed $RESULT" && exit 1
@ -453,14 +460,14 @@ remove_single_rF "$ready_file5"
-p "$port5" &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
-p "$port5"
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
printf '%s\n\n' "Test successfully REVOKED!"
printf '%s\n\n' "------------- TEST CASE 7 LOAD CERT IN SSL -------------------"
remove_single_rF "$ready_file5"
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server1-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server1-cert.pem \
-k certs/ocsp/server1-key.pem -R "$ready_file5" \
-p "$port5" -H loadSSL &
server_pid5=$!
@ -475,12 +482,12 @@ fi
printf '%s\n\n' "Test successful"
printf '%s\n\n' "------------- TEST CASE 8 SHOULD REVOKE ----------------------"
remove_single_rF "$ready_file5"
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server4-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server4-cert.pem \
-k certs/ocsp/server4-key.pem -R "$ready_file5" \
-p "$port5" -H loadSSL &
server_pid5=$!
sleep 0.1
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
-p "$port5"
RESULT=$?
[ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
@ -560,7 +567,7 @@ done
printf '%s\n\n' "------------- TEST CASE 9 SHOULD PASS ----------------------"
# client asks for OCSP staple but doesn't fail when none returned
timeout -s KILL 2m ./examples/client/client -p "$port" -g -v 3 -W 2
$TIMEOUT_KILL_2M ./examples/client/client -p "$port" -g -v 3 -W 2
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 9 failed" && exit 1
@ -568,7 +575,7 @@ printf '%s\n\n' "Test PASSED!"
printf '%s\n\n' "------------- TEST CASE 10 SHOULD UNKNOWN -------------------"
# client asks for OCSP staple but doesn't fail when none returned
timeout -s KILL 2m ./examples/client/client -p "$port" -g -v 3 -W 2m
$TIMEOUT_KILL_2M ./examples/client/client -p "$port" -g -v 3 -W 2m
RESULT=$?
[ $RESULT -ne 1 ] \
@ -585,7 +592,7 @@ printf '%s\n\n' "------------- TEST CASE DTLS-1 SHOULD PASS -------------------"
-p "$port5" -u -v 3 &
server_pid5=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -u -v 3 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -u -v 3 \
-p "$port5"
RESULT=$?
[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1

