wolfssl/scripts/trusted_peer.test

#!/usr/bin/env bash

# trusted_peer.test
# copyright wolfSSL 2016

# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
# command unbounded (the flaky hang this guards against is Linux-only CI).
# A prefix variable rather than a shell function: backgrounding a function
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
# wrapper and orphan the server it was meant to kill.
if command -v timeout >/dev/null 2>&1; then
    TIMEOUT_KILL_2M="timeout -s KILL 2m"
else
    TIMEOUT_KILL_2M=""
fi

# timeout(1) exits 124, or 128+signal when it must signal the child (137 for
# the SIGKILL used here). Skip branches below turn a non-zero status into
# "feature not compiled in" and exit 0, so a hang must be told apart from a
# genuine failure or it lands in CI as a silent pass.
timed_out() { [ "$1" -eq 124 ] || [ "$1" -eq 137 ]; }

[ ! -x ./examples/client/client ] && printf '\n\n%s\n' "Client doesn't exist" \
                                  && exit 1

if ./examples/client/client -? 2>&1 | grep "Client not compiled in!" ; then
    echo 'skipping trusted_peer.test because client not compiled in.' 1>&2
    exit 77
fi

if ./examples/server/server -? 2>&1 | grep "Server not compiled in!" ; then
    echo 'skipping trusted_peer.test because server not compiled in.' 1>&2
    exit 77
fi

# if we can, isolate the network namespace to eliminate port collisions.
if [[ -n "$NETWORK_UNSHARE_HELPER" ]]; then
     if [[ -z "$NETWORK_UNSHARE_HELPER_CALLED" ]]; then
         export NETWORK_UNSHARE_HELPER_CALLED=yes
         exec "$NETWORK_UNSHARE_HELPER" "$0" "$@" || exit $?
     fi
elif [ "${AM_BWRAPPED-}" != "yes" ]; then
    bwrap_path="$(command -v bwrap)"
    if [ -n "$bwrap_path" ]; then
        export AM_BWRAPPED=yes
        exec "$bwrap_path" --unshare-net --dev-bind / / "$0" "$@"
    fi
    unset AM_BWRAPPED
fi

# getting unique port is modeled after resume.test script
# need a unique port since may run the same time as testsuite
# use server port zero hack to get one
port=0
no_pid=-1
server_pid=$no_pid
counter=0
# let's use absolute path to a local dir (make distcheck may be in sub dir)
# also let's add some randomness by adding pid in case multiple 'make check's
# per source tree
ready_file=`pwd`/wolfssl_tp_ready$$

# variables for certs so can use RSA or ECC
client_cert=`pwd`/certs/client-cert.pem
client_ca=`pwd`/certs/ca-cert.pem
client_key=`pwd`/certs/client-key.pem
ca_key=`pwd`/certs/ca-key.pem
server_cert=`pwd`/certs/server-cert.pem
server_key=`pwd`/certs/server-key.pem
combined_cert=`pwd`/certs/client_combined.pem
wrong_ca=`pwd`/certs/wolfssl-website-ca.pem
wrong_cert=`pwd`/certs/server-revoked-cert.pem

echo "ready file \"$ready_file\""

create_port() {
    counter=0
    while [ ! -s "$ready_file" -a "$counter" -lt 20 ]; do
        echo -e "waiting for ready file..."
        sleep 0.1
        counter=$((counter+ 1))
    done

    if test -e "$ready_file"; then
        echo -e "found ready file, starting client..."

        # sleep for an additional 0.1 to mitigate race on write/read of $ready_file:
        sleep 0.1

        # get created port 0 ephemeral port
        port=`cat "$ready_file"`
    else
        echo -e "NO ready file ending test..."
        do_cleanup
    fi
}

remove_ready_file() {
    if test -e "$ready_file"; then
        echo -e "removing existing ready file"
    rm "$ready_file"
    fi
}

do_cleanup() {
    echo "in cleanup"

    if [ $server_pid != $no_pid ] && kill -0 $server_pid 2>&-
    then
        # sleep to give sanitizers time to dump backtraces.
        sleep 1
        echo "killing server"
        kill $server_pid
    fi
    remove_ready_file
}

do_trap() {
    echo "got trap"
    do_cleanup
    exit 1
}

trap do_trap INT TERM

[ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1

# Look for if RSA and/or ECC is enabled and adjust certs/keys
ciphers=`./examples/client/client -e`
if [[  "$ciphers" != *"RSA"* ]]; then
    if [[ $ciphers == *"ECDSA"* ]]; then
        client_cert=`pwd`/certs/client-ecc-cert.pem
        client_ca=`pwd`/certs/server-ecc.pem
        client_key=`pwd`/certs/ecc-client-key.pem
        ca_key=`pwd`/certs/ecc-key.pem
        server_cert=`pwd`/certs/server-ecc.pem
        server_key=`pwd`/certs/ecc-key.pem
        wrong_ca=`pwd`/certs/server-ecc-comp.pem
        wrong_cert=`pwd`/certs/server-ecc-comp.pem
    else
        echo "configure options not set up for test. No RSA or ECC"
        exit 0
    fi
fi

# CRL list not set up for tests
crl_test=`./examples/client/client -h`
if [[ "$crl_test" == *"-C "* ]]; then
    echo "test not set up to run with CRL"
    exit 0
fi

