mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-15 19:21:24 +02:00
Tobias Frauenschläger
1f36572941
The scripts that wait for a server to publish its ready file declare counter at file scope and never reset it, so the retry budget is shared by every server start in the script instead of applying to each one. Once the early cases have used it up, every later create_port() falls straight through to "NO ready file ending test", kills a server that was starting normally, and the client then fails with "port number cannot be 0". Retry loops do not help, since the budget is already spent when they run. The failure needs only a build whose server start-up is slow enough to consume a few tenths of a second each time. It showed up in the FIPS dev-no-POST kernel-settings-all-pqc-asm job, where the server pays for the CASTs, the PQC algorithms and the vector-register fallback fuzzer: psk.test gave up after exactly 20 waits and tls13.test after exactly 51, both the full script budget rather than a per-case one. Reset counter where the wait begins, which is what the ocsp-stapling scripts already do. Reproduced with a wrapper that delays the server by one second: psk.test then fails on its third case before the change and passes after it.
1428 lines
44 KiB
Bash
Executable File
1428 lines
44 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# openssl.test
|
|
|
|
# Environment variables used:
|
|
# OPENSSL (openssl app to use)
|
|
# OPENSSL_ENGINE_ID (engine id if any i.e. "wolfengine")
|
|
|
|
CERT_DIR="$PWD/$(dirname "$0")/../certs"
|
|
|
|
if ! test -n "$WOLFSSL_OPENSSL_TEST"; then
|
|
echo "WOLFSSL_OPENSSL_TEST NOT set, won't run"
|
|
exit 77
|
|
fi
|
|
|
|
# if we can, isolate the network namespace to eliminate port collisions.
|
|
if [[ -n "$NETWORK_UNSHARE_HELPER" ]]; then
|
|
if [[ -z "$NETWORK_UNSHARE_HELPER_CALLED" ]]; then
|
|
export NETWORK_UNSHARE_HELPER_CALLED=yes
|
|
exec "$NETWORK_UNSHARE_HELPER" "$0" "$@" || exit $?
|
|
fi
|
|
elif [ "${AM_BWRAPPED-}" != "yes" ]; then
|
|
bwrap_path="$(command -v bwrap)"
|
|
if [ -n "$bwrap_path" ]; then
|
|
export AM_BWRAPPED=yes
|
|
exec "$bwrap_path" --unshare-net --dev-bind / / "$0" "$@"
|
|
fi
|
|
unset AM_BWRAPPED
|
|
fi
|
|
|
|
echo "WOLFSSL_OPENSSL_TEST set, running test..."
|
|
|
|
# need a unique port since may run the same time as testsuite
|
|
# Track ports already assigned in this script run to prevent intra-run collisions
|
|
used_ports=()
|
|
|
|
generate_port() {
|
|
#-------------------------------------------------------------------------#
|
|
# Generate a random port number, guaranteed unique within this script run.
|
|
# Checks both the intra-run used_ports list and system-level bound ports.
|
|
#-------------------------------------------------------------------------#
|
|
local attempts=0 collision p
|
|
|
|
while true; do
|
|
if [[ "$OSTYPE" == "linux"* ]]; then
|
|
p=$(($(od -An -N2 /dev/urandom) % (65535-49512) + 49512))
|
|
elif [[ "$OSTYPE" == "darwin"* ]]; then
|
|
p=$(($(od -An -N2 /dev/random) % (65535-49512) + 49512))
|
|
else
|
|
echo "Unknown OS TYPE"
|
|
exit 1
|
|
fi
|
|
|
|
# Check against ports already assigned in this run
|
|
collision=0
|
|
for up in "${used_ports[@]}"; do
|
|
if [ "$up" = "$p" ]; then
|
|
collision=1
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Also check if the port is already bound on this system
|
|
if [ "$collision" -eq 0 ]; then
|
|
if command -v ss &>/dev/null; then
|
|
ss -lnt 2>/dev/null | grep -q ":${p}[[:space:]]" && collision=1
|
|
elif command -v netstat &>/dev/null; then
|
|
netstat -lnt 2>/dev/null | grep -q ":${p}[[:space:]]" && collision=1
|
|
fi
|
|
fi
|
|
|
|
[ "$collision" -eq 0 ] && break
|
|
|
|
((attempts++))
|
|
if [ "$attempts" -ge 100 ]; then
|
|
echo "ERROR: generate_port could not find a free port after 100 attempts"
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
port=$p
|
|
used_ports+=("$p")
|
|
}
|
|
|
|
no_pid=-1
|
|
servers=""
|
|
openssl_pid=$no_pid
|
|
ecdh_openssl_pid=$no_pid
|
|
ecdsa_openssl_pid=$no_pid
|
|
ed25519_openssl_pid=$no_pid
|
|
ed448_openssl_pid=$no_pid
|
|
tls13_psk_openssl_pid=$no_pid
|
|
wolfssl_pid=$no_pid
|
|
ecdh_wolfssl_pid=$no_pid
|
|
ecdsa_wolfssl_pid=$no_pid
|
|
ed25519_wolfssl_pid=$no_pid
|
|
ed448_wolfssl_pid=$no_pid
|
|
tls13_psk_wolfssl_pid=$no_pid
|
|
anon_wolfssl_pid=$no_pid
|
|
wolf_cases_tested=0
|
|
wolf_cases_total=0
|
|
counter=0
|
|
wolfssl_no_resume=""
|
|
testing_summary="OpenSSL Interop Testing Summary:\nVersion\tTested\t#Found\t#wolf\t#Found\t#OpenSSL\n"
|
|
versionName="Invalid"
|
|
if [ "$OPENSSL" = "" ]; then
|
|
OPENSSL=openssl
|
|
fi
|
|
WOLFSSL_SERVER=./examples/server/server
|
|
WOLFSSL_CLIENT=./examples/client/client
|
|
|
|
version_name() {
|
|
case $version in "0")
|
|
versionName="SSLv3"
|
|
;;
|
|
"1")
|
|
versionName="TLSv1"
|
|
;;
|
|
"2")
|
|
versionName="TLSv1.1"
|
|
;;
|
|
"3")
|
|
versionName="TLSv1.2"
|
|
;;
|
|
"4")
|
|
versionName="TLSv1.3"
|
|
;;
|
|
"d")
|
|
versionName="Down"
|
|
;;
|
|
"")
|
|
versionName="Def"
|
|
;;
|
|
"5")
|
|
versionName="ALL"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
do_cleanup() {
|
|
echo "in cleanup"
