luna - wolfssl/scripts/openssl.test

   1#!/usr/bin/env bash
   2
   3# openssl.test
   4
   5# Environment variables used:
   6# OPENSSL            (openssl app to use)
   7# OPENSSL_ENGINE_ID  (engine id if any i.e. "wolfengine")
   8
   9CERT_DIR="$PWD/$(dirname "$0")/../certs"
  10
  11if ! test -n "$WOLFSSL_OPENSSL_TEST"; then
  12    echo "WOLFSSL_OPENSSL_TEST NOT set, won't run"
  13    exit 77
  14fi
  15
  16# if we can, isolate the network namespace to eliminate port collisions.
  17if [[ -n "$NETWORK_UNSHARE_HELPER" ]]; then
  18     if [[ -z "$NETWORK_UNSHARE_HELPER_CALLED" ]]; then
  19         export NETWORK_UNSHARE_HELPER_CALLED=yes
  20         exec "$NETWORK_UNSHARE_HELPER" "$0" "$@" || exit $?
  21     fi
  22elif [ "${AM_BWRAPPED-}" != "yes" ]; then
  23    bwrap_path="$(command -v bwrap)"
  24    if [ -n "$bwrap_path" ]; then
  25        export AM_BWRAPPED=yes
  26        exec "$bwrap_path" --unshare-net --dev-bind / / "$0" "$@"
  27    fi
  28    unset AM_BWRAPPED
  29fi
  30
  31echo "WOLFSSL_OPENSSL_TEST set, running test..."
  32
  33# need a unique port since may run the same time as testsuite
  34# Track ports already assigned in this script run to prevent intra-run collisions
  35used_ports=()
  36
  37generate_port() {
  38    #-------------------------------------------------------------------------#
  39    # Generate a random port number, guaranteed unique within this script run.
  40    # Checks both the intra-run used_ports list and system-level bound ports.
  41    #-------------------------------------------------------------------------#
  42    local attempts=0 collision p
  43
  44    while true; do
  45        if [[ "$OSTYPE" == "linux"* ]]; then
  46            p=$(($(od -An -N2 /dev/urandom) % (65535-49512) + 49512))
  47        elif [[ "$OSTYPE" == "darwin"* ]]; then
  48            p=$(($(od -An -N2 /dev/random) % (65535-49512) + 49512))
  49        else
  50            echo "Unknown OS TYPE"
  51            exit 1
  52        fi
  53
  54        # Check against ports already assigned in this run
  55        collision=0
  56        for up in "${used_ports[@]}"; do
  57            if [ "$up" = "$p" ]; then
  58                collision=1
  59                break
  60            fi
  61        done
  62
  63        # Also check if the port is already bound on this system
  64        if [ "$collision" -eq 0 ]; then
  65            if command -v ss &>/dev/null; then
  66                ss -lnt 2>/dev/null | grep -q ":${p}[[:space:]]" && collision=1
  67            elif command -v netstat &>/dev/null; then
  68                netstat -lnt 2>/dev/null | grep -q ":${p}[[:space:]]" && collision=1
  69            fi
  70        fi
  71
  72        [ "$collision" -eq 0 ] && break
  73
  74        ((attempts++))
  75        if [ "$attempts" -ge 100 ]; then
  76            echo "ERROR: generate_port could not find a free port after 100 attempts"
  77            exit 1
  78        fi
  79    done
  80
  81    port=$p
  82    used_ports+=("$p")
  83}
  84
  85no_pid=-1
  86servers=""
  87openssl_pid=$no_pid
  88ecdh_openssl_pid=$no_pid
  89ecdsa_openssl_pid=$no_pid
  90ed25519_openssl_pid=$no_pid
  91ed448_openssl_pid=$no_pid
  92tls13_psk_openssl_pid=$no_pid
  93wolfssl_pid=$no_pid
  94ecdh_wolfssl_pid=$no_pid
  95ecdsa_wolfssl_pid=$no_pid
  96ed25519_wolfssl_pid=$no_pid
  97ed448_wolfssl_pid=$no_pid
  98tls13_psk_wolfssl_pid=$no_pid
  99anon_wolfssl_pid=$no_pid
 100wolf_cases_tested=0
 101wolf_cases_total=0
 102counter=0
 103wolfssl_no_resume=""
 104testing_summary="OpenSSL Interop Testing Summary:\nVersion\tTested\t#Found\t#wolf\t#Found\t#OpenSSL\n"
 105versionName="Invalid"
 106if [ "$OPENSSL" = "" ]; then
 107    OPENSSL=openssl
 108fi
 109WOLFSSL_SERVER=./examples/server/server
 110WOLFSSL_CLIENT=./examples/client/client
 111
 112version_name() {
 113    case $version in "0")
 114        versionName="SSLv3"
 115        ;;
 116    "1")
 117        versionName="TLSv1"
 118        ;;
 119    "2")
 120        versionName="TLSv1.1"
 121        ;;
 122    "3")
 123        versionName="TLSv1.2"
 124        ;;
 125    "4")
 126        versionName="TLSv1.3"
 127        ;;
 128    "d")
 129        versionName="Down"
 130        ;;
 131    "")
 132        versionName="Def"
 133        ;;
 134    "5")
 135        versionName="ALL"
 136        ;;
 137    esac
 138}
 139
 140do_cleanup() {
 141    echo "in cleanup"
 142
 143    IFS=$OIFS #restore separator
 144    sleepseconds=1
 145    for s in $servers
 146    do
 147        f2=${s%:*}
 148        sname=${f2%:*}
 149        pid=${f2##*:}
 150        port=${s##*:}
 151        if kill -0 "$pid" 2>&-
 152        then
 153            # sleep to give sanitizers time to dump backtraces.
 154            sleep $sleepseconds
 155            sleepseconds=0
 156            echo "killing server: $sname ($port)"
 157            kill -9 "$pid"
 158        fi
 159    done
 160}
 161
 162do_trap() {
 163    echo "got trap"
 164    do_cleanup
 165    exit 1
 166}
 167
 168trap do_trap INT TERM
 169
 170#
 171# Start an OpenSSL server
 172#
 173start_openssl_server() {
 174    if [ "$wolfssl_client_avail" = "" ]
 175    then
 176        return
 177    fi
 178
 179    generate_port
 180    server_port=$port
 181    found_free_port=0
 182    counter=0
 183
 184    # If OPENSSL_ENGINE_ID has been set then check that the desired engine can
 185    # be loaded successfully and error out if not. Otherwise the OpenSSL app
 186    # will fall back to default engine.
