luna - wolfssl/tests/suites.c

   1/* suites.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22
  23#include <tests/unit.h>
  24
  25#ifdef NO_INLINE
  26    #include <wolfssl/wolfcrypt/misc.h>
  27#else
  28    #define WOLFSSL_MISC_INCLUDED
  29    #include <wolfcrypt/src/misc.c>
  30#endif
  31
  32#include <stdlib.h>
  33#include <stdio.h>
  34#include <string.h>
  35#include <wolfssl/ssl.h>
  36
  37#if defined(HAVE_ECC) && defined(FP_ECC) && defined(HAVE_THREAD_LS) \
  38                      && (defined(NO_MAIN_DRIVER) || defined(HAVE_STACK_SIZE))
  39#include <wolfssl/wolfcrypt/ecc.h>
  40#endif
  41
  42#include <wolfssl/wolfcrypt/memory.h> /* for LARGEST_MEM_BUCKET */
  43
  44#define MAX_ARGS 40
  45#define MAX_COMMAND_SZ 240
  46#ifdef WOLFSSL_TLS13
  47    #define MAX_SUITE_SZ 200
  48#else
  49    #define MAX_SUITE_SZ 80
  50#endif
  51#define NOT_BUILT_IN (-123)
  52#if defined(NO_OLD_TLS) || !defined(WOLFSSL_ALLOW_SSLV3) || \
  53    !defined(WOLFSSL_ALLOW_TLSV10)
  54    #define VERSION_TOO_OLD (-124)
  55#endif
  56
  57#include "examples/client/client.h"
  58#include "examples/server/server.h"
  59
  60#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \
  61    !defined(NO_TLS) && !defined(SINGLE_THREADED)
  62static WOLFSSL_CTX* cipherSuiteCtx = NULL;
  63static char nonblockFlag[] = "-N";
  64static char noVerifyFlag[] = "-d";
  65static char disableEMSFlag[] = "-n";
  66static char flagSep[] = " ";
  67#if !defined(USE_WINDOWS_API) && !defined(WOLFSSL_TIRTOS)
  68    static char portFlag[] = "-p";
  69    static char svrPort[] = "0";
  70#endif
  71static char intTestFlag[] = "-H";
  72static char forceDefCipherListFlag[] = "defCipherList";
  73static char exitWithRetFlag[] = "exitWithRet";
  74static char disableDHPrimeTest[] = "-2";
  75
  76#ifdef WOLFSSL_ASYNC_CRYPT
  77    static int devId = INVALID_DEVID;
  78#endif
  79
  80
  81#ifdef VERSION_TOO_OLD
  82static int GetTlsVersion(const char* line)
  83{
  84    int version = -1;
  85    const char* find = "-v ";
  86    const char* begin = strstr(line, find);
  87
  88    if (begin) {
  89        begin += 3;
  90        if (*begin == 'd' || *begin == 'e')
  91            begin += 2;
  92
  93        version = atoi(begin);
  94    }
  95    return version;
  96}
  97
  98#ifndef WOLFSSL_ALLOW_SSLV3
  99/* if the protocol version is sslv3 return 1, else 0 */
 100static int IsSslVersion(const char* line)
 101{
 102    int version = GetTlsVersion(line);
 103    return (version == 0) ? 1 : 0;
 104}
 105#endif /* !WOLFSSL_ALLOW_SSLV3 */
 106
 107#ifndef WOLFSSL_ALLOW_TLSV10
 108/* if the protocol version is TLSv1.0 return 1, else 0 */
 109static int IsTls10Version(const char* line)
 110{
 111    int version = GetTlsVersion(line);
 112    return (version == 1) ? 1 : 0;
 113}
 114#endif /* !WOLFSSL_ALLOW_TLSV10 */
 115
 116#ifdef NO_OLD_TLS
 117/* if the protocol version is less than tls 1.2 return 1, else 0 */
 118static int IsOldTlsVersion(const char* line)
 119{
 120    int version = GetTlsVersion(line);
 121    return (version < 3) ? 1 : 0;
 122}
 123#endif /* NO_OLD_TLS */
 124#endif /* VERSION_TOO_OLD */
 125
 126
 127/* if the cipher suite on line is valid store in suite and return 1, else 0 */
 128static int IsValidCipherSuite(const char* line, char *suite, size_t suite_spc)
 129{
 130    int  found = 0;
 131    int  valid = 0;
 132
 133    const char* find = "-l ";
 134    const char* begin = strstr(line, find);
 135    const char* end;
 136
 137    if (suite_spc < MAX_SUITE_SZ+1)
 138        return 0;
 139
 140    suite[0] = '\0';
 141
 142    if (begin) {