|
|
|
|
IFS=$OIFS #restore separator
|
|
sleepseconds=1
|
|
for s in $servers
|
|
do
|
|
f2=${s%:*}
|
|
sname=${f2%:*}
|
|
pid=${f2##*:}
|
|
port=${s##*:}
|
|
if kill -0 "$pid" 2>&-
|
|
then
|
|
# sleep to give sanitizers time to dump backtraces.
|
|
sleep $sleepseconds
|
|
sleepseconds=0
|
|
echo "killing server: $sname ($port)"
|
|
kill -9 "$pid"
|
|
fi
|
|
done
|
|
}
|
|
|
|
do_trap() {
|
|
echo "got trap"
|
|
do_cleanup
|
|
exit 1
|
|
}
|
|
|
|
trap do_trap INT TERM
|
|
|
|
#
|
|
# Start an OpenSSL server
|
|
#
|
|
start_openssl_server() {
|
|
if [ "$wolfssl_client_avail" = "" ]
|
|
then
|
|
return
|
|
fi
|
|
|
|
generate_port
|
|
server_port=$port
|
|
found_free_port=0
|
|
counter=0
|
|
|
|
# If OPENSSL_ENGINE_ID has been set then check that the desired engine can
|
|
# be loaded successfully and error out if not. Otherwise the OpenSSL app
|
|
# will fall back to default engine.
|
|
if [ -n "${OPENSSL_ENGINE_ID}" ]; then
|
|
OUTPUT=$($OPENSSL engine -tt "$OPENSSL_ENGINE_ID")
|
|
if ! echo "$OUTPUT" | grep -q "available"; then
|
|
printf "not able to load engine or engine not available\n"
|
|
printf '%s\n' "$OPENSSL engine -tt $OPENSSL_ENGINE_ID"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
OPENSSL_ENGINE_ID="-engine ${OPENSSL_ENGINE_ID}"
|
|
fi
|
|
|
|
while [ "$counter" -lt 20 ]; do
|
|
echo -e "\n# Trying to start $openssl_suite OpenSSL server on port $server_port..."
|
|
echo "#"
|
|
|
|
if [ "$cert_file" != "" ]
|
|
then
|
|
echo "# $OPENSSL s_server -accept $server_port $OPENSSL_ENGINE_ID -cert \"$cert_file\" -key \"$key_file\" -quiet -CAfile \"$ca_file\" -www -dhparam \"${CERT_DIR}/dh2048.pem\" -verify 10 -verify_return_error -psk $psk_hex -cipher \"ALL:eNULL\" $openssl_nodhe"
|
|
# shellcheck disable=SC2086
|
|
$OPENSSL s_server -accept "$server_port" $OPENSSL_ENGINE_ID -cert "$cert_file" -key "$key_file" -quiet -CAfile "$ca_file" -www -dhparam "${CERT_DIR}/dh2048.pem" -verify 10 -verify_return_error -psk "$psk_hex" -cipher "ALL:eNULL" $openssl_nodhe &
|
|
else
|
|
echo "# $OPENSSL s_server -accept $server_port $OPENSSL_ENGINE_ID -quiet -nocert -www -dhparam \"${CERT_DIR}/dh2048.pem\" -verify 10 -verify_return_error -psk $psk_hex -cipher \"ALL:eNULL\" $openssl_nodhe"
|
|
# shellcheck disable=SC2086
|
|
$OPENSSL s_server -accept "$server_port" $OPENSSL_ENGINE_ID -quiet -nocert -www -dhparam "${CERT_DIR}/dh2048.pem" -verify 10 -verify_return_error -psk "$psk_hex" -cipher "ALL:eNULL" $openssl_nodhe &
|
|
fi
|
|
server_pid=$!
|
|
# wait to see if s_server successfully starts before continuing
|
|
sleep 0.1
|
|
|
|
if kill -0 "$server_pid" 2>/dev/null
|
|
then
|
|
echo "s_server started successfully on port $server_port"
|
|
found_free_port=1
|
|
break
|
|
else
|
|
#port already started, try a different port
|
|
counter=$((counter+ 1))
|
|
generate_port
|
|
server_port=$port
|
|
fi
|
|
done
|
|
|
|
if [ "$found_free_port" = 0 ]
|
|
then
|
|
echo -e "Couldn't find free port for server"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
|
|
servers="$servers OpenSSL_$openssl_suite:$server_pid:$server_port"
|
|
}
|
|
|
|
#
|
|
# Start a wolfSSL server
|
|
#
|
|
start_wolfssl_server() {
|
|
if [ "$wolfssl_server_avail" = "" ]
|
|
then
|
|
echo "# wolfSSL server not available"
|
|
return
|
|
fi
|
|
|
|
wolfssl_cert=""
|
|
wolfssl_key=""
|
|
wolfssl_caCert=""
|
|
if [ "$cert_file" != "" ]
|
|
then
|
|
wolfssl_cert="-c$cert_file"
|
|
fi
|
|
if [ "$key_file" != "" ]
|
|
then
|
|
wolfssl_key="-k$key_file"
|
|
fi
|
|
if [ "$ca_file" != "" ]
|
|
then
|
|
wolfssl_caCert="-A$ca_file"
|
|
fi
|
|
|
|
generate_port
|
|
server_port=$port
|
|
found_free_port=0
|
|
counter=0
|
|
while [ "$counter" -lt 20 ]; do
|
|
echo -e "\n# Trying to start $wolfssl_suite wolfSSL server on port $server_port..."
|
|
|
|
echo "#"
|
|
echo "# $WOLFSSL_SERVER -p $server_port -g -v d -x -i $psk $crl -l ALL:eNULL \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\""
|
|
# shellcheck disable=SC2086
|
|
$WOLFSSL_SERVER -p "$server_port" -g -v d -x -i $psk $crl -l ALL:eNULL "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" &
|
|
server_pid=$!
|
|
# wait to see if server successfully starts before continuing
|
|
sleep 0.1
|
|
|
|
if kill -0 "$server_pid" 2>/dev/null
|
|
then
|
|
echo "wolfSSL server started successfully on port $server_port"
|
|
found_free_port=1
|
|
break
|
|
else
|
|
#port already started, try a different port
|
|
counter=$((counter+ 1))
|
|
generate_port
|
|
server_port=$port
|
|
fi
|
|
done
|
|
|
|
if [ "$found_free_port" = 0 ]
|
|
then
|
|
echo -e "Couldn't find free port for server"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
|
|
servers="$servers wolfSSL_$wolfssl_suite:$server_pid:$server_port"
|
|
}
|
|
|
|
check_server_ready() {
|
|
# server should be ready, let's make sure
|
|
server_ready=0
|
|
counter=0
|
|
while [ "$counter" -lt 20 ]; do
|
|
echo -e "waiting for $server_name ready..."
|
|
echo -e Checking | nc -4 -w 1 -z localhost "$server_port"
|
|
nc_result=$?
|
|
if [ "$nc_result" = 0 ]
|
|
then
|
|
echo -e "$server_name ready!"