 187    if [ -n "${OPENSSL_ENGINE_ID}" ]; then
 188        OUTPUT=$($OPENSSL engine -tt "$OPENSSL_ENGINE_ID")
 189        if ! echo "$OUTPUT" | grep -q "available"; then
 190            printf "not able to load engine or engine not available\n"
 191            printf '%s\n' "$OPENSSL engine -tt $OPENSSL_ENGINE_ID"
 192            do_cleanup
 193            exit 1
 194        fi
 195        OPENSSL_ENGINE_ID="-engine ${OPENSSL_ENGINE_ID}"
 196    fi
 197
 198    while [ "$counter" -lt 20 ]; do
 199        echo -e "\n# Trying to start $openssl_suite OpenSSL server on port $server_port..."
 200        echo "#"
 201
 202        if [ "$cert_file" != "" ]
 203        then
 204            echo "# $OPENSSL s_server -accept $server_port $OPENSSL_ENGINE_ID -cert \"$cert_file\" -key \"$key_file\" -quiet -CAfile \"$ca_file\" -www -dhparam \"${CERT_DIR}/dh2048.pem\" -verify 10 -verify_return_error -psk $psk_hex -cipher \"ALL:eNULL\" $openssl_nodhe"
 205            # shellcheck disable=SC2086
 206            $OPENSSL s_server -accept "$server_port" $OPENSSL_ENGINE_ID -cert "$cert_file" -key "$key_file" -quiet -CAfile "$ca_file" -www -dhparam "${CERT_DIR}/dh2048.pem" -verify 10 -verify_return_error -psk "$psk_hex" -cipher "ALL:eNULL" $openssl_nodhe &
 207        else
 208            echo "# $OPENSSL s_server -accept $server_port $OPENSSL_ENGINE_ID -quiet -nocert -www -dhparam \"${CERT_DIR}/dh2048.pem\" -verify 10 -verify_return_error -psk $psk_hex -cipher \"ALL:eNULL\" $openssl_nodhe"
 209            # shellcheck disable=SC2086
 210            $OPENSSL s_server -accept "$server_port" $OPENSSL_ENGINE_ID -quiet -nocert -www -dhparam "${CERT_DIR}/dh2048.pem" -verify 10 -verify_return_error -psk "$psk_hex" -cipher "ALL:eNULL" $openssl_nodhe &
 211        fi
 212        server_pid=$!
 213        # wait to see if s_server successfully starts before continuing
 214        sleep 0.1
 215
 216        if kill -0 "$server_pid" 2>/dev/null
 217        then
 218            echo "s_server started successfully on port $server_port"
 219            found_free_port=1
 220            break
 221        else
 222            #port already started, try a different port
 223            counter=$((counter+ 1))
 224            generate_port
 225            server_port=$port
 226        fi
 227    done
 228
 229    if [ "$found_free_port" = 0 ]
 230    then
 231        echo -e "Couldn't find free port for server"
 232        do_cleanup
 233        exit 1
 234    fi
 235
 236    servers="$servers OpenSSL_$openssl_suite:$server_pid:$server_port"
 237}
 238
 239#
 240# Start a wolfSSL server
 241#
 242start_wolfssl_server() {
 243    if [ "$wolfssl_server_avail" = "" ]
 244    then
 245        echo "# wolfSSL server not available"
 246        return
 247    fi
 248
 249    wolfssl_cert=""
 250    wolfssl_key=""
 251    wolfssl_caCert=""
 252    if [ "$cert_file" != "" ]
 253    then
 254        wolfssl_cert="-c$cert_file"
 255    fi
 256    if [ "$key_file" != "" ]
 257    then
 258        wolfssl_key="-k$key_file"
 259    fi
 260    if [ "$ca_file" != "" ]
 261    then
 262        wolfssl_caCert="-A$ca_file"
 263    fi
 264
 265    generate_port
 266    server_port=$port
 267    found_free_port=0
 268    counter=0
 269    while [ "$counter" -lt 20 ]; do
 270        echo -e "\n# Trying to start $wolfssl_suite wolfSSL server on port $server_port..."
 271
 272        echo "#"
 273        echo "# $WOLFSSL_SERVER -p $server_port -g -v d -x -i $psk $crl -l ALL:eNULL \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\""
 274        # shellcheck disable=SC2086
 275        $WOLFSSL_SERVER -p "$server_port" -g -v d -x -i $psk $crl -l ALL:eNULL "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" &
 276        server_pid=$!
 277        # wait to see if server successfully starts before continuing
 278        sleep 0.1
 279
 280        if kill -0 "$server_pid" 2>/dev/null
 281        then
 282            echo "wolfSSL server started successfully on port $server_port"
 283            found_free_port=1
 284            break
 285        else
 286            #port already started, try a different port
 287            counter=$((counter+ 1))
 288            generate_port
 289            server_port=$port
 290        fi
 291    done
 292
 293    if [ "$found_free_port" = 0 ]
 294    then
 295        echo -e "Couldn't find free port for server"
 296        do_cleanup
 297        exit 1
 298    fi
 299
 300    servers="$servers wolfSSL_$wolfssl_suite:$server_pid:$server_port"
 301}
 302
 303check_server_ready() {
 304    # server should be ready, let's make sure
 305    server_ready=0
 306    while [ "$counter" -lt 20 ]; do
 307        echo -e "waiting for $server_name ready..."
 308        echo -e Checking | nc -4 -w 1 -z localhost "$server_port"
 309        nc_result=$?
 310        if [ "$nc_result" = 0 ]
 311        then
 312            echo -e "$server_name ready!"
 313            server_ready=1
 314            break
 315        fi
 316        sleep 0.1
 317        counter=$((counter+ 1))
 318    done
 319
 320    if [ $server_ready = 0 ]
 321    then
 322        echo -e "Couldn't verify $server_name is running, timeout error"
 323        do_cleanup
 324        exit 1
 325    fi
 326}
 327
 328#
 329# Run wolfSSL client against OpenSSL server
 330#
 331do_wolfssl_client() {
 332    if [ "$wolfssl_client_avail" = "" ]
 333    then
 334        return
 335    fi
 336
 337    wolfssl_cert=""
 338    wolfssl_key=""
 339    wolfssl_caCert=""
 340    if [ "$cert" != "" ]
 341    then
 342        wolfssl_cert="-c$cert"
 343    fi
 344    if [ "$key" != "" ]
 345    then
 346        wolfssl_key="-k$key"
 347    fi
 348    if [ "$caCert" != "" ]
 349    then
 350        wolfssl_caCert="-A$caCert"
 351    fi
 352    wolfssl_resume="-r"
 353    if [ "$openssl_psk_resume_bug" != "" ] && [ "$tls13_suite" != "" ]
 354    then
 355        wolfssl_resume=
 356    fi
 357    if [ "$wolfssl_no_resume" = "yes" ]
 358    then
 359        wolfssl_resume=
 360    fi
 361    if [ "$version" != "5" ] && [ "$version" != "" ]
 362    then
 363        echo "#"
 364        echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite -v $version $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"
 365        # shellcheck disable=SC2086
 366        $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
 367    else
 368        echo "#"
 369        echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"
 370        # do all versions
 371        # shellcheck disable=SC2086
 372        $WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl
 373    fi
 374
 375    client_result=$?
