WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Send SNI in external.test so the peer returns its own certificate 

scripts/external.test connects to www.wolfssl.com without a server_name
extension, so the CDN in front of that host answers with its own default
certificate rather than the wolfSSL one. That chain currently runs through
the RSA-4096 GlobalSign Root R46, while the intended chain is RSA-2048
throughout, so the test only passes on builds able to verify a 4096-bit
signature.

Two PRB configurations fail on master because of it. The fastmath leg with
FP_MAX_BITS=6144 reports BUFFER_E, and the 32-bit leg reports
ASN_SIG_CONFIRM_E because a build without WOLFSSL_X86_64_BUILD,
WOLFSSL_AARCH64_BUILD or OPENSSL_EXTRA defaults SP_INT_BITS to 3072. Both
are correct refusals to handle a key larger than the build supports, so the
test, not the library, is what needs fixing.

Name the host with -S in both client invocations. The option is a no-op
where the build lacks SNI, so those configurations keep their current
behavior, and the check uses the client's own "-S check" probe to decide.

Verified by building master with CFLAGS=-DSP_INT_BITS=3072, which
reproduces the BUFFER_E failure, and confirming the test passes with this
change in the same build and in an --enable-all build.
pull/11370/head
Tobias Frauenschläger 2026-09-04 13:13:10 +02:00 committed by Daniele Lacamera
parent 9d4968db3d
commit 38fba1147f
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
scripts/external.test
View File

@ -50,13 +50,21 @@ fi
echo "WOLFSSL_EXTERNAL_TEST set, running test..."
# The CDN in front of $server answers a request without SNI using its own
# default certificate, whose chain needs a larger RSA key than some builds
# support, so name the host wherever the build can.
sni=""
if ./examples/client/client -S check | grep -q 'SNI is: ON'; then
sni="-S $server"
fi
# is our desired server there?
"${SCRIPT_DIR}"/ping.test $server 2
RESULT=$?
[ $RESULT -ne 0 ] && exit 0
# client test against the server
$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server -p 443 -g -A $ca
$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server $sni -p 443 -g -A $ca
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
@ -66,7 +74,7 @@ RESULT=$?
BUILD_FLAGS="$(./examples/client/client '-#')"
if echo "$BUILD_FLAGS" | grep -q "WOLFSSL_SYS_CA_CERTS" && ! echo "$BUILD_FLAGS" | grep -q "WOLFSSL_STATIC_MEMORY"; then
echo -e "\nConnecting using WOLFSSL_SYS_CA_CERTS..."
./examples/client/client -X -C -h $server -p 443 -g --sys-ca-certs
./examples/client/client -X -C -h $server $sni -p 443 -g --sys-ca-certs
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed when using WOLFSSL_SYS_CA_CERTS" && exit 1
fi