|
|
server_ready=1
|
|
break
|
|
fi
|
|
sleep 0.1
|
|
counter=$((counter+ 1))
|
|
done
|
|
|
|
if [ $server_ready = 0 ]
|
|
then
|
|
echo -e "Couldn't verify $server_name is running, timeout error"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
#
|
|
# Run wolfSSL client against OpenSSL server
|
|
#
|
|
do_wolfssl_client() {
|
|
if [ "$wolfssl_client_avail" = "" ]
|
|
then
|
|
return
|
|
fi
|
|
|
|
wolfssl_cert=""
|
|
wolfssl_key=""
|
|
wolfssl_caCert=""
|
|
if [ "$cert" != "" ]
|
|
then
|
|
wolfssl_cert="-c$cert"
|
|
fi
|
|
if [ "$key" != "" ]
|
|
then
|
|
wolfssl_key="-k$key"
|
|
fi
|
|
if [ "$caCert" != "" ]
|
|
then
|
|
wolfssl_caCert="-A$caCert"
|
|
fi
|
|
wolfssl_resume="-r"
|
|
if [ "$openssl_psk_resume_bug" != "" ] && [ "$tls13_suite" != "" ]
|
|
then
|
|
wolfssl_resume=
|
|
fi
|
|
if [ "$wolfssl_no_resume" = "yes" ]
|
|
then
|
|
wolfssl_resume=
|
|
fi
|
|
if [ "$version" != "5" ] && [ "$version" != "" ]
|
|
then
|
|
echo "#"
|
|
echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite -v $version $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"
|
|
# shellcheck disable=SC2086
|
|
$WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
|
|
else
|
|
echo "#"
|
|
echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"
|
|
# do all versions
|
|
# shellcheck disable=SC2086
|
|
$WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
|
|
fi
|
|
|
|
client_result=$?
|
|
|
|
if [ "$client_result" != 0 ]
|
|
then
|
|
echo -e "client failed! Suite = $wolfSuite version = $version"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
wolf_temp_cases_tested=$((wolf_temp_cases_tested+1))
|
|
}
|
|
|
|
#
|
|
# Run OpenSSL client against wolfSSL server
|
|
#
|
|
do_openssl_client() {
|
|
if [ "$wolfssl_server_avail" = "" ]
|
|
then
|
|
return
|
|
fi
|
|
|
|
if [ "$version" = "" ] || [ "$version" = "5" ]
|
|
then
|
|
if [ "$tls13_cipher" = "" ] && [ "$openssl_tls13" != "" ]
|
|
then
|
|
openssl_version="-no_tls1_3"
|
|
fi
|
|
fi
|
|
if [ "$cert" != "" ]
|
|
then
|
|
openssl_cert1="-cert"
|
|
openssl_cert2="$cert"
|
|
fi
|
|
if [ "$key" != "" ]
|
|
then
|
|
openssl_key1="-key"
|
|
openssl_key2="$key"
|
|
fi
|
|
if [ "$caCert" != "" ]
|
|
then
|
|
openssl_caCert1="-CAfile"
|
|
openssl_caCert2="$caCert"
|
|
fi
|
|
# Integrity-only cipher suites require SECLEVEL=0 to allow NULL encryption
|
|
openssl_seclevel=""
|
|
if [ "$tls13_integrity_only" = "yes" ]
|
|
then
|
|
openssl_seclevel="-cipher ALL:@SECLEVEL=0"
|
|
fi
|
|
|
|
if [ "$tls13_cipher" = "" ]
|
|
then
|
|
echo "#"
|
|
echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
|
echo "Hello" | eval "$OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
|
else
|
|
echo "#"
|
|
echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
|
echo "Hello" | eval "$OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
|
|
fi
|
|
|
|
client_result=$?
|
|
|
|
if [ "$client_result" != 0 ]
|
|
then
|
|
echo -e "client failed! Suite = $wolfSuite version = $version"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
open_temp_cases_tested=$((open_temp_cases_tested+1))
|
|
}
|
|
|
|
OIFS=$IFS # store old separator to reset
|
|
|
|
#
|
|
# Start
|
|
#
|
|
echo
|
|
echo "wolfSSL configuration:"
|
|
./config.status --config
|
|
echo
|
|
echo "OpenSSL version:"
|
|
$OPENSSL version -a
|
|
echo
|
|
|
|
echo -e "\nTesting existence of openssl command...\n"
|
|
command -v "$OPENSSL" >/dev/null 2>&1 || { echo >&2 "Requires openssl command, but it's not installed. Ending."; do_cleanup; exit 0; }
|
|
|
|
|
|
echo -e "\nTesting for _build directory as part of distcheck, different paths"
|
|
currentDir=$(pwd)
|
|
case "$currentDir" in
|
|
*_build)
|
|
echo -e "_build directory detected, moving a directory back"
|
|
cd .. || exit
|
|
;;
|
|
esac
|
|
echo -e "\nChecking for wolfSSL client - needed for cipher list"
|
|
wolfssl_client_avail=$($WOLFSSL_CLIENT -?)
|
|
case $wolfssl_client_avail in
|
|
*"Client not compiled in!"*)
|
|
wolfssl_client_avail=
|
|
echo >&2 "Requires wolfSSL client, but it's not built. Ending."
|
|
do_cleanup
|
|
exit 0
|
|
;;
|
|
esac
|
|
|
|
echo -e "\nTesting for buggy version of OpenSSL - TLS 1.3, PSK and session ticket"
|
|
openssl_version=$($OPENSSL version)
|
|
case $openssl_version in
|
|
"OpenSSL 1.1.1 "*)
|
|
openssl_psk_resume_bug=yes
|
|
;;
|
|
"OpenSSL 1.0.2"*)
|
|
openssl_adh_reneg_bug=yes
|
|
;;
|
|
esac
|
|
|
|
# check for wolfssl server
|
|
wolfssl_server_avail=$($WOLFSSL_SERVER -?)