 143        begin += 3;
 144
 145        end = XSTRSTR(begin, " ");
 146
 147        if (end) {
 148            long len = end - begin;
 149            if (len > MAX_SUITE_SZ) {
 150                printf("suite too long!\n");
 151                return 0;
 152            }
 153            XMEMCPY(suite, begin, (size_t) len);
 154            suite[len] = '\0';
 155        }
 156        else
 157            XSTRNCPY(suite, begin, MAX_SUITE_SZ);
 158
 159        suite[MAX_SUITE_SZ] = '\0';
 160        found = 1;
 161    }
 162
 163    if (found) {
 164        if (wolfSSL_CTX_set_cipher_list(cipherSuiteCtx, suite) == WOLFSSL_SUCCESS)
 165            valid = 1;
 166    }
 167
 168    return valid;
 169}
 170
 171#if defined(WOLFSSL_HAVE_MLKEM)
 172
 173#define MATCH_PQC(b, s, l) ((l) == sizeof(s) - 1 && \
 174    XSTRNCMP((b), (s), sizeof(s) - 1) == 0)
 175
 176static int IsKyberLevelAvailable(const char* line)
 177{
 178    int available = 0;
 179    const char* begin = XSTRSTR(line, "--pqc");
 180    size_t len = 0;
 181
 182    if (begin != NULL) {
 183        begin += XSTRLEN("--pqc");
 184        while (*begin == ' ' || *begin == '\t') {
 185            begin++;
 186        }
 187
 188        if (*begin != '\0') {
 189            const char* end = begin;
 190            while (*end != '\0' && *end != ' ' && *end != '\t') {
 191                end++;
 192            }
 193            len = (size_t)(end - begin);
 194        }
 195    }
 196
 197    if (begin != NULL && len > 0) {
 198#ifndef WOLFSSL_NO_ML_KEM
 199    #ifndef WOLFSSL_TLS_NO_MLKEM_STANDALONE
 200        #ifndef WOLFSSL_NO_ML_KEM_512
 201            if (MATCH_PQC(begin, "ML_KEM_512", len)) {
 202                available = 1;
 203            }
 204        #endif
 205        #ifndef WOLFSSL_NO_ML_KEM_768
 206            if (MATCH_PQC(begin, "ML_KEM_768", len)) {
 207                available = 1;
 208            }
 209        #endif
 210        #ifndef WOLFSSL_NO_ML_KEM_1024
 211            if (MATCH_PQC(begin, "ML_KEM_1024", len)) {
 212                available = 1;
 213            }
 214        #endif
 215    #endif /* WOLFSSL_TLS_NO_MLKEM_STANDALONE */
 216    #ifdef WOLFSSL_PQC_HYBRIDS
 217        #if !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_ECC)
 218            if (MATCH_PQC(begin, "SecP256r1MLKEM768", len)) {
 219                available = 1;
 220            }
 221        #endif
 222        #if !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_CURVE25519)
 223            if (MATCH_PQC(begin, "X25519MLKEM768", len)) {
 224                available = 1;
 225            }
 226        #endif
 227        #if !defined(WOLFSSL_NO_ML_KEM_1024) && defined(HAVE_ECC)
 228            if (MATCH_PQC(begin, "SecP384r1MLKEM1024", len)) {
 229                available = 1;
 230            }
 231        #endif
 232    #endif /* WOLFSSL_PQC_HYBRIDS */
 233    #ifdef WOLFSSL_EXTRA_PQC_HYBRIDS
 234        #if !defined(WOLFSSL_NO_ML_KEM_512) && defined(HAVE_ECC)
 235            if (MATCH_PQC(begin, "SecP256r1MLKEM512", len)) {
 236                available = 1;
 237            }
 238        #ifdef WOLFSSL_ML_KEM_USE_OLD_IDS
 239            if (MATCH_PQC(begin, "P256_ML_KEM_512_OLD", len)) {
 240                available = 1;
 241            }
 242        #endif
 243        #endif
 244        #if !defined(WOLFSSL_NO_ML_KEM_512) && defined(HAVE_CURVE25519)
 245            if (MATCH_PQC(begin, "X25519MLKEM512", len)) {
 246                available = 1;
 247            }
 248        #endif
 249        #if !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_ECC)
