mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-29 17:29:53 +02:00
Juliusz Sosinowicz
1fa1228ba1
Three ways the bounds added here failed to do their job: - get_first_free_port ended the scan cap with 'exit 1', but every caller runs it in a command substitution, so only the subshell died. The port variable came back empty, the next $((port + 1)) evaluated to 1, and the run limped on to a confusing wait_for_readyFile failure. Forcing the cap on ocsp-stapling.test: before, the script ran on and hung until an outer timeout killed it; now it exits 1 at the error. Return instead, and check the status at all 25 call sites across the six scripts. - The macOS timeout shim was a shell function. Backgrounding a function forks a subshell, so $! was the subshell and cleanup killed that while the server it was meant to stop leaked. Use a prefix variable that expands to nothing when timeout(1) is absent, keeping $! the real pid. - timeout -s KILL exits 137, not 124. Sites that read $? and treat any non-zero as 'feature not compiled in' turned a hang into exit 0, so the bound made a hang less visible than before. Add timed_out() and check it before those skip branches; use it for the version probes too, which matched any status >= 124.
117 lines
3.9 KiB
Bash
Executable File
117 lines
3.9 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# ocsp.test
|
|
|
|
# timeout(1) is GNU coreutils and absent on macOS; where it's missing, run the
|
|
# command unbounded (the flaky hang this guards against is Linux-only CI).
|
|
# A prefix variable rather than a shell function: backgrounding a function
|
|
# makes $! the forked subshell, so a later "kill $server_pid" would stop the
|
|
# wrapper and orphan the server it was meant to kill.
|
|
if command -v timeout >/dev/null 2>&1; then
|
|
TIMEOUT_KILL_2M="timeout -s KILL 2m"
|
|
else
|
|
TIMEOUT_KILL_2M=""
|
|
fi
|
|
|
|
# Note, this script makes connection(s) to the public Internet.
|
|
|
|
SCRIPT_DIR="$(dirname "$0")"
|
|
|
|
server=www.globalsign.com
|
|
ca=certs/external/ca-globalsign-root.pem
|
|
|
|
[ ! -x ./examples/client/client ] && printf '\n\n%s\n' "Client doesn't exist" \
|
|
&& exit 1
|
|
|
|
if ! ./examples/client/client -V | grep -q 3; then
|
|
echo 'skipping ocsp.test because TLS1.2 is not available.' 1>&2
|
|
exit 77
|
|
fi
|
|
|
|
GL_UNREACHABLE=0
|
|
# Global Sign now requires server name indication extension to work, check
|
|
# enabled prior to testing
|
|
OUTPUT=$(eval "./examples/client/client -S check")
|
|
if [ "$OUTPUT" = "SNI is: ON" ]; then
|
|
printf '\n\n%s\n\n' "SNI is on, proceed with globalsign test"
|
|
|
|
if [ "$AM_BWRAPPED" != "yes" ]; then
|
|
# is our desired server there?
|
|
"${SCRIPT_DIR}/ping.test" $server 2
|
|
RESULT=$?
|
|
if [ $RESULT -ne 0 ]; then
|
|
GL_UNREACHABLE=1
|
|
fi
|
|
else
|
|
RESULT=0
|
|
fi
|
|
|
|
if [ $RESULT -eq 0 ]; then
|
|
# client test against the server
|
|
echo "./examples/client/client -X -C -h $server -p 443 -A \"$ca\" -g -o -N -v d -S $server"
|
|
$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server -p 443 -A "$ca" -g -o -N -v d -S $server
|
|
GL_RESULT=$?
|
|
[ $GL_RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection failed"
|
|
else
|
|
GL_RESULT=1
|
|
fi
|
|
else
|
|
printf '\n\n%s\n\n' "SNI disabled, skipping globalsign test"
|
|
GL_RESULT=0
|
|
fi
|
|
|
|
server=www.google.com
|
|
ca=certs/external/ca-google-root.pem
|
|
|
|
if [ "$AM_BWRAPPED" != "yes" ]; then
|
|
# is our desired server there?
|
|
${SCRIPT_DIR}/ping.test $server 2
|
|
RESULT=$?
|
|
else
|
|
RESULT=0
|
|
fi
|
|
|
|
if [ $RESULT -eq 0 ]; then
|
|
# client test against the server
|
|
echo "./examples/client/client -X -C -h $server -p 443 -A \"$ca\" -g -o -N"
|
|
$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server -p 443 -A "$ca" -g -o -N
|
|
GR_RESULT=$?
|
|
[ $GR_RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection failed"
|
|
else
|
|
GR_RESULT=1
|
|
fi
|
|
|
|
if test -n "$WOLFSSL_OCSP_TEST"; then
|
|
# check that both passed
|
|
if [ $GL_RESULT -eq 0 ] && [ $GR_RESULT -eq 0 ]; then
|
|
printf '\n\n%s\n' "Both OCSP connection to globalsign and google passed"
|
|
printf '%s\n' "Test Passed!"
|
|
exit 0
|
|
elif [ $GL_UNREACHABLE -eq 1 ] && [ $GR_RESULT -eq 0 ]; then
|
|
printf '%s\n' "Global Sign is currently unreachable. Logging it but if"
|
|
printf '%s\n' "this continues to occur should be investigated"
|
|
exit 0
|
|
else
|
|
# Unlike other environment variables the intent of WOLFSSL_OCSP_TEST
|
|
# is to indicate a requirement for both tests to pass. If variable is
|
|
# set and either tests fail then whole case fails. Do not set the
|
|
# variable if either case passing is to be considered a success.
|
|
printf '\n\n%s\n' "One of the OCSP connections to either globalsign or"
|
|
printf '%s\n' "google failed, however since WOLFSSL_OCSP_TEST is set"
|
|
printf '%s\n' "the test is considered to have failed"
|
|
printf '%s\n' "Test Failed!"
|
|
exit 1
|
|
fi
|
|
else
|
|
# if environment variable is not set then just need one to pass
|
|
if [ $GL_RESULT -ne 0 ] && [ $GR_RESULT -ne 0 ]; then
|
|
printf '\n\n%s\n' "Both OCSP connection to globalsign and google failed"
|
|
printf '%s\n' "Test Failed!"
|
|
exit 77
|
|
else
|
|
printf '\n\n%s\n' "WOLFSSL_OCSP_TEST NOT set, and 1 of the tests passed"
|
|
printf '%s\n' "Test Passed!"
|
|
exit 0
|
|
fi
|
|
fi
|