|
|
case $wolfssl_server_avail in
|
|
*"Server not compiled in!"*)
|
|
wolfssl_server_avail=
|
|
;;
|
|
esac
|
|
# get wolfssl ciphers
|
|
wolf_ciphers=$($WOLFSSL_CLIENT -e)
|
|
# get wolfssl supported versions
|
|
wolf_versions=$($WOLFSSL_CLIENT -V)
|
|
wolf_versions="${wolf_versions}:5" #5 will test without -v flag
|
|
|
|
OIFS="$IFS" # store old separator to reset
|
|
IFS=: # set delimiter
|
|
for version in $wolf_versions
|
|
do
|
|
case $version in
|
|
1|2|3)
|
|
wolf_tls=yes
|
|
;;
|
|
4)
|
|
wolf_tls13=yes
|
|
;;
|
|
esac
|
|
done
|
|
IFS="$OIFS" #restore separator
|
|
|
|
#
|
|
# Start OpenSSL servers
|
|
#
|
|
|
|
# Check for certificate support in wolfSSL
|
|
wolf_certs=$($WOLFSSL_CLIENT -? 2>&1)
|
|
case $wolf_certs in
|
|
*"cert"*)
|
|
;;
|
|
*)
|
|
wolf_certs=""
|
|
;;
|
|
esac
|
|
|
|
if [ "$wolf_certs" != "" ]
|
|
then
|
|
echo
|
|
# Check if RSA certificates supported in wolfSSL
|
|
wolf_rsa=$($WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1)
|
|
case $wolf_rsa in
|
|
*"ca file"*)
|
|
echo "wolfSSL does not support RSA"
|
|
wolf_rsa=""
|
|
;;
|
|
*)
|
|
;;
|
|
esac
|
|
if [ "$wolf_rsa" != "" ]; then
|
|
echo "wolfSSL supports RSA"
|
|
fi
|
|
# Check if RSA-PSS certificates supported in wolfSSL
|
|
wolf_rsapss=$($WOLFSSL_CLIENT -A "${CERT_DIR}/rsapss/ca-rsapss.pem" 2>&1)
|
|
case $wolf_rsapss in
|
|
*"ca file"*)
|
|
echo "wolfSSL does not support RSA-PSS"
|
|
wolf_rsapss=""
|
|
;;
|
|
*)
|
|
;;
|
|
esac
|
|
if [ "$wolf_rsapss" != "" ]; then
|
|
echo "wolfSSL supports RSA-PSS"
|
|
fi
|
|
# Check if ECC certificates supported in wolfSSL
|
|
wolf_ecc=$($WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1)
|
|
case $wolf_ecc in
|
|
*"ca file"*)
|
|
echo "wolfSSL does not support ECDSA"
|
|
wolf_ecc=""
|
|
;;
|
|
*)
|
|
;;
|
|
esac
|
|
if [ "$wolf_ecc" != "" ]; then
|
|
echo "wolfSSL supports ECDSA"
|
|
fi
|
|
# Check if Ed25519 certificates supported in wolfSSL
|
|
wolf_ed25519=$($WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1)
|
|
case $wolf_ed25519 in
|
|
*"ca file"*)
|
|
echo "wolfSSL does not support Ed25519"
|
|
wolf_ed25519=""
|
|
;;
|
|
*)
|
|
;;
|
|
esac
|
|
if [ "$wolf_ed25519" != "" ]; then
|
|
echo "wolfSSL supports Ed25519"
|
|
fi
|
|
# Check if Ed25519 certificates supported in OpenSSL
|
|
openssl_ed25519=$($OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1)
|
|
case $openssl_ed25519 in
|
|
*"unable to load"*)
|
|
echo "OpenSSL does not support Ed25519"
|
|
wolf_ed25519=""
|
|
;;
|
|
*)
|
|
;;
|
|
esac
|
|
if [ "$wolf_ed25519" != "" ]; then
|
|
echo "OpenSSL supports Ed25519"
|
|
fi
|
|
# Check if Ed448 certificates supported in wolfSSL
|
|
wolf_ed448=$($WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1)
|
|
case $wolf_ed448 in
|
|
*"ca file"*)
|
|
echo "wolfSSL does not support Ed448"
|
|
wolf_ed448=""
|
|
;;
|
|
*)
|
|
;;
|
|
esac
|
|
if [ "$wolf_ed448" != "" ]; then
|
|
echo "wolfSSL supports Ed448"
|
|
fi
|
|
# Check if Ed448 certificates supported in OpenSSL
|
|
openssl_ed448=$($OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1)
|
|
case $openssl_ed448 in
|
|
*"unable to load"*)
|
|
echo "OpenSSL does not support Ed448"
|
|
wolf_ed448=""
|
|
;;
|
|
*)
|
|
;;
|
|
esac
|
|
if [ "$wolf_ed448" != "" ]; then
|
|
echo "OpenSSL supports Ed448"
|
|
fi
|
|
echo
|
|
fi
|
|
|
|
openssl_tls13=$($OPENSSL s_client -help 2>&1)
|
|
case $openssl_tls13 in
|
|
*no_tls1_3*)
|
|
;;
|
|
*)
|
|
openssl_tls13=
|
|
;;
|
|
esac
|
|
|
|
# Not all openssl versions support -allow_no_dhe_kex
|
|
openssl_nodhe=$($OPENSSL s_client -help 2>&1)
|
|
case $openssl_nodhe in
|
|
*allow_no_dhe_kex*)
|
|
openssl_nodhe=-allow_no_dhe_kex
|
|
;;
|
|
*)
|
|
openssl_nodhe=
|
|
;;
|
|
esac
|
|
|
|
# Check suites to determine support in wolfSSL
|
|
OIFS="$IFS" # store old separator to reset
|
|
IFS=: # set delimiter
|
|
for wolfSuite in $wolf_ciphers; do
|
|
case $wolfSuite in
|
|
*ECDHE-RSA-*)
|
|
ecdhe_avail=yes
|
|
wolf_rsa=yes
|
|
;;
|
|
*DHE-RSA-*)
|
|
wolf_rsa=yes
|
|
;;
|
|
*ECDH-RSA*)
|
|
wolf_ecdh_rsa=yes
|
|
;;
|
|
*ECDHE-ECDSA*|*ECDH-ECDSA*)
|
|
wolf_ecdsa=yes
|
|
;;
|
|
*ADH*)
|
|
wolf_anon=yes
|
|
;;
|
|
*PSK*)
|
|
if [ "$wolf_psk" = "" ]
|
|
then
|
|
echo "Testing PSK"
|
|
wolf_psk=1
|
|
fi
|
|
if [ "$wolf_tls" != "" ]
|
|
then
|
|
wolf_tls_psk=yes
|
|
fi
|
|
;;
|
|
*TLS13*)
|
|
;;
|
|
*)
|
|
wolf_rsa=yes
|
|
esac
|
|
done
|
|
IFS="$OIFS" #restore separator
|
|
|
|
openssl_ciphers=$($OPENSSL ciphers ALL 2>&1)
|
|
case $openssl_ciphers in
|
|
*ADH*)
|
|
openssl_anon=yes
|
|
;;
|
|
esac
|
|
|
|
# TLSv1 -> TLSv1.2 PSK secret
|
|
psk_hex="1a2b3c4d"
|
|
|
|
# If RSA cipher suites supported in wolfSSL then start servers
|
|
if [ "$wolf_rsa" != "" ] || [ "$wolf_tls_psk" != "" ]
|
|
then
|
|
if [ "$wolf_rsa" != "" ]
|
|
then
|
|
cert_file="${CERT_DIR}/server-cert.pem"
|
|
key_file="${CERT_DIR}/server-key.pem"
|
|
ca_file="${CERT_DIR}/client-ca.pem"
|
|
else
|
|
cert_file=
|
|
key_file=
|
|
ca_file=
|
|
fi
|
|
|
|
openssl_suite="RSA"
|
|
start_openssl_server
|
|
openssl_port=$server_port
|
|
openssl_pid=$server_pid
|
|
|
|
wolfssl_suite="RSA"
|
|
if [ "$wolf_tls_psk" != "" ]
|
|
then
|
|
psk="-j"
|
|
fi
|
|
echo "cert_file=$cert_file"
|
|
start_wolfssl_server
|
|
psk=
|
|
wolfssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
wolfssl_pid=$server_pid
|
|
fi
|
|
|
|
# If ECDH-RSA cipher suites supported in wolfSSL then start servers
|
|
if [ "$wolf_ecdh_rsa" != "" ]
|
|
then
|
|
cert_file="${CERT_DIR}/server-ecc-rsa.pem"
|
|
key_file="${CERT_DIR}/ecc-key.pem"
|
|
ca_file="${CERT_DIR}/client-ca.pem"
|
|
|
|
openssl_suite="ECDH-RSA"
