mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-14 19:11:28 +02:00
Tobias Frauenschläger
1f36572941
The scripts that wait for a server to publish its ready file declare counter at file scope and never reset it, so the retry budget is shared by every server start in the script instead of applying to each one. Once the early cases have used it up, every later create_port() falls straight through to "NO ready file ending test", kills a server that was starting normally, and the client then fails with "port number cannot be 0". Retry loops do not help, since the budget is already spent when they run. The failure needs only a build whose server start-up is slow enough to consume a few tenths of a second each time. It showed up in the FIPS dev-no-POST kernel-settings-all-pqc-asm job, where the server pays for the CASTs, the PQC algorithms and the vector-register fallback fuzzer: psk.test gave up after exactly 20 waits and tls13.test after exactly 51, both the full script budget rather than a per-case one. Reset counter where the wait begins, which is what the ocsp-stapling scripts already do. Reproduced with a wrapper that delays the server by one second: psk.test then fails on its third case before the change and passes after it.
321 lines
9.2 KiB
Bash
Executable File
321 lines
9.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# trusted_peer.test
|
|
# copyright wolfSSL 2016
|
|
|
|
[ ! -x ./examples/client/client ] && printf '\n\n%s\n' "Client doesn't exist" \
|
|
&& exit 1
|
|
|
|
if ./examples/client/client -? 2>&1 | grep "Client not compiled in!" ; then
|
|
echo 'skipping trusted_peer.test because client not compiled in.' 1>&2
|
|
exit 77
|
|
fi
|
|
|
|
if ./examples/server/server -? 2>&1 | grep "Server not compiled in!" ; then
|
|
echo 'skipping trusted_peer.test because server not compiled in.' 1>&2
|
|
exit 77
|
|
fi
|
|
|
|
# if we can, isolate the network namespace to eliminate port collisions.
|
|
if [[ -n "$NETWORK_UNSHARE_HELPER" ]]; then
|
|
if [[ -z "$NETWORK_UNSHARE_HELPER_CALLED" ]]; then
|
|
export NETWORK_UNSHARE_HELPER_CALLED=yes
|
|
exec "$NETWORK_UNSHARE_HELPER" "$0" "$@" || exit $?
|
|
fi
|
|
elif [ "${AM_BWRAPPED-}" != "yes" ]; then
|
|
bwrap_path="$(command -v bwrap)"
|
|
if [ -n "$bwrap_path" ]; then
|
|
export AM_BWRAPPED=yes
|
|
exec "$bwrap_path" --unshare-net --dev-bind / / "$0" "$@"
|
|
fi
|
|
unset AM_BWRAPPED
|
|
fi
|
|
|
|
# getting unique port is modeled after resume.test script
|
|
# need a unique port since may run the same time as testsuite
|
|
# use server port zero hack to get one
|
|
port=0
|
|
no_pid=-1
|
|
server_pid=$no_pid
|
|
counter=0
|
|
# let's use absolute path to a local dir (make distcheck may be in sub dir)
|
|
# also let's add some randomness by adding pid in case multiple 'make check's
|
|
# per source tree
|
|
ready_file=`pwd`/wolfssl_tp_ready$$
|
|
|
|
# variables for certs so can use RSA or ECC
|
|
client_cert=`pwd`/certs/client-cert.pem
|
|
client_ca=`pwd`/certs/ca-cert.pem
|
|
client_key=`pwd`/certs/client-key.pem
|
|
ca_key=`pwd`/certs/ca-key.pem
|
|
server_cert=`pwd`/certs/server-cert.pem
|
|
server_key=`pwd`/certs/server-key.pem
|
|
combined_cert=`pwd`/certs/client_combined.pem
|
|
wrong_ca=`pwd`/certs/wolfssl-website-ca.pem
|
|
wrong_cert=`pwd`/certs/server-revoked-cert.pem
|
|
|
|
echo "ready file \"$ready_file\""
|
|
|
|
create_port() {
|
|
counter=0
|
|
while [ ! -s "$ready_file" -a "$counter" -lt 20 ]; do
|
|
echo -e "waiting for ready file..."
