From 3a0da7013ede68a1ff94de95b4e72e607ba2d9ab Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Fri, 14 Aug 2026 13:50:06 +0000 Subject: [PATCH] Fix CI: expand the openssl.test timeout prefix under IFS=: openssl.test sets IFS=: around its cipher suite loops, so an unquoted $TIMEOUT_KILL_2M inside them did not split back into separate words and the shell looked for a command literally named "timeout -s KILL 2m". Every wolfSSL client run in do_wolfssl_client() then died with "command not found", which the script reported as a failing cipher suite. Use an array, whose expansion does not depend on IFS, and keep a flattened copy for the two eval call sites, where the shell re-parses the string and IFS does not apply. --- scripts/openssl.test | 44 +++++++++++++++++++++++++------------------- 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/scripts/openssl.test b/scripts/openssl.test index 03287e7b2a..5e29adce13 100755 --- a/scripts/openssl.test +++ b/scripts/openssl.test @@ -4,14 +4,20 @@ # timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the # command unbounded (the flaky hang this guards against is Linux-only CI). -# A prefix variable rather than a shell function: backgrounding a function -# makes $! the forked subshell, so a later "kill $server_pid" would stop the -# wrapper and orphan the server it was meant to kill. +# A prefix rather than a shell function: backgrounding a function makes $! the +# forked subshell, so a later "kill $server_pid" would stop the wrapper and +# orphan the server it was meant to kill. It is an array because this script +# sets IFS=: around its main loops, where an unquoted expansion of a plain +# string would not split back into separate words. if command -v timeout >/dev/null 2>&1; then - TIMEOUT_KILL_2M="timeout -s KILL 2m" + TIMEOUT_KILL_2M=(timeout -s KILL 2m) else - TIMEOUT_KILL_2M="" + TIMEOUT_KILL_2M=() fi +# The same prefix flattened, for the eval call sites: eval re-parses its +# argument, so the shell grammar splits it there and IFS does not apply. Built +# here while IFS still holds its default value. +TIMEOUT_KILL_2M_EVAL="${TIMEOUT_KILL_2M[*]}" # Environment variables used: # OPENSSL (openssl app to use) @@ -375,13 +381,13 @@ do_wolfssl_client() { echo "#" echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite -v $version $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl" # shellcheck disable=SC2086 - $TIMEOUT_KILL_2M $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl + "${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl else echo "#" echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl" # do all versions # shellcheck disable=SC2086 - $TIMEOUT_KILL_2M $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl + "${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl fi client_result=$? @@ -437,11 +443,11 @@ do_openssl_client() { then echo "#" echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\"" - echo "Hello" | eval "$TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\"" + echo "Hello" | eval "$TIMEOUT_KILL_2M_EVAL $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\"" else echo "#" echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\"" - echo "Hello" | eval "$TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\"" + echo "Hello" | eval "$TIMEOUT_KILL_2M_EVAL $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\"" fi client_result=$? @@ -548,7 +554,7 @@ if [ "$wolf_certs" != "" ] then echo # Check if RSA certificates supported in wolfSSL - wolf_rsa=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1) + wolf_rsa=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1) case $wolf_rsa in *"ca file"*) echo "wolfSSL does not support RSA" @@ -561,7 +567,7 @@ then echo "wolfSSL supports RSA" fi # Check if RSA-PSS certificates supported in wolfSSL - wolf_rsapss=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/rsapss/ca-rsapss.pem" 2>&1) + wolf_rsapss=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/rsapss/ca-rsapss.pem" 2>&1) case $wolf_rsapss in *"ca file"*) echo "wolfSSL does not support RSA-PSS" @@ -574,7 +580,7 @@ then echo "wolfSSL supports RSA-PSS" fi # Check if ECC certificates supported in wolfSSL - wolf_ecc=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1) + wolf_ecc=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1) case $wolf_ecc in *"ca file"*) echo "wolfSSL does not support ECDSA" @@ -587,7 +593,7 @@ then echo "wolfSSL supports ECDSA" fi # Check if Ed25519 certificates supported in wolfSSL - wolf_ed25519=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1) + wolf_ed25519=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1) case $wolf_ed25519 in *"ca file"*) echo "wolfSSL does not support Ed25519" @@ -600,7 +606,7 @@ then echo "wolfSSL supports Ed25519" fi # Check if Ed25519 certificates supported in OpenSSL - openssl_ed25519=$($TIMEOUT_KILL_2M $OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1) + openssl_ed25519=$("${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1) case $openssl_ed25519 in *"unable to load"*) echo "OpenSSL does not support Ed25519" @@ -613,7 +619,7 @@ then echo "OpenSSL supports Ed25519" fi # Check if Ed448 certificates supported in wolfSSL - wolf_ed448=$($TIMEOUT_KILL_2M $WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1) + wolf_ed448=$("${TIMEOUT_KILL_2M[@]}" $WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1) case $wolf_ed448 in *"ca file"*) echo "wolfSSL does not support Ed448" @@ -626,7 +632,7 @@ then echo "wolfSSL supports Ed448" fi # Check if Ed448 certificates supported in OpenSSL - openssl_ed448=$($TIMEOUT_KILL_2M $OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1) + openssl_ed448=$("${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1) case $openssl_ed448 in *"unable to load"*) echo "OpenSSL does not support Ed448" @@ -882,7 +888,7 @@ do # double check that can actually do a sslv3 connection using # client-cert.pem to send but any file with EOF works - $TIMEOUT_KILL_2M $OPENSSL s_client -ssl3 -no_ign_eof -host localhost -port "$openssl_port" < "${CERT_DIR}/client-cert.pem" + "${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -ssl3 -no_ign_eof -host localhost -port "$openssl_port" < "${CERT_DIR}/client-cert.pem" sslv3_sup=$? if [ "$sslv3_sup" != 0 ] then @@ -893,7 +899,7 @@ do openssl_version="-ssl3" ;; "1") - proto_check=$(echo "hell" | $TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:"$openssl_port" -tls1 2>&1) + proto_check=$(echo "hell" | "${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -connect localhost:"$openssl_port" -tls1 2>&1) tlsv1_sup=$? if [ "$tlsv1_sup" != 0 ] then @@ -914,7 +920,7 @@ do "2") # Same ciphers for TLSv1.1 as TLSv1 # shellcheck disable=SC2034 - proto_check=$(echo "hello" | $TIMEOUT_KILL_2M $OPENSSL s_client -connect localhost:"$openssl_port" -tls1_1 2>&1) + proto_check=$(echo "hello" | "${TIMEOUT_KILL_2M[@]}" $OPENSSL s_client -connect localhost:"$openssl_port" -tls1_1 2>&1) tlsv1_1_sup=$? if [ "$tlsv1_1_sup" != 0 ] then