|
|
start_openssl_server
|
|
ecdh_openssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
ecdh_openssl_pid=$server_pid
|
|
|
|
wolfssl_suite="ECDH-RSA"
|
|
start_wolfssl_server
|
|
ecdh_wolfssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
ecdh_wolfssl_pid=$server_pid
|
|
fi
|
|
|
|
if [ "$wolf_ecdsa" != "" ] && [ "$wolf_ecc" != "" ]
|
|
then
|
|
cert_file="${CERT_DIR}/server-ecc.pem"
|
|
key_file="${CERT_DIR}/ecc-key.pem"
|
|
ca_file="${CERT_DIR}/client-ecc-cert.pem"
|
|
|
|
openssl_suite="ECDH[E]-ECDSA"
|
|
start_openssl_server
|
|
ecdsa_openssl_port=$server_port
|
|
ecdsa_openssl_pid=$server_pid
|
|
|
|
wolfssl_suite="ECDH[E]-ECDSA"
|
|
start_wolfssl_server
|
|
ecdsa_wolfssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
ecdsa_wolfssl_pid=$server_pid
|
|
fi
|
|
|
|
# If Ed25519 certificates supported in wolfSSL then start servers
|
|
if [ "$wolf_ed25519" != "" ];
|
|
then
|
|
cert_file="${CERT_DIR}/ed25519/server-ed25519.pem"
|
|
key_file="${CERT_DIR}/ed25519/server-ed25519-priv.pem"
|
|
ca_file="${CERT_DIR}/ed25519/client-ed25519.pem"
|
|
|
|
openssl_suite="Ed25519"
|
|
start_openssl_server
|
|
ed25519_openssl_port=$server_port
|
|
ed25519_openssl_pid=$server_pid
|
|
|
|
crl="-V"
|
|
wolfssl_suite="Ed25519"
|
|
start_wolfssl_server
|
|
ed25519_wolfssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
ed25519_wolfssl_pid=$server_pid
|
|
crl=
|
|
fi
|
|
|
|
# If Ed448 certificates supported in wolfSSL then start servers
|
|
if [ "$wolf_ed448" != "" ];
|
|
then
|
|
cert_file="${CERT_DIR}/ed448/server-ed448.pem"
|
|
key_file="${CERT_DIR}/ed448/server-ed448-priv.pem"
|
|
ca_file="${CERT_DIR}/ed448/client-ed448.pem"
|
|
|
|
openssl_suite="Ed448"
|
|
start_openssl_server
|
|
ed448_openssl_port=$server_port
|
|
ed448_openssl_pid=$server_pid
|
|
|
|
crl="-V"
|
|
wolfssl_suite="Ed448"
|
|
start_wolfssl_server
|
|
ed448_wolfssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
ed448_wolfssl_pid=$server_pid
|
|
crl=
|
|
fi
|
|
|
|
if [ "$wolf_tls13" != "" ] && [ "$wolf_psk" != "" ]
|
|
then
|
|
cert_file=
|
|
|
|
psk_hex="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
|
|
openssl_suite="TLSv1.3_PSK"
|
|
start_openssl_server
|
|
tls13_psk_openssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
tls13_psk_openssl_pid=$server_pid
|
|
|
|
psk="-s --openssl-psk"
|
|
wolfssl_suite="TLSv1.3_PSK"
|
|
start_wolfssl_server
|
|
tls13_psk_wolfssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
tls13_psk_wolfssl_pid=$server_pid
|
|
fi
|
|
if [ "$wolf_anon" != "" ] && [ "$openssl_anon" ]
|
|
then
|
|
cert_file=""
|
|
key_file=""
|
|
ca_file=""
|
|
|
|
wolfssl_suite="Anon"
|
|
psk="-a" # anonymous not psk
|
|
start_wolfssl_server
|
|
anon_wolfssl_port=$server_port
|
|
# shellcheck disable=SC2034
|
|
anon_wolfssl_pid=$server_pid
|
|
fi
|
|
|
|
for s in $servers
|
|
do
|
|
f2=${s%:*}
|
|
server_name=${f2%:*}
|
|
server_port=${s##*:}
|
|
check_server_ready
|
|
done
|
|
|
|
OIFS="$IFS" # store old separator to reset
|
|
IFS=: # set delimiter
|
|
set -f # no globbing
|
|
|
|
wolf_temp_cases_total=0
|
|
wolf_temp_cases_tested=0
|
|
|
|
# Testing of OpenSSL support for version requires a running OpenSSL server
|
|
for version in $wolf_versions;
|
|
do
|
|
echo -e "version = $version"
|
|
# get openssl ciphers depending on version
|
|
# -s flag for only supported ciphers
|
|
case $version in
|
|
"0")
|
|
openssl_ciphers=$($OPENSSL ciphers "SSLv3" 2>&1)
|
|
|
|
# double check that can actually do a sslv3 connection using
|
|
# client-cert.pem to send but any file with EOF works
|
|
$OPENSSL s_client -ssl3 -no_ign_eof -host localhost -port "$openssl_port" < "${CERT_DIR}/client-cert.pem"
|
|
sslv3_sup=$?
|
|
if [ "$sslv3_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing SSLv3. No OpenSSL support for 'SSLv3' modifier"
|
|
testing_summary="${testing_summary}SSLv3\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
|
|
continue
|
|
fi
|
|
openssl_version="-ssl3"
|
|
;;
|
|
"1")
|
|
proto_check=$(echo "hell" | $OPENSSL s_client -connect localhost:"$openssl_port" -tls1 2>&1)
|
|
tlsv1_sup=$?
|
|
if [ "$tlsv1_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing TLSv1. No OpenSSL support for '-tls1'"
|
|
testing_summary="${testing_summary}TLSv1\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL Support)\n"
|
|
continue
|
|
fi
|
|
openssl_ciphers=$($OPENSSL ciphers -s "TLSv1" 2>&1)
|
|
tlsv1_sup=$?
|
|
if [ "$tlsv1_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing TLSv1. No OpenSSL support for 'TLSv1' modifier"
|
|
testing_summary="${testing_summary}TLSv1\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
|
|
continue
|
|
fi
|
|
openssl_version="-tls1"
|
|
;;
|
|
"2")
|
|
# Same ciphers for TLSv1.1 as TLSv1
|
|
# shellcheck disable=SC2034
|
|
proto_check=$(echo "hello" | $OPENSSL s_client -connect localhost:"$openssl_port" -tls1_1 2>&1)
|
|
tlsv1_1_sup=$?
|
|
if [ "$tlsv1_1_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing TLSv1.1. No OpenSSL support for 'TLSv1.1' modifier"
|
|
testing_summary="${testing_summary}TLSv1.1\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
|
|
continue
|
|
fi
|
|
openssl_ciphers=$($OPENSSL ciphers -s "TLSv1" 2>&1)
|
|
tlsv1_sup=$?
|
|
if [ "$tlsv1_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing TLSv1. No OpenSSL support for 'TLSv1' modifier"
|
|
testing_summary="${testing_summary}TLSv1\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
|
|
continue
|
|
fi
|
|
openssl_version="-tls1_1"
|
|
;;
|
|
"3")
|
|
openssl_ciphers=$($OPENSSL ciphers -s "TLSv1.2" 2>&1)
|
|
tlsv1_2_sup=$?