51
scripts/ocsp-stapling_tls13multi.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
@ -300,7 +305,9 @@ get_first_free_port() {
scanned=$((scanned+1))
if [ "$scanned" -ge 100 ]; then
echo "ERROR: no free port found after scanning 100 ports" 1>&2
exit 1
# return, not exit: every caller runs this in a command
# substitution, where exit would only end the subshell.
return 1
fi
done
echo "$ret"
@ -308,11 +315,11 @@ get_first_free_port() {
}
base_port=$((((($$ + RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
port1=$(get_first_free_port "$base_port")
port2=$(get_first_free_port $((port1 + 1)))
port3=$(get_first_free_port $((port2 + 1)))
port4=$(get_first_free_port $((port3 + 1)))
port5=$(get_first_free_port $((port4 + 1)))
port1=$(get_first_free_port "$base_port") || exit 1
port2=$(get_first_free_port $((port1 + 1))) || exit 1
port3=$(get_first_free_port $((port2 + 1))) || exit 1
port4=$(get_first_free_port $((port3 + 1))) || exit 1
port5=$(get_first_free_port $((port4 + 1))) || exit 1
# 1:
./examples/server/server -R "$ready_file1" -p "$port1" &
@ -352,10 +359,10 @@ printf '%s' "Random ports selected: $port1 $port2"
printf '%s\n' " $port3 $port4 $port5"
printf '%s\n' "-----------------------------------"
# Use client connections to cleanly shutdown the servers
timeout -s KILL 2m ./examples/client/client -p "$port1"
timeout -s KILL 2m ./examples/client/client -p "$port2"
timeout -s KILL 2m ./examples/client/client -p "$port3"
timeout -s KILL 2m ./examples/client/client -p "$port4"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port1"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port2"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port3"
$TIMEOUT_KILL_2M ./examples/client/client -p "$port4"
create_new_cnf "$port1" "$port2" "$port3" \
"$port4"
@ -419,7 +426,7 @@ if [ "$tls13" == "yes" ]; then
-p "$port5" -v 4 &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p "$port5"
RESULT=$?
[ "$RESULT" -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
@ -433,7 +440,7 @@ if [ "$tls13" == "yes" ]; then
-p "$port5" -v 4 &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p "$port5"
RESULT=$?
[ "$RESULT" -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
@ -445,7 +452,7 @@ if [ "$tls13" == "yes" ]; then
-k certs/ocsp/server4-key.pem -R "$ready_file5" \
-p "$port5" &
sleep 0.1
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p "$port5"
RESULT=$?
[ "$RESULT" -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
@ -459,7 +466,7 @@ if [ "$tls13" == "yes" ]; then
-p "$port5" -v 4 &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p "$port5"
RESULT=$?
[ "$RESULT" -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
@ -472,7 +479,7 @@ if [ "$tls13" == "yes" ]; then
-p "$port5" -v 4 &
server_pid5=$!
wait_for_readyFile "$ready_file5" "$server_pid5" "$port5"
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p "$port5"
RESULT=$?
[ "$RESULT" -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
@ -480,7 +487,7 @@ if [ "$tls13" == "yes" ]; then
printf '%s\n\n' "------------- TEST CASE 6 LOAD CERT IN SSL -------------------"
remove_single_rF "$ready_file5"
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server1-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server1-cert.pem \
-k certs/ocsp/server1-key.pem -R "$ready_file5" -v 4 \
-p "$port5" -H loadSSL &
server_pid5=$!
@ -495,12 +502,12 @@ if [ "$tls13" == "yes" ]; then
printf '%s\n\n' "Test successful"
printf '%s\n\n' "------------- TEST CASE 7 SHOULD REVOKE ----------------------"
remove_single_rF "$ready_file5"
timeout -s KILL 2m ./examples/server/server -c certs/ocsp/server4-cert.pem \
$TIMEOUT_KILL_2M ./examples/server/server -c certs/ocsp/server4-cert.pem \
-k certs/ocsp/server4-key.pem -R "$ready_file5" \
-p "$port5" -H loadSSL -v 4 &
server_pid5=$!
sleep 0.1
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p "$port5"
RESULT=$?
[ "$RESULT" -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
@ -541,7 +548,7 @@ if [ "$dtls13" == "yes" ]; then
-p "$port5" -u -v 4 &
server_pid5=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -u -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -u -v 4 \
-p "$port5"
RESULT=$?
[ "$RESULT" -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
@ -555,7 +562,7 @@ if [ "$dtls13" == "yes" ]; then
-p "$port5" -v 4 &
server_pid5=$!
sleep 0.2
timeout -s KILL 2m ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
$TIMEOUT_KILL_2M ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 \
-p "$port5"
RESULT=$?
[ "$RESULT" -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1

13
scripts/ocsp.test
View File

@ -4,8 +4,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
# Note, this script makes connection(s) to the public Internet.
@ -44,7 +49,7 @@ if [ "$OUTPUT" = "SNI is: ON" ]; then
if [ $RESULT -eq 0 ]; then
# client test against the server
echo "./examples/client/client -X -C -h $server -p 443 -A \"$ca\" -g -o -N -v d -S $server"
timeout -s KILL 2m ./examples/client/client -X -C -h $server -p 443 -A "$ca" -g -o -N -v d -S $server
$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server -p 443 -A "$ca" -g -o -N -v d -S $server
GL_RESULT=$?
[ $GL_RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection failed"
else
@ -69,7 +74,7 @@ fi
if [ $RESULT -eq 0 ]; then
# client test against the server
echo "./examples/client/client -X -C -h $server -p 443 -A \"$ca\" -g -o -N"
timeout -s KILL 2m ./examples/client/client -X -C -h $server -p 443 -A "$ca" -g -o -N
$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server -p 443 -A "$ca" -g -o -N
GR_RESULT=$?
[ $GR_RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection failed"
else