 376
 377    if [ "$client_result" != 0 ]
 378    then
 379        echo -e "client failed! Suite = $wolfSuite version = $version"
 380        do_cleanup
 381        exit 1
 382    fi
 383    wolf_temp_cases_tested=$((wolf_temp_cases_tested+1))
 384}
 385
 386#
 387# Run OpenSSL client against wolfSSL server
 388#
 389do_openssl_client() {
 390    if [ "$wolfssl_server_avail" = "" ]
 391    then
 392        return
 393    fi
 394
 395    if [ "$version" = "" ] || [ "$version" = "5" ]
 396    then
 397        if [ "$tls13_cipher" = "" ] && [ "$openssl_tls13" != "" ]
 398        then
 399            openssl_version="-no_tls1_3"
 400        fi
 401    fi
 402    if [ "$cert" != "" ]
 403    then
 404        openssl_cert1="-cert"
 405        openssl_cert2="$cert"
 406    fi
 407    if [ "$key" != "" ]
 408    then
 409        openssl_key1="-key"
 410        openssl_key2="$key"
 411    fi
 412    if [ "$caCert" != "" ]
 413    then
 414        openssl_caCert1="-CAfile"
 415        openssl_caCert2="$caCert"
 416    fi
 417    # Integrity-only cipher suites require SECLEVEL=0 to allow NULL encryption
 418    openssl_seclevel=""
 419    if [ "$tls13_integrity_only" = "yes" ]
 420    then
 421        openssl_seclevel="-cipher ALL:@SECLEVEL=0"
 422    fi
 423
 424    if [ "$tls13_cipher" = "" ]
 425    then
 426        echo "#"
 427        echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
 428        echo "Hello" | eval "$OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
 429    else
 430        echo "#"
 431        echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
 432        echo "Hello" | eval "$OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""
 433    fi
 434
 435    client_result=$?
 436
 437    if [ "$client_result" != 0 ]
 438    then
 439        echo -e "client failed! Suite = $wolfSuite version = $version"
 440        do_cleanup
 441        exit 1
 442    fi
 443    open_temp_cases_tested=$((open_temp_cases_tested+1))
 444}
 445
 446OIFS=$IFS # store old separator to reset
 447
 448#
 449# Start
 450#
 451echo
 452echo "wolfSSL configuration:"
 453./config.status --config
 454echo
 455echo "OpenSSL version:"
 456$OPENSSL version -a
 457echo
 458
 459echo -e "\nTesting existence of openssl command...\n"
 460command -v "$OPENSSL" >/dev/null 2>&1 || { echo >&2 "Requires openssl command, but it's not installed.  Ending."; do_cleanup; exit 0; }
 461
 462
 463echo -e "\nTesting for _build directory as part of distcheck, different paths"
 464currentDir=$(pwd)
 465case "$currentDir" in
 466*_build)
 467    echo -e "_build directory detected, moving a directory back"
 468    cd .. || exit
 469    ;;
 470esac
 471echo -e "\nChecking for wolfSSL client - needed for cipher list"
 472wolfssl_client_avail=$($WOLFSSL_CLIENT -?)
 473case $wolfssl_client_avail in
 474*"Client not compiled in!"*)
 475    wolfssl_client_avail=
 476    echo >&2 "Requires wolfSSL client, but it's not built.  Ending."
 477    do_cleanup
 478    exit 0
 479    ;;
 480esac
 481
 482echo -e "\nTesting for buggy version of OpenSSL - TLS 1.3, PSK and session ticket"
 483openssl_version=$($OPENSSL version)
 484case $openssl_version in
 485"OpenSSL 1.1.1 "*)
 486    openssl_psk_resume_bug=yes
 487    ;;
 488"OpenSSL 1.0.2"*)
 489    openssl_adh_reneg_bug=yes
 490    ;;
 491esac
 492
 493# check for wolfssl server
 494wolfssl_server_avail=$($WOLFSSL_SERVER -?)
 495case $wolfssl_server_avail in
 496*"Server not compiled in!"*)
 497    wolfssl_server_avail=
 498    ;;
 499esac
 500# get wolfssl ciphers
 501wolf_ciphers=$($WOLFSSL_CLIENT -e)
 502# get wolfssl supported versions
 503wolf_versions=$($WOLFSSL_CLIENT -V)
 504wolf_versions="${wolf_versions}:5" #5 will test without -v flag
 505
 506OIFS="$IFS" # store old separator to reset
 507IFS=: # set delimiter
 508for version in $wolf_versions
 509do
 510    case $version in
 511    1|2|3)
 512        wolf_tls=yes
 513        ;;
 514    4)
 515        wolf_tls13=yes
 516        ;;
 517    esac
 518done
 519IFS="$OIFS" #restore separator
 520
 521#
 522# Start OpenSSL servers
 523#
 524
 525# Check for certificate support in wolfSSL
 526wolf_certs=$($WOLFSSL_CLIENT -? 2>&1)
 527case $wolf_certs in
 528*"cert"*)
 529    ;;
 530*)
 531    wolf_certs=""
 532    ;;
 533esac
 534
 535if [ "$wolf_certs" != "" ]
 536then
 537    echo
 538    # Check if RSA certificates supported in wolfSSL
 539    wolf_rsa=$($WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1)
 540    case $wolf_rsa in
 541    *"ca file"*)
 542        echo "wolfSSL does not support RSA"
 543        wolf_rsa=""
 544        ;;
 545    *)
 546        ;;
 547    esac
 548    if [ "$wolf_rsa" != "" ]; then
 549        echo "wolfSSL supports RSA"
 550    fi
 551    # Check if RSA-PSS certificates supported in wolfSSL
 552    wolf_rsapss=$($WOLFSSL_CLIENT -A "${CERT_DIR}/rsapss/ca-rsapss.pem" 2>&1)
 553    case $wolf_rsapss in
 554    *"ca file"*)
 555        echo "wolfSSL does not support RSA-PSS"
 556        wolf_rsapss=""
 557        ;;
 558    *)
 559        ;;
 560    esac
 561    if [ "$wolf_rsapss" != "" ]; then
 562        echo "wolfSSL supports RSA-PSS"
 563    fi
 564    # Check if ECC certificates supported in wolfSSL
 565    wolf_ecc=$($WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1)
 566    case $wolf_ecc in
 567    *"ca file"*)
 568        echo "wolfSSL does not support ECDSA"
 569        wolf_ecc=""
 570        ;;
 571    *)
 572        ;;
 573    esac
 574    if [ "$wolf_ecc" != "" ]; then
 575        echo "wolfSSL supports ECDSA"
 576    fi
 577    # Check if Ed25519 certificates supported in wolfSSL