|
|
if [ "$tlsv1_2_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing TLSv1.2. No OpenSSL support for 'TLSv1.2' modifier"
|
|
testing_summary="${testing_summary}TLSv1.2\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
|
|
continue
|
|
fi
|
|
openssl_version="-tls1_2"
|
|
;;
|
|
"4")
|
|
openssl_ciphers=$($OPENSSL ciphers -tls1_3 2>&1)
|
|
tlsv1_3_sup=$?
|
|
if [ "$tlsv1_3_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing TLSv1.3. No OpenSSL support for 'TLSv1.3' modifier"
|
|
testing_summary="${testing_summary}TLSv1.3\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
|
|
continue
|
|
fi
|
|
# shellcheck disable=SC2034
|
|
ecc_support=$($WOLFSSL_CLIENT -? 2>&1 | grep 'ECC named groups')
|
|
openssl_version="-tls1_3"
|
|
;;
|
|
"d(downgrade)")
|
|
version="d"
|
|
openssl_version=""
|
|
;;
|
|
"e(either)")
|
|
continue
|
|
;;
|
|
"5") #test all suites
|
|
openssl_ciphers=$($OPENSSL ciphers -s "ALL" 2>&1)
|
|
all_sup=$?
|
|
if [ "$all_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing ALL. No OpenSSL support for ALL modifier"
|
|
testing_summary="${testing_summary}ALL\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
|
|
continue
|
|
fi
|
|
openssl_version=""
|
|
;;
|
|
"")
|
|
openssl_ciphers=$($OPENSSL ciphers 2>&1)
|
|
all_sup=$?
|
|
if [ "$all_sup" != 0 ]
|
|
then
|
|
echo -e "Not testing ALL. No OpenSSL support for ALL modifier"
|
|
testing_summary="${testing_summary}ALL\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
|
|
continue
|
|
fi
|
|
openssl_version=""
|
|
;;
|
|
esac
|
|
|
|
for wolfSuite in $wolf_ciphers; do
|
|
echo -e "trying wolfSSL cipher suite $wolfSuite"
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
matchSuite=0
|
|
tls13_suite=
|
|
tls13_integrity_only=
|
|
|
|
case $wolfSuite in
|
|
"TLS13-AES128-GCM-SHA256")
|
|
cmpSuite="TLS_AES_128_GCM_SHA256"
|
|
tls13_suite="yes"
|
|
;;
|
|
"TLS13-AES256-GCM-SHA384")
|
|
cmpSuite="TLS_AES_256_GCM_SHA384"
|
|
tls13_suite="yes"
|
|
;;
|
|
"TLS13-CHACHA20-POLY1305-SHA256")
|
|
cmpSuite="TLS_CHACHA20_POLY1305_SHA256"
|
|
tls13_suite="yes"
|
|
;;
|
|
"TLS13-AES128-CCM-SHA256")
|
|
cmpSuite="TLS_AES_128_CCM_SHA256"
|
|
tls13_suite="yes"
|
|
;;
|
|
"TLS13-AES128-CCM-8-SHA256"|"TLS13-AES128-CCM8-SHA256")
|
|
cmpSuite="TLS_AES_128_CCM_8_SHA256"
|
|
tls13_suite="yes"
|
|
;;
|
|
"TLS13-SHA256-SHA256")
|
|
cmpSuite="TLS_SHA256_SHA256"
|
|
tls13_suite="yes"
|
|
tls13_integrity_only="yes"
|
|
# OpenSSL does not enable TLS_SHA256_SHA256 in openssl ciphers
|
|
# output by default, but it can be specified with -ciphersuite as
|
|
# done in do_openssl_client()
|
|
matchSuite=1
|
|
;;
|
|
"TLS13-SHA384-SHA384")
|
|
cmpSuite="TLS_SHA384_SHA384"
|
|
tls13_suite="yes"
|
|
tls13_integrity_only="yes"
|
|
# OpenSSL does not enable TLS_SHA256_SHA256 in openssl ciphers
|
|
# output by default, but it can be specified with -ciphersuite as
|
|
# done in do_openssl_client()
|
|
matchSuite=1
|
|
;;
|
|
"TLS13-"*)
|
|
echo -e "Suite = $wolfSuite not recognized!"
|
|
echo -e "Add translation of wolfSSL name to OpenSSL"
|
|
do_cleanup
|
|
exit 1
|
|
;;
|
|
*)
|
|
cmpSuite=$wolfSuite
|
|
;;
|
|
esac
|
|
|
|
if [ $matchSuite = 0 ]
|
|
then
|
|
case ":$openssl_ciphers:" in *":$cmpSuite:"*) # add extra : for edge cases
|
|
case "$cmpSuite" in
|
|
"TLS_"*)
|
|
if [ "$version" != "4" ] && [ "$version" != "d" ]
|
|
then
|
|
echo -e "TLS 1.3 cipher suite but not TLS 1.3 protocol"
|
|
matchSuite=0
|
|
else
|
|
echo -e "Matched to OpenSSL suite support"
|
|
matchSuite=1
|
|
fi
|
|
;;
|
|
*)
|
|
if [ "$version" = "d" ] && [ "$wolfdowngrade" = "4" ]
|
|
then
|
|
echo -e "Not TLS 1.3 cipher suite but TLS 1.3 downgrade"
|
|
matchSuite=0
|
|
elif [ "$version" != "4" ]
|
|
then
|
|
echo -e "Matched to OpenSSL suite support"
|
|
matchSuite=1
|
|
else
|
|
echo -e "Not TLS 1.3 cipher suite but TLS 1.3 protocol"
|
|
matchSuite=0
|
|
fi
|
|
;;
|
|
esac
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
if [ $matchSuite = 0 ]
|
|
then
|
|
echo -e "Couldn't match suite, continuing..."