|
|
sleep 0.1
|
|
counter=$((counter+ 1))
|
|
done
|
|
|
|
if test -e "$ready_file"; then
|
|
echo -e "found ready file, starting client..."
|
|
|
|
# sleep for an additional 0.1 to mitigate race on write/read of $ready_file:
|
|
sleep 0.1
|
|
|
|
# get created port 0 ephemeral port
|
|
port=`cat "$ready_file"`
|
|
else
|
|
echo -e "NO ready file ending test..."
|
|
do_cleanup
|
|
fi
|
|
}
|
|
|
|
remove_ready_file() {
|
|
if test -e "$ready_file"; then
|
|
echo -e "removing existing ready file"
|
|
rm "$ready_file"
|
|
fi
|
|
}
|
|
|
|
do_cleanup() {
|
|
echo "in cleanup"
|
|
|
|
if [ $server_pid != $no_pid ] && kill -0 $server_pid 2>&-
|
|
then
|
|
# sleep to give sanitizers time to dump backtraces.
|
|
sleep 1
|
|
echo "killing server"
|
|
kill -9 $server_pid
|
|
fi
|
|
remove_ready_file
|
|
}
|
|
|
|
do_trap() {
|
|
echo "got trap"
|
|
do_cleanup
|
|
exit 1
|
|
}
|
|
|
|
trap do_trap INT TERM
|
|
|
|
[ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
|
|
|
|
# Look for if RSA and/or ECC is enabled and adjust certs/keys
|
|
ciphers=`./examples/client/client -e`
|
|
if [[ "$ciphers" != *"RSA"* ]]; then
|
|
if [[ $ciphers == *"ECDSA"* ]]; then
|
|
client_cert=`pwd`/certs/client-ecc-cert.pem
|
|
client_ca=`pwd`/certs/server-ecc.pem
|
|
client_key=`pwd`/certs/ecc-client-key.pem
|
|
ca_key=`pwd`/certs/ecc-key.pem
|
|
server_cert=`pwd`/certs/server-ecc.pem
|
|
server_key=`pwd`/certs/ecc-key.pem
|
|
wrong_ca=`pwd`/certs/server-ecc-comp.pem
|
|
wrong_cert=`pwd`/certs/server-ecc-comp.pem
|
|
else
|
|
echo "configure options not set up for test. No RSA or ECC"
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
# CRL list not set up for tests
|
|
crl_test=`./examples/client/client -h`
|
|
if [[ "$crl_test" == *"-C "* ]]; then
|
|
echo "test not set up to run with CRL"
|
|
exit 0
|
|
fi
|
|
|
|
# Test for trusted peer certs build
|
|
echo ""
|
|
echo "Checking built with trusted peer certs "
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
remove_ready_file
|
|
./examples/server/server -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$client_ca" -p $port
|
|
RESULT=$?
|
|
remove_ready_file
|
|
# if fail here then is a settings issue so return 0
|
|
if [ $RESULT -ne 0 ]; then
|
|
echo -e "\n\nTrusted peer certs not enabled \"WOLFSSL_TRUST_PEER_CERT\""
|
|
do_cleanup
|
|
exit 0
|
|
fi
|
|
echo ""
|
|
|
|
# Test that using no CA's and only trusted peer certs works
|
|
echo "Server and Client relying on trusted peer cert loaded"
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
./examples/server/server -A "$wrong_ca" -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$wrong_ca" -E "$server_cert" -c "$client_cert" -p $port
|
|
RESULT=$?
|
|
remove_ready_file
|
|
if [ $RESULT -ne 0 ]; then
|
|
echo -e "\nServer and Client trusted peer cert failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
echo ""
|
|
|
|
# Test that using server trusted peer certs works
|
|
echo "Server relying on trusted peer cert loaded"
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
./examples/server/server -A "$wrong_ca" -E "$client_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$client_ca" -c "$client_cert" -p $port
|
|
RESULT=$?