 578    wolf_ed25519=$($WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1)
 579    case $wolf_ed25519 in
 580    *"ca file"*)
 581        echo "wolfSSL does not support Ed25519"
 582        wolf_ed25519=""
 583        ;;
 584    *)
 585        ;;
 586    esac
 587    if [ "$wolf_ed25519" != "" ]; then
 588        echo "wolfSSL supports Ed25519"
 589    fi
 590    # Check if Ed25519 certificates supported in OpenSSL
 591    openssl_ed25519=$($OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1)
 592    case $openssl_ed25519 in
 593    *"unable to load"*)
 594        echo "OpenSSL does not support Ed25519"
 595        wolf_ed25519=""
 596        ;;
 597    *)
 598        ;;
 599    esac
 600    if [ "$wolf_ed25519" != "" ]; then
 601        echo "OpenSSL supports Ed25519"
 602    fi
 603    # Check if Ed448 certificates supported in wolfSSL
 604    wolf_ed448=$($WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1)
 605    case $wolf_ed448 in
 606    *"ca file"*)
 607        echo "wolfSSL does not support Ed448"
 608        wolf_ed448=""
 609        ;;
 610    *)
 611        ;;
 612    esac
 613    if [ "$wolf_ed448" != "" ]; then
 614        echo "wolfSSL supports Ed448"
 615    fi
 616    # Check if Ed448 certificates supported in OpenSSL
 617    openssl_ed448=$($OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1)
 618    case $openssl_ed448 in
 619    *"unable to load"*)
 620        echo "OpenSSL does not support Ed448"
 621        wolf_ed448=""
 622        ;;
 623    *)
 624        ;;
 625    esac
 626    if [ "$wolf_ed448" != "" ]; then
 627        echo "OpenSSL supports Ed448"
 628    fi
 629    echo
 630fi
 631
 632openssl_tls13=$($OPENSSL s_client -help 2>&1)
 633case $openssl_tls13 in
 634*no_tls1_3*)
 635    ;;
 636*)
 637    openssl_tls13=
 638    ;;
 639esac
 640
 641# Not all openssl versions support -allow_no_dhe_kex
 642openssl_nodhe=$($OPENSSL s_client -help 2>&1)
 643case $openssl_nodhe in
 644*allow_no_dhe_kex*)
 645    openssl_nodhe=-allow_no_dhe_kex
 646    ;;
 647*)
 648    openssl_nodhe=
 649    ;;
 650esac
 651
 652# Check suites to determine support in wolfSSL
 653OIFS="$IFS" # store old separator to reset
 654IFS=: # set delimiter
 655for wolfSuite in $wolf_ciphers; do
 656    case $wolfSuite in
 657    *ECDHE-RSA-*)
 658        ecdhe_avail=yes
 659        wolf_rsa=yes
 660        ;;
 661    *DHE-RSA-*)
 662        wolf_rsa=yes
 663        ;;
 664    *ECDH-RSA*)
 665        wolf_ecdh_rsa=yes
 666        ;;
 667    *ECDHE-ECDSA*|*ECDH-ECDSA*)
 668        wolf_ecdsa=yes
 669        ;;
 670    *ADH*)
 671        wolf_anon=yes
 672        ;;
 673    *PSK*)
 674        if [ "$wolf_psk" = "" ]
 675        then
 676            echo "Testing PSK"
 677            wolf_psk=1
 678        fi
 679        if [ "$wolf_tls" != "" ]
 680        then
 681            wolf_tls_psk=yes
 682        fi
 683        ;;
 684    *TLS13*)
 685        ;;
 686    *)
 687        wolf_rsa=yes
 688    esac
 689done
 690IFS="$OIFS" #restore separator
 691
 692openssl_ciphers=$($OPENSSL ciphers ALL 2>&1)
 693case $openssl_ciphers in
 694*ADH*)
 695    openssl_anon=yes
 696    ;;
 697esac
 698
 699# TLSv1 -> TLSv1.2 PSK secret
 700psk_hex="1a2b3c4d"
 701
 702# If RSA cipher suites supported in wolfSSL then start servers
 703if [ "$wolf_rsa" != "" ] || [ "$wolf_tls_psk" != "" ]
 704then
 705    if [ "$wolf_rsa" != "" ]
 706    then
 707        cert_file="${CERT_DIR}/server-cert.pem"
 708        key_file="${CERT_DIR}/server-key.pem"
 709        ca_file="${CERT_DIR}/client-ca.pem"
 710    else
 711        cert_file=
 712        key_file=
 713        ca_file=
 714    fi
 715
 716    openssl_suite="RSA"
 717    start_openssl_server
 718    openssl_port=$server_port
 719    openssl_pid=$server_pid
 720
 721    wolfssl_suite="RSA"
 722    if [ "$wolf_tls_psk" != "" ]
 723    then
 724        psk="-j"
 725    fi
 726echo "cert_file=$cert_file"
 727    start_wolfssl_server
 728    psk=
 729    wolfssl_port=$server_port
 730    # shellcheck disable=SC2034
 731    wolfssl_pid=$server_pid
 732fi
 733
 734# If ECDH-RSA cipher suites supported in wolfSSL then start servers
 735if [ "$wolf_ecdh_rsa" != "" ]
 736then
 737    cert_file="${CERT_DIR}/server-ecc-rsa.pem"
 738    key_file="${CERT_DIR}/ecc-key.pem"
 739    ca_file="${CERT_DIR}/client-ca.pem"
 740
 741    openssl_suite="ECDH-RSA"
 742    start_openssl_server
 743    ecdh_openssl_port=$server_port
 744    # shellcheck disable=SC2034
 745    ecdh_openssl_pid=$server_pid
 746
 747    wolfssl_suite="ECDH-RSA"
 748    start_wolfssl_server
 749    ecdh_wolfssl_port=$server_port
 750    # shellcheck disable=SC2034
 751    ecdh_wolfssl_pid=$server_pid
 752fi
 753
 754if [ "$wolf_ecdsa" != "" ] && [ "$wolf_ecc" != "" ]
 755then
 756    cert_file="${CERT_DIR}/server-ecc.pem"
 757    key_file="${CERT_DIR}/ecc-key.pem"
 758    ca_file="${CERT_DIR}/client-ecc-cert.pem"
 759
 760    openssl_suite="ECDH[E]-ECDSA"
 761    start_openssl_server
 762    ecdsa_openssl_port=$server_port
 763    ecdsa_openssl_pid=$server_pid
 764
 765    wolfssl_suite="ECDH[E]-ECDSA"
 766    start_wolfssl_server
 767    ecdsa_wolfssl_port=$server_port
 768    # shellcheck disable=SC2034
 769    ecdsa_wolfssl_pid=$server_pid
 770fi
 771
 772# If Ed25519 certificates supported in wolfSSL then start servers
 773if [ "$wolf_ed25519" != "" ];
 774then
 775    cert_file="${CERT_DIR}/ed25519/server-ed25519.pem"
 776    key_file="${CERT_DIR}/ed25519/server-ed25519-priv.pem"
 777    ca_file="${CERT_DIR}/ed25519/client-ed25519.pem"
 778
 779    openssl_suite="Ed25519"