|
|
continue
|
|
fi
|
|
|
|
# check for psk suite and turn on client psk if so
|
|
psk=""
|
|
adh=""
|
|
crl=""
|
|
cert=""
|
|
key=""
|
|
caCert=""
|
|
case $wolfSuite in
|
|
*ECDH-RSA*)
|
|
cert="${CERT_DIR}/client-cert.pem"
|
|
key="${CERT_DIR}/client-key.pem"
|
|
caCert="${CERT_DIR}/ca-cert.pem"
|
|
port=$ecdh_openssl_port
|
|
do_wolfssl_client
|
|
port=$ecdh_wolfssl_port
|
|
do_openssl_client
|
|
;;
|
|
*ECDHE-ECDSA*|*ECDH-ECDSA*)
|
|
if [ "$wolf_ecc" != "" ]
|
|
then
|
|
cert="${CERT_DIR}/client-ecc-cert.pem"
|
|
key="${CERT_DIR}/ecc-client-key.pem"
|
|
caCert="${CERT_DIR}/ca-ecc-cert.pem"
|
|
|
|
port=$ecdsa_openssl_port
|
|
do_wolfssl_client
|
|
port=$ecdsa_wolfssl_port
|
|
do_openssl_client
|
|
else
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total - 1))
|
|
fi
|
|
if [ "$ed25519_openssl_pid" != "$no_pid" ] && [ "$version" != "0" ] && [ "$version" != "1" ] && [ "$version" != "2" ]
|
|
then
|
|
cert="${CERT_DIR}/ed25519/client-ed25519.pem"
|
|
key="${CERT_DIR}/ed25519/client-ed25519-priv.pem"
|
|
caCert="${CERT_DIR}/ed25519/server-ed25519.pem"
|
|
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
|
|
port=$ed25519_openssl_port
|
|
crl="-C"
|
|
do_wolfssl_client
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
port=$ed25519_wolfssl_port
|
|
do_openssl_client
|
|
fi
|
|
if [ "$ed448_openssl_pid" != "$no_pid" ] && [ "$version" != "0" ] && [ "$version" != "1" ] && [ "$version" != "2" ]
|
|
then
|
|
cert="${CERT_DIR}/ed448/client-ed448.pem"
|
|
key="${CERT_DIR}/ed448/client-ed448-priv.pem"
|
|
caCert="${CERT_DIR}/ed448/server-ed448.pem"
|
|
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
|
|
port=$ed448_openssl_port
|
|
crl="-C"
|
|
do_wolfssl_client
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
port=$ed448_wolfssl_port
|
|
do_openssl_client
|
|
fi
|
|
;;
|
|
*DHE-PSK*)
|
|
cert="${CERT_DIR}/client-cert.pem"
|
|
key="${CERT_DIR}/client-key.pem"
|
|
caCert="${CERT_DIR}/ca-cert.pem"
|
|
|
|
port=$openssl_port
|
|
psk="-s"
|
|
do_wolfssl_client
|
|
|
|
# Skip when no RSA as some versions of OpenSSL can't handle no
|
|
# signature
|
|
if [ "$wolf_rsa" != "" ]
|
|
then
|
|
port=$wolfssl_port
|
|
openssl_psk="-psk 1a2b3c4d"
|
|
do_openssl_client
|
|
fi
|
|
;;
|
|
*PSK*)
|
|
cert="${CERT_DIR}/client-cert.pem"
|
|
key="${CERT_DIR}/client-key.pem"
|
|
caCert="${CERT_DIR}/ca-cert.pem"
|
|
|
|
port=$openssl_port
|
|
psk="-s"
|
|
do_wolfssl_client
|
|
port=$wolfssl_port
|
|
openssl_psk="-psk 1a2b3c4d"
|
|
do_openssl_client
|
|
;;
|
|
*ADH*)
|
|
cert="${CERT_DIR}/client-cert.pem"
|
|
key="${CERT_DIR}/client-key.pem"
|
|
caCert="${CERT_DIR}/ca-cert.pem"
|
|
|
|
if [ "$version" != "0" ] && [ "$version" != "1" ] && [ "$version" != "2" ] && [ "$openssl_adh_reneg_bug" != "" ]
|
|
then
|
|
continue
|
|
fi
|
|
|
|
port=$openssl_port
|
|
adh="-a"
|
|
do_wolfssl_client
|
|
port=$anon_wolfssl_port
|
|
do_openssl_client
|
|
;;
|
|
TLS13*)
|
|
if [ "$version" != "4" ] && [ "$version" != "d" ] && [ "$version" != " " ] && [ "$version" != "5" ]
|
|
then
|
|
continue
|
|
fi
|
|
tls13_cipher=yes
|
|
# Integrity-only cipher suites (NULL encryption)
|
|
if [ "$tls13_integrity_only" = "yes" ]
|
|
then
|
|
# Only run integrity-only tests with TLS 1.3 (version 4)
|
|
if [ "$version" != "4" ]
|
|
then
|
|
tls13_cipher=
|
|
tls13_integrity_only=
|
|
continue
|
|
fi
|
|
|
|
# Integrity-only cipher suites require OpenSSL 3.4 or later
|
|
if $OPENSSL version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 | \
|
|
awk -F. '{if ($1 > 3 || ($1 == 3 && $2 >= 4)) exit 1; else exit 0;}'; then
|
|
echo -e "OpenSSL version too old for integrity-only ciphers, skipping"
|
|
tls13_cipher=
|
|
tls13_integrity_only=
|
|
continue
|
|
fi
|
|
|
|
# Test with RSA certs if available
|
|
if [ "$openssl_pid" != "$no_pid" ] && [ "$wolf_rsa" != "" ]
|
|
then
|
|
cert="${CERT_DIR}/client-cert.pem"
|
|
key="${CERT_DIR}/client-key.pem"
|
|
caCert="${CERT_DIR}/ca-cert.pem"
|
|
|
|
# Start a dedicated OpenSSL server for integrity-only tests
|
|
generate_port
|
|
integrity_openssl_port=$port
|
|
$OPENSSL s_server -accept "$integrity_openssl_port" -cert "${CERT_DIR}/server-cert.pem" -key "${CERT_DIR}/server-key.pem" -quiet -CAfile "${CERT_DIR}/client-cert.pem" -www -cipher "ALL:eNULL:@SECLEVEL=0" -ciphersuites "$cmpSuite" -verify 10 -verify_return_error &
|
|
integrity_openssl_pid=$!
|
|
sleep 0.1
|
|
|
|
port=$integrity_openssl_port
|
|
do_wolfssl_client
|
|
|
|
# Kill the dedicated server
|
|
kill "$integrity_openssl_pid" 2>/dev/null
|
|
|
|
port=$wolfssl_port
|
|
do_openssl_client
|
|
fi
|
|
# Test with ECC certs if available
|
|
if [ "$ecdsa_openssl_pid" != "$no_pid" ] && [ "$wolf_ecc" != "" ]
|
|
then
|
|
cert="${CERT_DIR}/client-ecc-cert.pem"
|
|
key="${CERT_DIR}/ecc-client-key.pem"
|
|
caCert="${CERT_DIR}/ca-ecc-cert.pem"
|
|
|
|
# Start a dedicated OpenSSL server for integrity-only tests (ECC)
|
|
generate_port
|
|
integrity_openssl_port=$port
|
|
$OPENSSL s_server -accept "$integrity_openssl_port" -cert "${CERT_DIR}/server-ecc.pem" -key "${CERT_DIR}/ecc-key.pem" -quiet -CAfile "${CERT_DIR}/client-ecc-cert.pem" -www -cipher "ALL:eNULL:@SECLEVEL=0" -ciphersuites "$cmpSuite" -verify 10 -verify_return_error &
|
|
integrity_openssl_pid=$!