37
scripts/openssl.test
View File

@ -4,8 +4,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
# Environment variables used:
@ -370,13 +375,13 @@ do_wolfssl_client() {
echo "#"
echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite -v $version $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"
# shellcheck disable=SC2086
timeout -s KILL 2m $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
$TIMEOUT_KILL_2M $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
else
echo "#"
echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"
# do all versions
# shellcheck disable=SC2086
timeout -s KILL 2m $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
$TIMEOUT_KILL_2M $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
fi
client_result=$?
@ -432,11 +437,11 @@ do_openssl_client() {
then
echo "#"
echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
echo "Hello" | eval "timeout -s KILL 2m $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
echo "Hello" | eval "$TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
else
echo "#"
echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
echo "Hello" | eval "timeout -s KILL 2m $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
echo "Hello" | eval "$TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
fi
client_result=$?
@ -543,7 +548,7 @@ if [ "$wolf_certs" != "" ]
then
echo
# Check if RSA certificates supported in wolfSSL
wolf_rsa=$(timeout -s KILL 2m $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1)
wolf_rsa=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1)
case $wolf_rsa in
*"ca file"*)
echo "wolfSSL does not support RSA"
@ -556,7 +561,7 @@ then
echo "wolfSSL supports RSA"
fi
# Check if RSA-PSS certificates supported in wolfSSL
wolf_rsapss=$(timeout -s KILL 2m $WOLFSSL_CLIENT -A "${CERT_DIR}/rsapss/ca-rsapss.pem" 2>&1)
wolf_rsapss=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/rsapss/ca-rsapss.pem" 2>&1)
case $wolf_rsapss in
*"ca file"*)
echo "wolfSSL does not support RSA-PSS"
@ -569,7 +574,7 @@ then
echo "wolfSSL supports RSA-PSS"
fi
# Check if ECC certificates supported in wolfSSL
wolf_ecc=$(timeout -s KILL 2m $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1)
wolf_ecc=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1)
case $wolf_ecc in
*"ca file"*)
echo "wolfSSL does not support ECDSA"
@ -582,7 +587,7 @@ then
echo "wolfSSL supports ECDSA"
fi
# Check if Ed25519 certificates supported in wolfSSL
wolf_ed25519=$(timeout -s KILL 2m $WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1)
wolf_ed25519=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1)
case $wolf_ed25519 in
*"ca file"*)
echo "wolfSSL does not support Ed25519"
@ -595,7 +600,7 @@ then
echo "wolfSSL supports Ed25519"
fi
# Check if Ed25519 certificates supported in OpenSSL
openssl_ed25519=$(timeout -s KILL 2m $OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1)
openssl_ed25519=$($TIMEOUT_KILL_2M $OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1)
case $openssl_ed25519 in
*"unable to load"*)
echo "OpenSSL does not support Ed25519"
@ -608,7 +613,7 @@ then
echo "OpenSSL supports Ed25519"
fi
# Check if Ed448 certificates supported in wolfSSL
wolf_ed448=$(timeout -s KILL 2m $WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1)
wolf_ed448=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1)
case $wolf_ed448 in
*"ca file"*)
echo "wolfSSL does not support Ed448"
@ -621,7 +626,7 @@ then
echo "wolfSSL supports Ed448"
fi
# Check if Ed448 certificates supported in OpenSSL
openssl_ed448=$(timeout -s KILL 2m $OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1)
openssl_ed448=$($TIMEOUT_KILL_2M $OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1)
case $openssl_ed448 in
*"unable to load"*)
echo "OpenSSL does not support Ed448"
@ -877,7 +882,7 @@ do
# double check that can actually do a sslv3 connection using
# client-cert.pem to send but any file with EOF works
timeout -s KILL 2m $OPENSSL s_client -ssl3 -no_ign_eof -host localhost -port "$openssl_port" < "${CERT_DIR}/client-cert.pem"
$TIMEOUT_KILL_2M $OPENSSL s_client -ssl3 -no_ign_eof -host localhost -port "$openssl_port" < "${CERT_DIR}/client-cert.pem"
sslv3_sup=$?
if [ "$sslv3_sup" != 0 ]
then
@ -888,7 +893,7 @@ do
openssl_version="-ssl3"
;;
"1")
proto_check=$(echo "hell" | timeout -s KILL 2m $OPENSSL s_client -connect localhost:"$openssl_port" -tls1 2>&1)
proto_check=$(echo "hell" | $TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:"$openssl_port" -tls1 2>&1)
tlsv1_sup=$?
if [ "$tlsv1_sup" != 0 ]
then
@ -909,7 +914,7 @@ do
"2")
# Same ciphers for TLSv1.1 as TLSv1
# shellcheck disable=SC2034
proto_check=$(echo "hello" | timeout -s KILL 2m $OPENSSL s_client -connect localhost:"$openssl_port" -tls1_1 2>&1)
proto_check=$(echo "hello" | $TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:"$openssl_port" -tls1_1 2>&1)
tlsv1_1_sup=$?
if [ "$tlsv1_1_sup" != 0 ]
then