 780    start_openssl_server
 781    ed25519_openssl_port=$server_port
 782    ed25519_openssl_pid=$server_pid
 783
 784    crl="-V"
 785    wolfssl_suite="Ed25519"
 786    start_wolfssl_server
 787    ed25519_wolfssl_port=$server_port
 788    # shellcheck disable=SC2034
 789    ed25519_wolfssl_pid=$server_pid
 790    crl=
 791fi
 792
 793# If Ed448 certificates supported in wolfSSL then start servers
 794if [ "$wolf_ed448" != "" ];
 795then
 796    cert_file="${CERT_DIR}/ed448/server-ed448.pem"
 797    key_file="${CERT_DIR}/ed448/server-ed448-priv.pem"
 798    ca_file="${CERT_DIR}/ed448/client-ed448.pem"
 799
 800    openssl_suite="Ed448"
 801    start_openssl_server
 802    ed448_openssl_port=$server_port
 803    ed448_openssl_pid=$server_pid
 804
 805    crl="-V"
 806    wolfssl_suite="Ed448"
 807    start_wolfssl_server
 808    ed448_wolfssl_port=$server_port
 809    # shellcheck disable=SC2034
 810    ed448_wolfssl_pid=$server_pid
 811    crl=
 812fi
 813
 814if [ "$wolf_tls13" != "" ] && [ "$wolf_psk" != "" ]
 815then
 816    cert_file=
 817
 818    psk_hex="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
 819    openssl_suite="TLSv1.3_PSK"
 820    start_openssl_server
 821    tls13_psk_openssl_port=$server_port
 822    # shellcheck disable=SC2034
 823    tls13_psk_openssl_pid=$server_pid
 824
 825    psk="-s --openssl-psk"
 826    wolfssl_suite="TLSv1.3_PSK"
 827    start_wolfssl_server
 828    tls13_psk_wolfssl_port=$server_port
 829    # shellcheck disable=SC2034
 830    tls13_psk_wolfssl_pid=$server_pid
 831fi
 832if [ "$wolf_anon" != "" ] && [ "$openssl_anon" ]
 833then
 834    cert_file=""
 835    key_file=""
 836    ca_file=""
 837
 838    wolfssl_suite="Anon"
 839    psk="-a" # anonymous not psk
 840    start_wolfssl_server
 841    anon_wolfssl_port=$server_port
 842    # shellcheck disable=SC2034
 843    anon_wolfssl_pid=$server_pid
 844fi
 845
 846for s in $servers
 847do
 848    f2=${s%:*}
 849    server_name=${f2%:*}
 850    server_port=${s##*:}
 851    check_server_ready
 852done
 853
 854OIFS="$IFS" # store old separator to reset
 855IFS=: # set delimiter
 856set -f # no globbing
 857
 858wolf_temp_cases_total=0
 859wolf_temp_cases_tested=0
 860
 861# Testing of OpenSSL support for version requires a running OpenSSL server
 862for version in $wolf_versions;
 863do
 864    echo -e "version = $version"
 865    # get openssl ciphers depending on version
 866    # -s flag for only supported ciphers
 867    case $version in
 868    "0")
 869        openssl_ciphers=$($OPENSSL ciphers "SSLv3" 2>&1)
 870
 871        # double check that can actually do a sslv3 connection using
 872        # client-cert.pem to send but any file with EOF works
 873        $OPENSSL s_client -ssl3 -no_ign_eof -host localhost -port "$openssl_port" < "${CERT_DIR}/client-cert.pem"
 874        sslv3_sup=$?
 875        if [ "$sslv3_sup" != 0 ]
 876        then
 877            echo -e "Not testing SSLv3. No OpenSSL support for 'SSLv3' modifier"
 878            testing_summary="${testing_summary}SSLv3\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
 879            continue
 880        fi
 881        openssl_version="-ssl3"
 882        ;;
 883    "1")
 884        proto_check=$(echo "hell" | $OPENSSL s_client -connect localhost:"$openssl_port" -tls1 2>&1)
 885        tlsv1_sup=$?
 886        if [ "$tlsv1_sup" != 0 ]
 887        then
 888            echo -e "Not testing TLSv1. No OpenSSL support for '-tls1'"
 889            testing_summary="${testing_summary}TLSv1\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL Support)\n"
 890            continue
 891        fi
 892        openssl_ciphers=$($OPENSSL ciphers -s "TLSv1" 2>&1)
 893        tlsv1_sup=$?
 894        if [ "$tlsv1_sup" != 0 ]
 895        then
 896            echo -e "Not testing TLSv1. No OpenSSL support for 'TLSv1' modifier"
 897            testing_summary="${testing_summary}TLSv1\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
 898            continue
 899        fi
 900        openssl_version="-tls1"
 901        ;;
 902    "2")
 903        # Same ciphers for TLSv1.1 as TLSv1
 904        # shellcheck disable=SC2034
 905        proto_check=$(echo "hello" | $OPENSSL s_client -connect localhost:"$openssl_port" -tls1_1 2>&1)
 906        tlsv1_1_sup=$?
 907        if [ "$tlsv1_1_sup" != 0 ]
 908        then
 909            echo -e "Not testing TLSv1.1. No OpenSSL support for 'TLSv1.1' modifier"
 910            testing_summary="${testing_summary}TLSv1.1\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
 911            continue
 912        fi
 913        openssl_ciphers=$($OPENSSL ciphers -s "TLSv1" 2>&1)
 914        tlsv1_sup=$?
 915        if [ "$tlsv1_sup" != 0 ]
 916        then
 917            echo -e "Not testing TLSv1. No OpenSSL support for 'TLSv1' modifier"
 918            testing_summary="${testing_summary}TLSv1\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
 919            continue
 920        fi
 921        openssl_version="-tls1_1"
 922        ;;
 923    "3")
 924        openssl_ciphers=$($OPENSSL ciphers -s "TLSv1.2" 2>&1)
 925        tlsv1_2_sup=$?
 926        if [ "$tlsv1_2_sup" != 0 ]
 927        then
 928            echo -e "Not testing TLSv1.2. No OpenSSL support for 'TLSv1.2' modifier"
 929            testing_summary="${testing_summary}TLSv1.2\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
 930            continue
 931        fi
 932        openssl_version="-tls1_2"
 933        ;;
 934    "4")
 935        openssl_ciphers=$($OPENSSL ciphers -tls1_3 2>&1)
 936        tlsv1_3_sup=$?