|
|
remove_ready_file
|
|
if [ $RESULT -ne 0 ]; then
|
|
echo -e "\nServer trusted peer cert test failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
echo ""
|
|
|
|
# Test that using client trusted peer certs works
|
|
echo "Client relying on trusted peer cert loaded"
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$wrong_ca" -E "$server_cert" -p $port
|
|
RESULT=$?
|
|
remove_ready_file
|
|
if [ $RESULT -ne 0 ]; then
|
|
echo -e "\nClient trusted peer cert test failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
echo ""
|
|
|
|
# Test that client fall through to CA works
|
|
echo "Client fall through to loaded CAs"
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$client_ca" -E "$wrong_cert" -p $port
|
|
RESULT=$?
|
|
remove_ready_file
|
|
if [ $RESULT -ne 0 ]; then
|
|
echo -e "\nClient trusted peer cert fall through to CA test failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
echo ""
|
|
|
|
# Test that client can fail
|
|
# check if using ECC client example is hard coded to load correct ECC ca so skip
|
|
if [[ $wrong_ca != *"ecc"* ]]; then
|
|
echo "Client wrong CA and wrong trusted peer cert loaded"
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
./examples/server/server -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$wrong_ca" -E "$wrong_cert" -p $port
|
|
RESULT=$?
|
|
remove_ready_file
|
|
if [ $RESULT -eq 0 ]; then
|
|
echo -e "\nClient trusted peer cert test failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
echo ""
|
|
fi
|
|
|
|
# Test that server can fail
|
|
echo "Server wrong CA and wrong trusted peer cert loaded"
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
./examples/server/server -A "$wrong_ca" -E "$wrong_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$client_ca" -p $port
|
|
RESULT=$?
|
|
remove_ready_file
|
|
if [ $RESULT -eq 0 ]; then
|
|
echo -e "\nServer trusted peer cert test failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
echo ""
|
|
|
|
# Test that server fall through to CA works
|
|
echo "Server fall through to loaded CAs"
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
./examples/server/server -E "$wrong_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$client_ca" -p $port
|
|
RESULT=$?
|
|
remove_ready_file
|
|
if [ $RESULT -ne 0 ]; then
|
|
echo -e "\nServer trusted peer cert fall through to CA test failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
echo ""
|
|
|
|
# test loading multiple certs
|
|
echo "Server loading multiple trusted peer certs"
|
|
echo "Test two success cases and one fail case"
|
|
echo "-----------------------------------------------------"
|
|
port=0
|
|
cat "$client_cert" "$client_ca" > "$combined_cert"
|
|
./examples/server/server -i -A "$wrong_ca" -E "$combined_cert" -c "$server_cert" -k "$server_key" -R "$ready_file" -p $port &
|
|
server_pid=$!
|
|
create_port
|
|
./examples/client/client -A "$client_ca" -c "$client_cert" -k "$client_key" -p $port
|
|
RESULT=$?
|
|
if [ $RESULT -ne 0 ]; then
|
|
echo -e "\nServer load multiple trusted peer certs failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
./examples/client/client -A "$client_ca" -c "$client_ca" -k "$ca_key" -p $port
|
|
RESULT=$?
|
|
if [ $RESULT -ne 0 ]; then
|
|
echo -e "\nServer load multiple trusted peer certs failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
./examples/client/client -A "$client_ca" -c "$wrong_cert" -k "$client_key" -p $port
|
|
RESULT=$?
|
|
if [ $RESULT -eq 0 ]; then
|
|
echo -e "\nServer load multiple trusted peer certs failed!"
|
|
do_cleanup
|
|
exit 1
|
|
fi
|
|
|
|
do_cleanup # kill PID of server running in infinite loop
|
|
rm "$combined_cert"
|
|
remove_ready_file
|
|
echo ""
|
|
|
|
echo "-----------------------------------------------------"
|
|
echo "ALL TESTS PASSED"
|
|
echo "-----------------------------------------------------"
|
|
|
|
exit 0
|
|
|
|
|