11
scripts/openssl_srtp.test
View File

@ -5,8 +5,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
set -e
@ -157,7 +162,7 @@ start_wolfssl_client() {
fi
client_output_file=/tmp/wolfssl_srtp_out
timeout -s KILL 2m ${WOLFSSL_CLIENT} -u\
$TIMEOUT_KILL_2M ${WOLFSSL_CLIENT} -u\
-x \
-v${dtls_version} \
--srtp "${srtp_profile}" \

11
scripts/pkcallbacks.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
@ -108,7 +113,7 @@ run_test() {
# starts the server on pk_port, -R generates ready file to be used as a
# mutex lock, -P does pkcallbacks. We capture the processid
# into the variable server_pid
timeout -s KILL 2m ./examples/server/server -P -R "$ready_file" -p $pk_port &
$TIMEOUT_KILL_2M ./examples/server/server -P -R "$ready_file" -p $pk_port &
server_pid=$!
counter=0

37
scripts/psk.test
View File

@ -5,10 +5,21 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
# timeout(1) exits 124, or 128+signal when it must signal the child (137 for
# the SIGKILL used here). Skip branches below turn a non-zero status into
# "feature not compiled in" and exit 0, so a hang must be told apart from a
# genuine failure or it lands in CI as a silent pass.
timed_out() { [ "$1" -eq 124 ] || [ "$1" -eq 137 ]; }
# if we can, isolate the network namespace to eliminate port collisions.
if [[ -n "$NETWORK_UNSHARE_HELPER" ]]; then
if [[ -z "$NETWORK_UNSHARE_HELPER_CALLED" ]]; then
@ -108,9 +119,14 @@ port=0
./examples/server/server -s -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -s -p $port
$TIMEOUT_KILL_2M ./examples/client/client -s -p $port
RESULT=$?
remove_ready_file
if timed_out $RESULT; then
echo -e "\n\nPSK probe client timed out"
do_cleanup
exit 1
fi
# if fail here then is a settings issue so return 0
if [ $RESULT -ne 0 ]; then
echo -e "\n\nPSK not enabled"
@ -122,9 +138,9 @@ echo ""
# client test against the server
###############################
timeout -s KILL 2m ./examples/client/client -v 3 2>&1 | grep -- 'Bad SSL version'
$TIMEOUT_KILL_2M ./examples/client/client -v 3 2>&1 | grep -- 'Bad SSL version'
pipe_rc=("${PIPESTATUS[@]}")
if [ "${pipe_rc[0]}" -ge 124 ]; then
if timed_out "${pipe_rc[0]}"; then
echo "client version probe timed out"
exit 1
fi
@ -136,9 +152,14 @@ if [ "${pipe_rc[1]}" -ne 0 ]; then
./examples/server/server -R "$ready_file" -p $port -l DHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-DES-CBC3-SHA &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -p $port
$TIMEOUT_KILL_2M ./examples/client/client -p $port
RESULT=$?
remove_ready_file
if timed_out $RESULT; then
echo -e "\n\nnon PSK suite probe client timed out"
do_cleanup
exit 1
fi
# if fail here then is a settings issue so return 0
if [ $RESULT -ne 0 ]; then
echo -e "\n\nIssue with chosen non PSK suites"
@ -152,7 +173,7 @@ if [ "${pipe_rc[1]}" -ne 0 ]; then
./examples/server/server -j -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -p $port
$TIMEOUT_KILL_2M ./examples/client/client -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
@ -169,7 +190,7 @@ if [ "${pipe_rc[1]}" -ne 0 ]; then
./examples/server/server -j -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -x -p $port
$TIMEOUT_KILL_2M ./examples/client/client -x -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -eq 0 ]; then