 937        if [ "$tlsv1_3_sup" != 0 ]
 938        then
 939            echo -e "Not testing TLSv1.3. No OpenSSL support for 'TLSv1.3' modifier"
 940            testing_summary="${testing_summary}TLSv1.3\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
 941            continue
 942        fi
 943        # shellcheck disable=SC2034
 944        ecc_support=$($WOLFSSL_CLIENT -? 2>&1 | grep 'ECC named groups')
 945        openssl_version="-tls1_3"
 946        ;;
 947    "d(downgrade)")
 948        version="d"
 949        openssl_version=""
 950        ;;
 951    "e(either)")
 952        continue
 953        ;;
 954    "5") #test all suites
 955        openssl_ciphers=$($OPENSSL ciphers -s "ALL" 2>&1)
 956        all_sup=$?
 957        if [ "$all_sup" != 0 ]
 958        then
 959            echo -e "Not testing ALL. No OpenSSL support for ALL modifier"
 960            testing_summary="${testing_summary}ALL\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
 961            continue
 962        fi
 963        openssl_version=""
 964        ;;
 965    "")
 966        openssl_ciphers=$($OPENSSL ciphers 2>&1)
 967        all_sup=$?
 968        if [ "$all_sup" != 0 ]
 969        then
 970            echo -e "Not testing ALL. No OpenSSL support for ALL modifier"
 971            testing_summary="${testing_summary}ALL\tNo\tN/A\tN/A\tN/A\tN/A\t (No OpenSSL cipherstring)\n"
 972            continue
 973        fi
 974        openssl_version=""
 975        ;;
 976    esac
 977
 978    for wolfSuite in $wolf_ciphers; do
 979        echo -e "trying wolfSSL cipher suite $wolfSuite"
 980        wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
 981        open_temp_cases_total=$((open_temp_cases_total + 1))
 982        matchSuite=0
 983        tls13_suite=
 984        tls13_integrity_only=
 985
 986        case $wolfSuite in
 987        "TLS13-AES128-GCM-SHA256")
 988            cmpSuite="TLS_AES_128_GCM_SHA256"
 989            tls13_suite="yes"
 990            ;;
 991        "TLS13-AES256-GCM-SHA384")
 992            cmpSuite="TLS_AES_256_GCM_SHA384"
 993            tls13_suite="yes"
 994            ;;
 995        "TLS13-CHACHA20-POLY1305-SHA256")
 996            cmpSuite="TLS_CHACHA20_POLY1305_SHA256"
 997            tls13_suite="yes"
 998            ;;
 999        "TLS13-AES128-CCM-SHA256")
1000            cmpSuite="TLS_AES_128_CCM_SHA256"
1001            tls13_suite="yes"
1002            ;;
1003        "TLS13-AES128-CCM-8-SHA256"|"TLS13-AES128-CCM8-SHA256")
1004            cmpSuite="TLS_AES_128_CCM_8_SHA256"
1005            tls13_suite="yes"
1006            ;;
1007        "TLS13-SHA256-SHA256")
1008            cmpSuite="TLS_SHA256_SHA256"
1009            tls13_suite="yes"
1010            tls13_integrity_only="yes"
1011            # OpenSSL does not enable TLS_SHA256_SHA256 in openssl ciphers
1012            # output by default, but it can be specified with -ciphersuite as
1013            # done in do_openssl_client()
1014            matchSuite=1
1015            ;;
1016        "TLS13-SHA384-SHA384")
1017            cmpSuite="TLS_SHA384_SHA384"
1018            tls13_suite="yes"
1019            tls13_integrity_only="yes"
1020            # OpenSSL does not enable TLS_SHA256_SHA256 in openssl ciphers
1021            # output by default, but it can be specified with -ciphersuite as
1022            # done in do_openssl_client()
1023            matchSuite=1
1024            ;;
1025        "TLS13-"*)
1026            echo -e "Suite = $wolfSuite not recognized!"
1027            echo -e "Add translation of wolfSSL name to OpenSSL"
1028            do_cleanup
1029            exit 1
1030            ;;
1031        *)
1032            cmpSuite=$wolfSuite
1033            ;;
1034        esac
1035
1036        if [ $matchSuite = 0 ]
1037        then
1038            case ":$openssl_ciphers:" in *":$cmpSuite:"*) # add extra : for edge cases
1039                case "$cmpSuite" in
1040                "TLS_"*)
1041                    if [ "$version" != "4" ] && [ "$version" != "d" ]
1042                    then
1043                        echo -e "TLS 1.3 cipher suite but not TLS 1.3 protocol"
1044                        matchSuite=0
1045                    else
1046                        echo -e "Matched to OpenSSL suite support"
1047                        matchSuite=1
1048                    fi
1049                    ;;
1050                *)
1051                    if [ "$version" = "d" ] && [ "$wolfdowngrade" = "4" ]
1052                    then
1053                        echo -e "Not TLS 1.3 cipher suite but TLS 1.3 downgrade"
1054                        matchSuite=0
1055                    elif [ "$version" != "4" ]
1056                    then
1057                        echo -e "Matched to OpenSSL suite support"
1058                        matchSuite=1
1059                    else
1060                        echo -e "Not TLS 1.3 cipher suite but TLS 1.3 protocol"
1061                        matchSuite=0
1062                    fi
1063                    ;;
1064                esac
1065                ;;
1066            esac
1067        fi
1068
1069        if [ $matchSuite = 0 ]
1070        then
1071            echo -e "Couldn't match suite, continuing..."