|
|
sleep 0.1
|
|
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
|
|
port=$integrity_openssl_port
|
|
do_wolfssl_client
|
|
|
|
# Kill the dedicated server
|
|
kill "$integrity_openssl_pid" 2>/dev/null
|
|
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
port=$ecdsa_wolfssl_port
|
|
do_openssl_client
|
|
fi
|
|
tls13_cipher=
|
|
tls13_integrity_only=
|
|
continue
|
|
fi
|
|
# RSA
|
|
if [ "$openssl_pid" != "$no_pid" ] && [ "$ecdhe_avail" = "yes" ]
|
|
then
|
|
cert="${CERT_DIR}/client-cert.pem"
|
|
key="${CERT_DIR}/client-key.pem"
|
|
caCert="${CERT_DIR}/ca-cert.pem"
|
|
|
|
port=$openssl_port
|
|
do_wolfssl_client
|
|
port=$wolfssl_port
|
|
do_openssl_client
|
|
fi
|
|
# PSK
|
|
if [ "$wolf_psk" != "" ] && [ "$wolfSuite" = "TLS13-AES128-GCM-SHA256" ] && [ "$wolf_ecc" != "" ] && [ "$openssl_nodhe" != "" ]
|
|
then
|
|
cert=""
|
|
key=""
|
|
caCert=""
|
|
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
|
|
port=$tls13_psk_openssl_port
|
|
psk="-s --openssl-psk"
|
|
# OpenSSL doesn't support DH for key exchange so do no PSK
|
|
# DHE when ECC not supported
|
|
if [ "$wolf_ecc" = "" ]
|
|
then
|
|
adh="-K"
|
|
fi
|
|
do_wolfssl_client
|
|
psk=""
|
|
adh=""
|
|
openssl_psk="-psk 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
port=$wolfssl_port
|
|
do_openssl_client
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
port=$tls13_psk_wolfssl_port
|
|
do_openssl_client
|
|
openssl_psk=""
|
|
fi
|
|
# ECDSA
|
|
if [ "$ecdsa_openssl_pid" != "$no_pid" ] && [ "$wolf_ecc" != "" ]
|
|
then
|
|
cert="${CERT_DIR}/client-ecc-cert.pem"
|
|
key="${CERT_DIR}/ecc-client-key.pem"
|
|
caCert="${CERT_DIR}/ca-ecc-cert.pem"
|
|
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
|
|
port=$ecdsa_openssl_port
|
|
caCert="${CERT_DIR}/ca-ecc-cert.pem"
|
|
do_wolfssl_client
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
port=$ecdsa_wolfssl_port
|
|
caCert="${CERT_DIR}/ca-ecc-cert.pem"
|
|
do_openssl_client
|
|
fi
|
|
# Ed25519
|
|
if [ $ed25519_openssl_pid != $no_pid ]
|
|
then
|
|
cert="${CERT_DIR}/ed25519/client-ed25519.pem"
|
|
key="${CERT_DIR}/ed25519/client-ed25519-priv.pem"
|
|
caCert="${CERT_DIR}/ed25519/server-ed25519.pem"
|
|
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
|
|
port=$ed25519_openssl_port
|
|
crl="-C"
|
|
do_wolfssl_client
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
port=$ed25519_wolfssl_port
|
|
do_openssl_client
|
|
fi
|
|
# Ed448
|
|
if [ $ed448_openssl_pid != $no_pid ]
|
|
then
|
|
cert="${CERT_DIR}/ed448/client-ed448.pem"
|
|
key="${CERT_DIR}/ed448/client-ed448-priv.pem"
|
|
caCert="${CERT_DIR}/ed448/server-ed448.pem"
|
|
|
|
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
|
|
port=$ed448_openssl_port
|
|
crl="-C"
|
|
do_wolfssl_client
|
|
open_temp_cases_total=$((open_temp_cases_total + 1))
|
|
port=$ed448_wolfssl_port
|
|
do_openssl_client
|
|
fi
|
|
tls13_cipher=
|
|
;;
|
|
*)
|
|
cert="${CERT_DIR}/client-cert.pem"
|
|
key="${CERT_DIR}/client-key.pem"
|
|
caCert="${CERT_DIR}/ca-cert.pem"
|
|
|
|
port=$openssl_port
|
|
do_wolfssl_client
|
|
port=$wolfssl_port
|
|
do_openssl_client
|
|
;;
|
|
esac
|
|
done
|
|
wolf_cases_tested=$((wolf_temp_cases_tested+wolf_cases_tested))
|
|
wolf_cases_total=$((wolf_temp_cases_total+wolf_cases_total))
|
|
echo -e "wolfSSL cases tested with version:$version $wolf_temp_cases_tested"
|
|
open_cases_tested=$((open_temp_cases_tested+open_cases_tested))
|
|
open_cases_total=$((open_temp_cases_total+open_cases_total))
|
|
echo -e "OpenSSL cases tested with version:$version $open_temp_cases_tested"
|
|
version_name
|
|
testing_summary="$testing_summary$versionName\tYes\t$wolf_temp_cases_total\t$wolf_temp_cases_tested\t$open_temp_cases_total\t$open_temp_cases_tested\n"
|
|
wolf_temp_cases_total=0
|
|
wolf_temp_cases_tested=0
|
|
open_temp_cases_total=0
|
|
open_temp_cases_tested=0
|
|
wolfdowngrade="$version"
|
|
done
|
|
IFS="$OIFS" #restore separator
|
|
|
|
# Skip RSA-PSS interop test when RSA-PSS is not supported
|
|
if [ "$wolf_rsapss" != "" ] && [ "$ecdhe_avail" = "yes" ] && [ "$wolf_rsa" = "yes" ]
|
|
then
|
|
# Test for RSA-PSS certs interop
|
|
# Was running into alert sent by openssl server with version 1.1.1 released
|
|
# in Sep 2018. To avoid this issue check that openssl version 3.0.0 or later
|
|
# is used.
|
|
|
|
$OPENSSL version | awk '{print $2}' | \
|
|
awk -F. '{if ($1 >= 3) exit 1; else exit 0;}'
|
|
RESULT=$?
|
|
if [ "$RESULT" = "0" ]; then
|
|
echo -e "Old version of openssl detected, skipping interop RSA-PSS test"
|
|
else
|
|
echo -e "Doing interop RSA-PSS test"
|
|
|
|
key_file=${CERT_DIR}/rsapss/server-rsapss-priv.pem
|
|
cert_file=${CERT_DIR}/rsapss/server-rsapss.pem
|
|
ca_file=${CERT_DIR}/client-cert.pem
|
|
openssl_suite="RSAPSS"
|
|
start_openssl_server
|
|
|
|
cert="${CERT_DIR}/client-cert.pem"
|
|
key="${CERT_DIR}/client-key.pem"
|
|
caCert="${CERT_DIR}/rsapss/ca-rsapss.pem"
|
|
crl="-C"
|
|
wolfSuite="ALL"
|
|
wolfssl_no_resume="yes"
|
|
port=$server_port
|
|
|
|
if [ "$wolf_tls13" != "" ]
|
|
then
|
|
version="4"
|
|
do_wolfssl_client
|
|
fi
|
|
|
|
if [ "$wolf_tls" != "" ]
|
|
then
|
|
version="3"
|
|
do_wolfssl_client
|
|
fi
|
|
fi
|
|
fi
|
|
do_cleanup
|
|
|
|
echo -e "wolfSSL total cases $wolf_cases_total"
|
|
echo -e "wolfSSL cases tested $wolf_cases_tested"
|
|
echo -e "OpenSSL total cases $open_cases_total"
|
|
echo -e "OpenSSL cases tested $open_cases_tested"
|
|
echo -e "\nSuccess!\n\n\n\n"
|
|
echo -e "$testing_summary"
|
|
exit 0
|