mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-30 14:44:11 +02:00
Fix CI: expand the openssl.test timeout prefix under IFS=:
openssl.test sets IFS=: around its cipher suite loops, so an unquoted $TIMEOUT_KILL_2M inside them did not split back into separate words and the shell looked for a command literally named "timeout -s KILL 2m". Every wolfSSL client run in do_wolfssl_client() then died with "command not found", which the script reported as a failing cipher suite. Use an array, whose expansion does not depend on IFS, and keep a flattened copy for the two eval call sites, where the shell re-parses the string and IFS does not apply.
This commit is contained in:
Juliusz Sosinowicz
+25
-19
@@ -4,14 +4,20 @@
|
||||
|
||||
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
|
||||
# command unbounded (the flaky hang this guards against is Linux-only CI).
|
||||
# A prefix variable rather than a shell function: backgrounding a function
|
||||
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
|
||||
# wrapper and orphan the server it was meant to kill.
|
||||
# A prefix rather than a shell function: backgrounding a function makes $! the
|
||||
# forked subshell, so a later "kill $server_pid" would stop the wrapper and
|
||||
# orphan the server it was meant to kill. It is an array because this script
|
||||
# sets IFS=: around its main loops, where an unquoted expansion of a plain
|
||||
# string would not split back into separate words.
|
||||
if command -v timeout >/dev/null 2>&1; then
|
||||
TIMEOUT_KILL_2M="timeout -s KILL 2m"
|
||||
TIMEOUT_KILL_2M=(timeout -s KILL 2m)
|
||||
else
|
||||
TIMEOUT_KILL_2M=""
|
||||
TIMEOUT_KILL_2M=()
|
||||
fi
|
||||
# The same prefix flattened, for the eval call sites: eval re-parses its
|
||||
# argument, so the shell grammar splits it there and IFS does not apply. Built
|
||||
# here while IFS still holds its default value.
|
||||
TIMEOUT_KILL_2M_EVAL="${TIMEOUT_KILL_2M[*]}"
|
||||
|
||||
# Environment variables used:
|
||||
# OPENSSL (openssl app to use)
|
||||
@@ -375,13 +381,13 @@ do_wolfssl_client() {
|
||||
echo "#"
|
||||
echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite -v $version $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"
|
||||
# shellcheck disable=SC2086
|
||||
$TIMEOUT_KILL_2M $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
|
||||
"${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
|
||||
else
|
||||
echo "#"
|
||||
echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"
|
||||
# do all versions
|
||||
# shellcheck disable=SC2086
|
||||
$TIMEOUT_KILL_2M $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
|
||||
"${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
|
||||
fi
|
||||
|
||||
client_result=$?
|
||||
@@ -437,11 +443,11 @@ do_openssl_client() {
|
||||
then
|
||||
echo "#"
|
||||
echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
||||
echo "Hello" | eval "$TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
||||
echo "Hello" | eval "$TIMEOUT_KILL_2M_EVAL $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
||||
else
|
||||
echo "#"
|
||||
echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
||||
echo "Hello" | eval "$TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
||||
echo "Hello" | eval "$TIMEOUT_KILL_2M_EVAL $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
||||
fi
|
||||
|
||||
client_result=$?