1072            continue
1073        fi
1074
1075        # check for psk suite and turn on client psk if so
1076        psk=""
1077        adh=""
1078        crl=""
1079        cert=""
1080        key=""
1081        caCert=""
1082        case $wolfSuite in
1083        *ECDH-RSA*)
1084            cert="${CERT_DIR}/client-cert.pem"
1085            key="${CERT_DIR}/client-key.pem"
1086            caCert="${CERT_DIR}/ca-cert.pem"
1087            port=$ecdh_openssl_port
1088            do_wolfssl_client
1089            port=$ecdh_wolfssl_port
1090            do_openssl_client
1091            ;;
1092        *ECDHE-ECDSA*|*ECDH-ECDSA*)
1093            if [ "$wolf_ecc" != "" ]
1094            then
1095                cert="${CERT_DIR}/client-ecc-cert.pem"
1096                key="${CERT_DIR}/ecc-client-key.pem"
1097                caCert="${CERT_DIR}/ca-ecc-cert.pem"
1098
1099                port=$ecdsa_openssl_port
1100                do_wolfssl_client
1101                port=$ecdsa_wolfssl_port
1102                do_openssl_client
1103            else
1104                wolf_temp_cases_total=$((wolf_temp_cases_total - 1))
1105            fi
1106            if [ "$ed25519_openssl_pid" != "$no_pid" ] && [ "$version" != "0" ] && [ "$version" != "1" ] && [ "$version" != "2" ]
1107            then
1108                cert="${CERT_DIR}/ed25519/client-ed25519.pem"
1109                key="${CERT_DIR}/ed25519/client-ed25519-priv.pem"
1110                caCert="${CERT_DIR}/ed25519/server-ed25519.pem"
1111
1112                wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
1113                port=$ed25519_openssl_port
1114                crl="-C"
1115                do_wolfssl_client
1116                open_temp_cases_total=$((open_temp_cases_total + 1))
1117                port=$ed25519_wolfssl_port
1118                do_openssl_client
1119            fi
1120            if [ "$ed448_openssl_pid" != "$no_pid" ] && [ "$version" != "0" ] && [ "$version" != "1" ] && [ "$version" != "2" ]
1121            then
1122                cert="${CERT_DIR}/ed448/client-ed448.pem"
1123                key="${CERT_DIR}/ed448/client-ed448-priv.pem"
1124                caCert="${CERT_DIR}/ed448/server-ed448.pem"
1125
1126                wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
1127                port=$ed448_openssl_port
1128                crl="-C"
1129                do_wolfssl_client
1130                open_temp_cases_total=$((open_temp_cases_total + 1))
1131                port=$ed448_wolfssl_port
1132                do_openssl_client
1133            fi
1134            ;;
1135        *DHE-PSK*)
1136            cert="${CERT_DIR}/client-cert.pem"
1137            key="${CERT_DIR}/client-key.pem"
1138            caCert="${CERT_DIR}/ca-cert.pem"
1139
1140            port=$openssl_port
1141            psk="-s"
1142            do_wolfssl_client
1143
1144            # Skip when no RSA as some versions of OpenSSL can't handle no
1145            # signature
1146            if [ "$wolf_rsa" != "" ]
1147            then
1148                port=$wolfssl_port
1149                openssl_psk="-psk 1a2b3c4d"
1150                do_openssl_client
1151            fi
1152            ;;
1153        *PSK*)
1154            cert="${CERT_DIR}/client-cert.pem"
1155            key="${CERT_DIR}/client-key.pem"
1156            caCert="${CERT_DIR}/ca-cert.pem"
1157
1158            port=$openssl_port
1159            psk="-s"
1160            do_wolfssl_client
1161            port=$wolfssl_port
1162            openssl_psk="-psk 1a2b3c4d"
1163            do_openssl_client
1164            ;;
1165        *ADH*)
1166            cert="${CERT_DIR}/client-cert.pem"
1167            key="${CERT_DIR}/client-key.pem"
1168            caCert="${CERT_DIR}/ca-cert.pem"
1169
1170            if [ "$version" != "0" ] && [ "$version" != "1" ] && [ "$version" != "2" ] && [ "$openssl_adh_reneg_bug" != "" ]
1171            then
1172                continue
1173            fi
1174
1175            port=$openssl_port
1176            adh="-a"
1177            do_wolfssl_client
1178            port=$anon_wolfssl_port
1179            do_openssl_client
1180            ;;
1181        TLS13*)
1182            if [ "$version" != "4" ] && [ "$version" != "d" ] && [ "$version" != " " ] && [ "$version" != "5" ]
1183            then
1184                continue
1185            fi
1186            tls13_cipher=yes
1187            # Integrity-only cipher suites (NULL encryption)
1188            if [ "$tls13_integrity_only" = "yes" ]
1189            then
1190                # Only run integrity-only tests with TLS 1.3 (version 4)
1191                if [ "$version" != "4" ]
1192                then
1193                    tls13_cipher=
1194                    tls13_integrity_only=
1195                    continue
1196                fi
1197
1198                # Integrity-only cipher suites require OpenSSL 3.4 or later
1199                if $OPENSSL version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 | \
1200                    awk -F. '{if ($1 > 3 || ($1 == 3 && $2 >= 4)) exit 1; else exit 0;}'; then
1201                    echo -e "OpenSSL version too old for integrity-only ciphers, skipping"
1202                    tls13_cipher=
1203                    tls13_integrity_only=
1204                    continue
1205                fi
1206
1207                # Test with RSA certs if available
1208                if [ "$openssl_pid" != "$no_pid" ] && [ "$wolf_rsa" != "" ]
1209                then
1210                    cert="${CERT_DIR}/client-cert.pem"
1211                    key="${CERT_DIR}/client-key.pem"
1212                    caCert="${CERT_DIR}/ca-cert.pem"
1213
1214                    # Start a dedicated OpenSSL server for integrity-only tests
1215                    generate_port
1216                    integrity_openssl_port=$port
1217                    $OPENSSL s_server -accept "$integrity_openssl_port" -cert "${CERT_DIR}/server-cert.pem" -key "${CERT_DIR}/server-key.pem" -quiet -CAfile "${CERT_DIR}/client-cert.pem" -www -cipher "ALL:eNULL:@SECLEVEL=0" -ciphersuites "$cmpSuite" -verify 10 -verify_return_error &
1218                    integrity_openssl_pid=$!
1219                    sleep 0.1
1220
1221                    port=$integrity_openssl_port
1222                    do_wolfssl_client
1223
1224                    # Kill the dedicated server
1225                    kill "$integrity_openssl_pid" 2>/dev/null
1226
1227                    port=$wolfssl_port
1228                    do_openssl_client
1229                fi
1230                # Test with ECC certs if available
1231                if [ "$ecdsa_openssl_pid" != "$no_pid" ] && [ "$wolf_ecc" != "" ]
1232                then
1233                    cert="${CERT_DIR}/client-ecc-cert.pem"
1234                    key="${CERT_DIR}/ecc-client-key.pem"
1235                    caCert="${CERT_DIR}/ca-ecc-cert.pem"
1236
1237                    # Start a dedicated OpenSSL server for integrity-only tests (ECC)
1238                    generate_port
1239                    integrity_openssl_port=$port
1240                    $OPENSSL s_server -accept "$integrity_openssl_port" -cert "${CERT_DIR}/server-ecc.pem" -key "${CERT_DIR}/ecc-key.pem" -quiet -CAfile "${CERT_DIR}/client-ecc-cert.pem" -www -cipher "ALL:eNULL:@SECLEVEL=0" -ciphersuites "$cmpSuite" -verify 10 -verify_return_error &
1241                    integrity_openssl_pid=$!