11
scripts/resume.test
View File

@ -2,8 +2,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
@ -84,7 +89,7 @@ do_test() {
remove_ready_file
echo "./examples/server/server -r -R \"$ready_file\" -p $resume_port"
timeout -s KILL 2m ./examples/server/server -r -R "$ready_file" -p $resume_port &
$TIMEOUT_KILL_2M ./examples/server/server -r -R "$ready_file" -p $resume_port &
server_pid=$!
counter=0

13
scripts/rsapss.test
View File

@ -4,8 +4,13 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
[ ! -x ./examples/client/client ] && printf '\n\n%s\n' "Client doesn't exist" \
@ -115,14 +120,14 @@ WOLFSSL_SERVER=./examples/server/server
start_wolfssl_server() {
generate_port
server_port=$port
timeout -s KILL 2m $WOLFSSL_SERVER -p "$server_port" -v 4 -c "$CERT_DIR"/rsapss/server-rsapss.pem -k "$CERT_DIR"/rsapss/server-rsapss-priv.pem -A "$CERT_DIR"/rsapss/root-rsapss.pem -d &
$TIMEOUT_KILL_2M $WOLFSSL_SERVER -p "$server_port" -v 4 -c "$CERT_DIR"/rsapss/server-rsapss.pem -k "$CERT_DIR"/rsapss/server-rsapss-priv.pem -A "$CERT_DIR"/rsapss/root-rsapss.pem -d &
}
#
# Run OpenSSL client against wolfSSL server
#
do_openssl_client() {
echo "test connection" | timeout -s KILL 2m $OPENSSL s_client -connect 127.0.0.1:"$server_port" -cert "$CERT_DIR"/rsapss/client-rsapss.pem -key "$CERT_DIR"/rsapss/client-rsapss-priv.pem -CAfile "$CERT_DIR"/rsapss/root-rsapss.pem > rsapss.test.log
echo "test connection" | $TIMEOUT_KILL_2M $OPENSSL s_client -connect 127.0.0.1:"$server_port" -cert "$CERT_DIR"/rsapss/client-rsapss.pem -key "$CERT_DIR"/rsapss/client-rsapss-priv.pem -CAfile "$CERT_DIR"/rsapss/root-rsapss.pem > rsapss.test.log
result=$?
cat rsapss.test.log
if [ "$result" != 0 ]