# Test for trusted peer certs build
echo ""
echo "Checking built with trusted peer certs "
echo "-----------------------------------------------------"
port=0
remove_ready_file
$TIMEOUT_KILL_2M ./examples/server/server -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -p $port
RESULT=$?
remove_ready_file
if timed_out $RESULT; then
    echo -e "\n\nTrusted peer cert probe client timed out"
    do_cleanup
    exit 1
fi
# if fail here then is a settings issue so return 0
if [ $RESULT -ne 0 ]; then
    echo -e "\n\nTrusted peer certs not enabled \"WOLFSSL_TRUST_PEER_CERT\""
    do_cleanup
    exit 0
fi
echo ""

# Test that using no CA's and only trusted peer certs works
echo "Server and Client relying on trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
$TIMEOUT_KILL_2M ./examples/server/server -A "$wrong_ca" -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$wrong_ca" -E "$server_cert" -c "$client_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
    echo -e "\nServer and Client trusted peer cert failed!"
    do_cleanup
    exit 1
fi
echo ""

# Test that using server trusted peer certs works
echo "Server relying on trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
$TIMEOUT_KILL_2M ./examples/server/server -A "$wrong_ca" -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -c "$client_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
    echo -e "\nServer trusted peer cert test failed!"
    do_cleanup
    exit 1
fi
echo ""

# Test that using client trusted peer certs works
echo "Client relying on trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
$TIMEOUT_KILL_2M ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$wrong_ca" -E "$server_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
    echo -e "\nClient trusted peer cert test failed!"
    do_cleanup
    exit 1
fi
echo ""

# Test that client fall through to CA works
echo "Client fall through to loaded CAs"
echo "-----------------------------------------------------"
port=0
$TIMEOUT_KILL_2M ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -E "$wrong_cert" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
    echo -e "\nClient trusted peer cert fall through to CA test failed!"
    do_cleanup
    exit 1
fi
echo ""

# Test that client can fail
# check if using ECC client example is hard coded to load correct ECC ca so skip
if [[ $wrong_ca != *"ecc"* ]]; then
echo "Client wrong CA and wrong trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
$TIMEOUT_KILL_2M ./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$wrong_ca" -E "$wrong_cert" -p $port
RESULT=$?
remove_ready_file
if timed_out $RESULT; then
    echo -e "\nClient trusted peer cert test timed out!"
    do_cleanup
    exit 1
fi
if [ $RESULT -eq 0 ]; then
    echo -e "\nClient trusted peer cert test failed!"
    do_cleanup
    exit 1
fi
echo ""
fi

# Test that server can fail
echo "Server wrong CA and wrong trusted peer cert loaded"
echo "-----------------------------------------------------"
port=0
$TIMEOUT_KILL_2M ./examples/server/server -A "$wrong_ca" -E "$wrong_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -p $port
RESULT=$?
remove_ready_file
if timed_out $RESULT; then
    echo -e "\nServer trusted peer cert test timed out!"
    do_cleanup
    exit 1
fi
if [ $RESULT -eq 0 ]; then
    echo -e "\nServer trusted peer cert test failed!"
    do_cleanup
    exit 1
fi
echo ""

# Test that server fall through to CA works
echo "Server fall through to loaded CAs"
echo "-----------------------------------------------------"
port=0
$TIMEOUT_KILL_2M ./examples/server/server -E "$wrong_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -p $port
RESULT=$?
remove_ready_file
if [ $RESULT -ne 0 ]; then
    echo -e "\nServer trusted peer cert fall through to CA test failed!"
    do_cleanup
    exit 1
fi
echo ""

# test loading multiple certs
echo "Server loading multiple trusted peer certs"
echo "Test two success cases and one fail case"
echo "-----------------------------------------------------"
port=0
cat "$client_cert" "$client_ca" > "$combined_cert"
$TIMEOUT_KILL_2M ./examples/server/server -i -A "$wrong_ca" -E "$combined_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
server_pid=$!
create_port
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -c "$client_cert" -k "$client_key" -p $port
RESULT=$?
if [ $RESULT -ne 0 ]; then
    echo -e "\nServer load multiple trusted peer certs failed!"
    do_cleanup
    exit 1
fi
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -c "$client_ca" -k "$ca_key"  -p $port
RESULT=$?
if [ $RESULT -ne 0 ]; then
    echo -e "\nServer load multiple trusted peer certs failed!"
    do_cleanup
    exit 1
fi
$TIMEOUT_KILL_2M ./examples/client/client -A "$client_ca" -c "$wrong_cert" -k "$client_key" -p $port
RESULT=$?
if timed_out $RESULT; then
    echo -e "\nServer load multiple trusted peer certs timed out!"
    do_cleanup
    exit 1
fi
if [ $RESULT -eq 0 ]; then
    echo -e "\nServer load multiple trusted peer certs failed!"
    do_cleanup
    exit 1
fi

do_cleanup # kill PID of server running in infinite loop
rm "$combined_cert"
remove_ready_file
echo ""

echo "-----------------------------------------------------"
echo "ALL TESTS PASSED"
echo "-----------------------------------------------------"

exit 0