1242                    sleep 0.1
1243
1244                    wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
1245                    port=$integrity_openssl_port
1246                    do_wolfssl_client
1247
1248                    # Kill the dedicated server
1249                    kill "$integrity_openssl_pid" 2>/dev/null
1250
1251                    open_temp_cases_total=$((open_temp_cases_total + 1))
1252                    port=$ecdsa_wolfssl_port
1253                    do_openssl_client
1254                fi
1255                tls13_cipher=
1256                tls13_integrity_only=
1257                continue
1258            fi
1259            # RSA
1260            if [ "$openssl_pid" != "$no_pid" ] && [ "$ecdhe_avail" = "yes" ]
1261            then
1262                cert="${CERT_DIR}/client-cert.pem"
1263                key="${CERT_DIR}/client-key.pem"
1264                caCert="${CERT_DIR}/ca-cert.pem"
1265
1266                port=$openssl_port
1267                do_wolfssl_client
1268                port=$wolfssl_port
1269                do_openssl_client
1270            fi
1271            # PSK
1272            if [ "$wolf_psk" != "" ] && [ "$wolfSuite" = "TLS13-AES128-GCM-SHA256" ] && [ "$wolf_ecc" != "" ] && [ "$openssl_nodhe" != "" ]
1273            then
1274                cert=""
1275                key=""
1276                caCert=""
1277
1278                wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
1279                port=$tls13_psk_openssl_port
1280                psk="-s --openssl-psk"
1281                # OpenSSL doesn't support DH for key exchange so do no PSK
1282                # DHE when ECC not supported
1283                if [ "$wolf_ecc" = "" ]
1284                then
1285                    adh="-K"
1286                fi
1287                do_wolfssl_client
1288                psk=""
1289                adh=""
1290                openssl_psk="-psk 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
1291                open_temp_cases_total=$((open_temp_cases_total + 1))
1292                port=$wolfssl_port
1293                do_openssl_client
1294                open_temp_cases_total=$((open_temp_cases_total + 1))
1295                port=$tls13_psk_wolfssl_port
1296                do_openssl_client
1297                openssl_psk=""
1298            fi
1299            # ECDSA
1300            if [ "$ecdsa_openssl_pid" != "$no_pid" ] && [ "$wolf_ecc" != "" ]
1301            then
1302                cert="${CERT_DIR}/client-ecc-cert.pem"
1303                key="${CERT_DIR}/ecc-client-key.pem"
1304                caCert="${CERT_DIR}/ca-ecc-cert.pem"
1305
1306                wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
1307                port=$ecdsa_openssl_port
1308                caCert="${CERT_DIR}/ca-ecc-cert.pem"
1309                do_wolfssl_client
1310                open_temp_cases_total=$((open_temp_cases_total + 1))
1311                port=$ecdsa_wolfssl_port
1312                caCert="${CERT_DIR}/ca-ecc-cert.pem"
1313                do_openssl_client
1314            fi
1315            # Ed25519
1316            if [ $ed25519_openssl_pid != $no_pid ]
1317            then
1318                cert="${CERT_DIR}/ed25519/client-ed25519.pem"
1319                key="${CERT_DIR}/ed25519/client-ed25519-priv.pem"
1320                caCert="${CERT_DIR}/ed25519/server-ed25519.pem"
1321
1322                wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
1323                port=$ed25519_openssl_port
1324                crl="-C"
1325                do_wolfssl_client
1326                open_temp_cases_total=$((open_temp_cases_total + 1))
1327                port=$ed25519_wolfssl_port
1328                do_openssl_client
1329            fi
1330            # Ed448
1331            if [ $ed448_openssl_pid != $no_pid ]
1332            then
1333                cert="${CERT_DIR}/ed448/client-ed448.pem"
1334                key="${CERT_DIR}/ed448/client-ed448-priv.pem"
1335                caCert="${CERT_DIR}/ed448/server-ed448.pem"
1336
1337                wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
1338                port=$ed448_openssl_port
1339                crl="-C"
1340                do_wolfssl_client
1341                open_temp_cases_total=$((open_temp_cases_total + 1))
1342                port=$ed448_wolfssl_port
1343                do_openssl_client
1344            fi
1345            tls13_cipher=
1346            ;;
1347        *)
1348            cert="${CERT_DIR}/client-cert.pem"
1349            key="${CERT_DIR}/client-key.pem"
1350            caCert="${CERT_DIR}/ca-cert.pem"
1351
1352            port=$openssl_port
1353            do_wolfssl_client
1354            port=$wolfssl_port
1355            do_openssl_client
1356            ;;
1357        esac
1358    done
1359    wolf_cases_tested=$((wolf_temp_cases_tested+wolf_cases_tested))
1360    wolf_cases_total=$((wolf_temp_cases_total+wolf_cases_total))
1361    echo -e "wolfSSL cases tested with version:$version  $wolf_temp_cases_tested"
1362    open_cases_tested=$((open_temp_cases_tested+open_cases_tested))
1363    open_cases_total=$((open_temp_cases_total+open_cases_total))
1364    echo -e "OpenSSL cases tested with version:$version  $open_temp_cases_tested"
1365    version_name
1366    testing_summary="$testing_summary$versionName\tYes\t$wolf_temp_cases_total\t$wolf_temp_cases_tested\t$open_temp_cases_total\t$open_temp_cases_tested\n"
1367    wolf_temp_cases_total=0
1368    wolf_temp_cases_tested=0
1369    open_temp_cases_total=0
1370    open_temp_cases_tested=0
1371    wolfdowngrade="$version"
1372done
1373IFS="$OIFS" #restore separator
1374
1375# Skip RSA-PSS interop test when RSA-PSS is not supported
1376if [ "$wolf_rsapss" != "" ] && [ "$ecdhe_avail" = "yes" ] && [ "$wolf_rsa" = "yes" ]
1377then
1378    # Test for RSA-PSS certs interop
1379    # Was running into alert sent by openssl server with version 1.1.1 released
1380    # in Sep 2018. To avoid this issue check that openssl version 3.0.0 or later
1381    # is used.
1382
1383    $OPENSSL version | awk '{print $2}' | \
1384        awk -F. '{if ($1 >= 3) exit 1; else exit 0;}'
1385    RESULT=$?
1386    if [ "$RESULT" = "0" ]; then
1387        echo -e "Old version of openssl detected, skipping interop RSA-PSS test"
1388    else
1389        echo -e "Doing interop RSA-PSS test"
1390
1391        key_file=${CERT_DIR}/rsapss/server-rsapss-priv.pem
1392        cert_file=${CERT_DIR}/rsapss/server-rsapss.pem
1393        ca_file=${CERT_DIR}/client-cert.pem
1394        openssl_suite="RSAPSS"
1395        start_openssl_server
1396
1397        cert="${CERT_DIR}/client-cert.pem"
1398        key="${CERT_DIR}/client-key.pem"
1399        caCert="${CERT_DIR}/rsapss/ca-rsapss.pem"
1400        crl="-C"
1401        wolfSuite="ALL"
1402        wolfssl_no_resume="yes"
1403        port=$server_port
1404
1405        if [ "$wolf_tls13" != "" ]
1406        then
1407            version="4"
1408            do_wolfssl_client
1409        fi
1410
1411        if [ "$wolf_tls" != "" ]
1412        then
1413            version="3"
1414            do_wolfssl_client
1415        fi
1416    fi
1417fi
1418do_cleanup
1419
1420echo -e "wolfSSL total cases   $wolf_cases_total"
1421echo -e "wolfSSL cases tested  $wolf_cases_tested"
1422echo -e "OpenSSL total cases   $open_cases_total"
1423echo -e "OpenSSL cases tested  $open_cases_tested"
1424echo -e "\nSuccess!\n\n\n\n"
1425echo -e "$testing_summary"
1426exit 0