46
scripts/tls13.test
View File

@ -2,10 +2,20 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
# timeout(1) exits 124, or 128+signal when it must signal the child (137 for
# the SIGKILL used here). A hang must be told apart from a genuine non-zero
# exit, or it is misread as a feature-not-available skip.
timed_out() { [ "$1" -eq 124 ] || [ "$1" -eq 137 ]; }
# tls13.test
# Copyright wolfSSL 2016-2021
@ -126,10 +136,10 @@ fi
# Usual TLS v1.3 server / TLS v1.3 client.
echo -e "\n\nTLS v1.3 server with TLS v1.3 client"
port=0
timeout -s KILL 2m ./examples/server/server -v 4 -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -v 4 -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -v 4 -p $port | tee "$client_file"
$TIMEOUT_KILL_2M ./examples/client/client -v 4 -p $port | tee "$client_file"
RESULT=${PIPESTATUS[0]}
remove_ready_file
if [ $RESULT -ne 0 ]; then
@ -142,10 +152,10 @@ echo ""
# TLS 1.3 cipher suites server / client.
echo -e "\n\nTLS v1.3 cipher suite mismatch"
port=0
timeout -s KILL 2m ./examples/server/server -v 4 -R "$ready_file" -p $port -l TLS13-AES128-GCM-SHA256 &
$TIMEOUT_KILL_2M ./examples/server/server -v 4 -R "$ready_file" -p $port -l TLS13-AES128-GCM-SHA256 &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -v 4 -p $port -l TLS13-AES256-GCM-SHA384
$TIMEOUT_KILL_2M ./examples/client/client -v 4 -p $port -l TLS13-AES256-GCM-SHA384
RESULT=$?
remove_ready_file
if [ $RESULT -eq 0 ]; then
@ -164,10 +174,10 @@ if [ $NO_CERTS -ne 0 -a $NO_CLIENT_AUTH -ne 0 ]; then
# TLS 1.3 mutual auth required but client doesn't send certificates.
echo -e "\n\nTLS v1.3 mutual auth fail"
port=0
timeout -s KILL 2m ./examples/server/server -v 4 -F -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -v 4 -F -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -v 4 -x -p $port
$TIMEOUT_KILL_2M ./examples/client/client -v 4 -x -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -eq 0 ]; then
@ -180,9 +190,9 @@ if [ $NO_CERTS -ne 0 -a $NO_CLIENT_AUTH -ne 0 ]; then
fi
# Check for TLS 1.2 support
timeout -s KILL 2m ./examples/client/client -v 3 2>&1 | grep -F -e 'Bad SSL version'
$TIMEOUT_KILL_2M ./examples/client/client -v 3 2>&1 | grep -F -e 'Bad SSL version'
pipe_rc=("${PIPESTATUS[@]}")
if [ "${pipe_rc[0]}" -ge 124 ]; then
if timed_out "${pipe_rc[0]}"; then
echo -e "\n\nTLS v1.2 support probe timed out"
exit 1
fi
@ -190,10 +200,10 @@ if [ "${pipe_rc[1]}" -ne 0 ]; then
# TLS 1.3 server / TLS 1.2 client.
echo -e "\n\nTLS v1.3 server downgrading to TLS v1.2"
port=0
timeout -s KILL 2m ./examples/server/server -v 4 -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -v 4 -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -v 3 -p $port
$TIMEOUT_KILL_2M ./examples/client/client -v 3 -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -eq 0 ]; then
@ -207,10 +217,10 @@ if [ "${pipe_rc[1]}" -ne 0 ]; then
# TLS 1.2 server / TLS 1.3 client.
echo -e "\n\nTLS v1.3 client upgrading server to TLS v1.3"
port=0
timeout -s KILL 2m ./examples/server/server -v 3 -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -v 3 -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -v 4 -p $port
$TIMEOUT_KILL_2M ./examples/client/client -v 4 -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -eq 0 ]; then
@ -238,10 +248,10 @@ if [ "${pipe_rc[1]}" -ne 0 ]; then
port=0
SERVER_CS="TLS13-AES256-GCM-SHA384:$TLS12_CS"
CLIENT_CS="TLS13-AES128-GCM-SHA256:$TLS12_CS"
timeout -s KILL 2m ./examples/server/server -v d -l $SERVER_CS -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -v d -l $SERVER_CS -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -v d -l $CLIENT_CS -p $port
$TIMEOUT_KILL_2M ./examples/client/client -v d -l $CLIENT_CS -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -eq 0 ]; then
@ -273,7 +283,7 @@ if [ "$early_data" = "yes" ]; then
echo -e "\n\nTLS v1.3 Early Data - session ticket"
port=0
(timeout -s KILL 2m ./examples/server/server -v 4 -r -0 -R "$ready_file" -p $port 2>&1 | \
($TIMEOUT_KILL_2M ./examples/server/server -v 4 -r -0 -R "$ready_file" -p $port 2>&1 | \
tee "$server_out_file") &
server_pid=$!
create_port
@ -321,7 +331,7 @@ if [ "$early_data" = "yes" -a "$psk" = "yes" ]; then
early_data_try_num=1
while :; do
(timeout -s KILL 2m ./examples/server/server -v 4 -s -0 -R "$ready_file" -p $port 2>&1 | \
($TIMEOUT_KILL_2M ./examples/server/server -v 4 -s -0 -R "$ready_file" -p $port 2>&1 | \
tee "$server_out_file") &
server_pid=$!
create_port