|
||||
@@ -548,7 +554,7 @@ if [ "$wolf_certs" != "" ]
|
||||
then
|
||||
echo
|
||||
# Check if RSA certificates supported in wolfSSL
|
||||
wolf_rsa=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1)
|
||||
wolf_rsa=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1)
|
||||
case $wolf_rsa in
|
||||
*"ca file"*)
|
||||
echo "wolfSSL does not support RSA"
|
||||
@@ -561,7 +567,7 @@ then
|
||||
echo "wolfSSL supports RSA"
|
||||
fi
|
||||
# Check if RSA-PSS certificates supported in wolfSSL
|
||||
wolf_rsapss=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/rsapss/ca-rsapss.pem" 2>&1)
|
||||
wolf_rsapss=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/rsapss/ca-rsapss.pem" 2>&1)
|
||||
case $wolf_rsapss in
|
||||
*"ca file"*)
|
||||
echo "wolfSSL does not support RSA-PSS"
|
||||
@@ -574,7 +580,7 @@ then
|
||||
echo "wolfSSL supports RSA-PSS"
|
||||
fi
|
||||
# Check if ECC certificates supported in wolfSSL
|
||||
wolf_ecc=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1)
|
||||
wolf_ecc=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1)
|
||||
case $wolf_ecc in
|
||||
*"ca file"*)
|
||||
echo "wolfSSL does not support ECDSA"
|
||||
@@ -587,7 +593,7 @@ then
|
||||
echo "wolfSSL supports ECDSA"
|
||||
fi
|
||||
# Check if Ed25519 certificates supported in wolfSSL
|
||||
wolf_ed25519=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1)
|
||||
wolf_ed25519=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1)
|
||||
case $wolf_ed25519 in
|
||||
*"ca file"*)
|
||||
echo "wolfSSL does not support Ed25519"
|
||||
@@ -600,7 +606,7 @@ then
|
||||
echo "wolfSSL supports Ed25519"
|
||||
fi
|
||||
# Check if Ed25519 certificates supported in OpenSSL
|
||||
openssl_ed25519=$($TIMEOUT_KILL_2M $OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1)
|
||||
openssl_ed25519=$("${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1)
|
||||
case $openssl_ed25519 in
|
||||
*"unable to load"*)
|
||||
echo "OpenSSL does not support Ed25519"
|
||||
@@ -613,7 +619,7 @@ then
|
||||
echo "OpenSSL supports Ed25519"
|
||||
fi
|
||||
# Check if Ed448 certificates supported in wolfSSL
|
||||
wolf_ed448=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1)
|
||||
wolf_ed448=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1)
|
||||
case $wolf_ed448 in
|
||||
*"ca file"*)
|
||||
echo "wolfSSL does not support Ed448"
|
||||
@@ -626,7 +632,7 @@ then
|
||||
echo "wolfSSL supports Ed448"
|
||||
fi
|
||||
# Check if Ed448 certificates supported in OpenSSL
|
||||
openssl_ed448=$($TIMEOUT_KILL_2M $OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1)
|
||||
openssl_ed448=$("${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1)
|
||||
case $openssl_ed448 in
|
||||
*"unable to load"*)
|
||||
echo "OpenSSL does not support Ed448"
|
||||
@@ -882,7 +888,7 @@ do
|
||||
|
||||
# double check that can actually do a sslv3 connection using
|
||||
# client-cert.pem to send but any file with EOF works
|
||||
$TIMEOUT_KILL_2M $OPENSSL s_client -ssl3 -no_ign_eof -host localhost -port "$openssl_port" < "${CERT_DIR}/client-cert.pem"
|
||||
"${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -ssl3 -no_ign_eof -host localhost -port "$openssl_port" < "${CERT_DIR}/client-cert.pem"
|
||||
sslv3_sup=$?
|
||||
if [ "$sslv3_sup" != 0 ]
|
||||
then
|
||||
@@ -893,7 +899,7 @@ do
|
||||
openssl_version="-ssl3"
|
||||
;;
|
||||
"1")
|
||||
proto_check=$(echo "hell" | $TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:"$openssl_port" -tls1 2>&1)
|
||||
proto_check=$(echo "hell" | "${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -connect localhost:"$openssl_port" -tls1 2>&1)
|
||||
tlsv1_sup=$?
|
||||
if [ "$tlsv1_sup" != 0 ]
|
||||
then
|
||||
@@ -914,7 +920,7 @@ do
|
||||
"2")
|
||||
# Same ciphers for TLSv1.1 as TLSv1
|
||||
# shellcheck disable=SC2034
|
||||
proto_check=$(echo "hello" | $TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:"$openssl_port" -tls1_1 2>&1)
|
||||
proto_check=$(echo "hello" | "${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -connect localhost:"$openssl_port" -tls1_1 2>&1)
|
||||
tlsv1_1_sup=$?
|
||||
if [ "$tlsv1_1_sup" != 0 ]
|
||||
then
|
||||
|
||||
Reference in New Issue
Block a user