mirror of https://github.com/wolfSSL/wolfssl.git
83 lines
2.9 KiB
Bash
Executable File
83 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# external.test
|
|
|
|
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
|
|
# command unbounded (the flaky hang this guards against is Linux-only CI).
|
|
# A prefix variable rather than a shell function: backgrounding a function
|
|
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
|
|
# wrapper and orphan the server it was meant to kill.
|
|
if command -v timeout >/dev/null 2>&1; then
|
|
TIMEOUT_KILL_2M="timeout -s KILL 2m"
|
|
else
|
|
TIMEOUT_KILL_2M=""
|
|
fi
|
|
|
|
SCRIPT_DIR="$(dirname "$0")"
|
|
|
|
server=www.wolfssl.com
|
|
ca=./certs/wolfssl-website-ca.pem
|
|
|
|
[ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
|
|
|
|
# www.wolfssl.com isn't using RFC 8446 yet but the draft instead.
|
|
if ! ./examples/client/client -V | grep -q 3; then
|
|
echo 'skipping external.test because TLS1.2 is not available.' 1>&2
|
|
exit 77
|
|
fi
|
|
|
|
# cloudflare seems to change CAs quickly, disabled by default
|
|
if ! test -n "$WOLFSSL_EXTERNAL_TEST"; then
|
|
echo "WOLFSSL_EXTERNAL_TEST not set, won't run"
|
|
exit 77
|
|
fi
|
|
if test "$WOLFSSL_EXTERNAL_TEST" == "0"; then
|
|
echo "WOLFSSL_EXTERNAL_TEST is defined to zero, won't run"
|
|
exit 77
|
|
fi
|
|
|
|
|
|
BUILD_FLAGS="$(./examples/client/client '-#')"
|
|
if echo "$BUILD_FLAGS" | fgrep -q -e ' -DWOLFSSL_SNIFFER '; then
|
|
echo 'skipping WOLFSSL_EXTERNAL_TEST because -DWOLFSSL_SNIFFER configuration of build is incompatible.'
|
|
exit 77
|
|
fi
|
|
|
|
if echo "$BUILD_FLAGS" | fgrep -v -q -e ' -DHAVE_ECC '; then
|
|
echo 'skipping WOLFSSL_EXTERNAL_TEST because -UHAVE_ECC configuration of build is incompatible.'
|
|
exit 77
|
|
fi
|
|
|
|
echo "WOLFSSL_EXTERNAL_TEST set, running test..."
|
|
|
|
# The CDN in front of $server answers a request without SNI using its own
|
|
# default certificate, whose chain needs a larger RSA key than some builds
|
|
# support, so name the host wherever the build can.
|
|
sni=""
|
|
if ./examples/client/client -S check | grep -q 'SNI is: ON'; then
|
|
sni="-S $server"
|
|
fi
|
|
|
|
# is our desired server there?
|
|
"${SCRIPT_DIR}"/ping.test $server 2
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && exit 0
|
|
|
|
# client test against the server
|
|
$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server $sni -p 443 -g -A $ca
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
|
|
|
|
# test again, but using system CA certs to verify the server if support is enabled.
|
|
# We don't want to use --sys-ca-certs with static memory, as we don't know how
|
|
# much memory will be required to store an unbounded number of certs
|
|
BUILD_FLAGS="$(./examples/client/client '-#')"
|
|
if echo "$BUILD_FLAGS" | grep -q "WOLFSSL_SYS_CA_CERTS" && ! echo "$BUILD_FLAGS" | grep -q "WOLFSSL_STATIC_MEMORY"; then
|
|
echo -e "\nConnecting using WOLFSSL_SYS_CA_CERTS..."
|
|
./examples/client/client -X -C -h $server $sni -p 443 -g --sys-ca-certs
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed when using WOLFSSL_SYS_CA_CERTS" && exit 1
|
|
fi
|
|
|
|
exit 0
|