60
scripts/trusted_peer.test
View File

@ -5,10 +5,21 @@
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
if ! command -v timeout >/dev/null 2>&1; then
timeout() { while [ "${1:-}" = "-s" ] || [ "${1:-}" = "-k" ]; do shift 2; done; shift; "$@"; }
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
TIMEOUT_KILL_2M=""
fi
# timeout(1) exits 124, or 128+signal when it must signal the child (137 for
# the SIGKILL used here). Skip branches below turn a non-zero status into
# "feature not compiled in" and exit 0, so a hang must be told apart from a
# genuine failure or it lands in CI as a silent pass.
timed_out() { [ "$1" -eq 124 ] || [ "$1" -eq 137 ]; }
[ ! -x ./examples/client/client ] && printf '\n\n%s\n' "Client doesn't exist" \
&& exit 1
@ -145,12 +156,17 @@ echo "Checking built with trusted peer certs "
echo "-----------------------------------------------------"
port=0
remove_ready_file
timeout -s KILL 2m ./examples/server/server -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$client_ca" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -p $port
RESULT=$?
remove_ready_file
if timed_out $RESULT; then
echo -e "\n\nTrusted peer cert probe client timed out"
do_cleanup
exit 1
fi
# if fail here then is a settings issue so return 0
if [ $RESULT -ne 0 ]; then
echo -e "\n\nTrusted peer certs not enabled \"WOLFSSL_TRUST_PEER_CERT\""
@ -163,10 +179,10 @@ echo ""
echo "Server and Client relying on trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
timeout -s KILL 2m ./examples/server/server -A "$wrong_ca" -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -A "$wrong_ca" -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$wrong_ca" -E "$server_cert" -c "$client_cert" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$wrong_ca" -E "$server_cert" -c "$client_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
@ -180,10 +196,10 @@ echo ""
echo "Server relying on trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
timeout -s KILL 2m ./examples/server/server -A "$wrong_ca" -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -A "$wrong_ca" -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$client_ca" -c "$client_cert" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -c "$client_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
@ -197,10 +213,10 @@ echo ""
echo "Client relying on trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
timeout -s KILL 2m ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$wrong_ca" -E "$server_cert" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$wrong_ca" -E "$server_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
@ -214,10 +230,10 @@ echo ""
echo "Client fall through to loaded CAs"
echo "-----------------------------------------------------"
port=0
timeout -s KILL 2m ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$client_ca" -E "$wrong_cert" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -E "$wrong_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
@ -233,10 +249,10 @@ if [[ $wrong_ca != *"ecc"* ]]; then
echo "Client wrong CA and wrong trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
timeout -s KILL 2m ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$wrong_ca" -E "$wrong_cert" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$wrong_ca" -E "$wrong_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -eq 0 ]; then
@ -251,10 +267,10 @@ fi
echo "Server wrong CA and wrong trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
timeout -s KILL 2m ./examples/server/server -A "$wrong_ca" -E "$wrong_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -A "$wrong_ca" -E "$wrong_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$client_ca" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -eq 0 ]; then
@ -268,10 +284,10 @@ echo ""
echo "Server fall through to loaded CAs"
echo "-----------------------------------------------------"
port=0
timeout -s KILL 2m ./examples/server/server -E "$wrong_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -E "$wrong_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$client_ca" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
@ -287,24 +303,24 @@ echo "Test two success cases and one fail case"
echo "-----------------------------------------------------"
port=0
cat "$client_cert" "$client_ca" > "$combined_cert"
timeout -s KILL 2m ./examples/server/server -i -A "$wrong_ca" -E "$combined_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
$TIMEOUT_KILL_2M ./examples/server/server -i -A "$wrong_ca" -E "$combined_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
timeout -s KILL 2m ./examples/client/client -A "$client_ca" -c "$client_cert" -k "$client_key" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -c "$client_cert" -k "$client_key" -p $port
RESULT=$?
if [ $RESULT -ne 0 ]; then
echo -e "\nServer load multiple trusted peer certs failed!"
do_cleanup
exit 1
fi
timeout -s KILL 2m ./examples/client/client -A "$client_ca" -c "$client_ca" -k "$ca_key" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -c "$client_ca" -k "$ca_key" -p $port
RESULT=$?
if [ $RESULT -ne 0 ]; then
echo -e "\nServer load multiple trusted peer certs failed!"
do_cleanup
exit 1
fi
timeout -s KILL 2m ./examples/client/client -A "$client_ca" -c "$wrong_cert" -k "$client_key" -p $port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -c "$wrong_cert" -k "$client_key" -p $port
RESULT=$?
if [ $RESULT -eq 0 ]; then
echo -e "\nServer load multiple trusted peer certs failed!"