 250            if (MATCH_PQC(begin, "SecP384r1MLKEM768", len)) {
 251                available = 1;
 252            }
 253        #ifdef WOLFSSL_ML_KEM_USE_OLD_IDS
 254            if (MATCH_PQC(begin, "P384_ML_KEM_768_OLD", len)) {
 255                available = 1;
 256            }
 257        #endif
 258        #endif
 259        #if !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_CURVE448)
 260            if (MATCH_PQC(begin, "X448MLKEM768", len)) {
 261                available = 1;
 262            }
 263        #endif
 264        #if !defined(WOLFSSL_NO_ML_KEM_1024) && defined(HAVE_ECC)
 265            if (MATCH_PQC(begin, "SecP521r1MLKEM1024", len)) {
 266                available = 1;
 267            }
 268        #ifdef WOLFSSL_ML_KEM_USE_OLD_IDS
 269            if (MATCH_PQC(begin, "P521_ML_KEM_1024_OLD", len)) {
 270                available = 1;
 271            }
 272        #endif
 273        #endif
 274    #endif /* WOLFSSL_EXTRA_PQC_HYBRIDS */
 275#endif /* !WOLFSSL_NO_ML_KEM */
 276
 277#ifdef WOLFSSL_MLKEM_KYBER
 278        #ifndef WOLFSSL_NO_KYBER512
 279            if (MATCH_PQC(begin, "KYBER_LEVEL1", len)) {
 280                available = 1;
 281            }
 282        #ifdef HAVE_ECC
 283            if (MATCH_PQC(begin, "P256_KYBER_LEVEL1", len)) {
 284                available = 1;
 285            }
 286        #endif
 287        #endif
 288        #ifndef WOLFSSL_NO_KYBER768
 289            if (MATCH_PQC(begin, "KYBER_LEVEL3", len)) {
 290                available = 1;
 291            }
 292        #ifdef HAVE_ECC
 293            if (MATCH_PQC(begin, "P384_KYBER_LEVEL3", len)) {
 294                available = 1;
 295            }
 296            if (MATCH_PQC(begin, "P256_KYBER_LEVEL3", len)) {
 297                available = 1;
 298            }
 299        #endif
 300        #endif
 301        #ifndef WOLFSSL_NO_KYBER1024
 302            if (MATCH_PQC(begin, "KYBER_LEVEL5", len)) {
 303                available = 1;
 304            }
 305        #ifdef HAVE_ECC
 306            if (MATCH_PQC(begin, "P521_KYBER_LEVEL5", len)) {
 307                available = 1;
 308            }
 309        #endif
 310        #endif
 311        #if !defined(WOLFSSL_NO_KYBER512) && defined(HAVE_CURVE25519)
 312            if (MATCH_PQC(begin, "X25519_KYBER_LEVEL1", len)) {
 313                available = 1;
 314            }
 315        #endif
 316        #if !defined(WOLFSSL_NO_KYBER768) && defined(HAVE_CURVE25519)
 317            if (MATCH_PQC(begin, "X25519_KYBER_LEVEL3", len)) {
 318                available = 1;
 319            }
 320        #endif
 321        #if !defined(WOLFSSL_NO_KYBER768) && defined(HAVE_CURVE448)
 322            if (MATCH_PQC(begin, "X448_KYBER_LEVEL3", len)) {
 323                available = 1;
 324            }
 325        #endif
 326#endif /* WOLFSSL_MLKEM_KYBER */
 327    }
 328
 329#if defined(WOLFSSL_MLKEM_NO_MAKE_KEY) || \
 330    defined(WOLFSSL_MLKEM_NO_ENCAPSULATE) || \
 331    defined(WOLFSSL_MLKEM_NO_DECAPSULATE)
 332    (void)available;
 333    return begin == NULL;
 334#else
 335    return (begin == NULL) || available;
 336#endif
 337}
 338#endif
 339
 340static int IsValidCert(const char* line)
 341{
 342    int ret = 1;
 343#if !defined(NO_FILESYSTEM) && !defined(NO_CERTS)
 344    WOLFSSL_CTX* ctx;
 345    size_t i;
 346    const char* begin;
 347    char cert[80];
 348#ifdef WOLFSSL_STATIC_MEMORY
 349    FILE* fStream = NULL;
 350    long chkSz = 0;
 351#endif
 352
 353    begin = XSTRSTR(line, "-c ");
 354    if (begin == NULL)
 355        return 1;
 356
 357    begin += 3;
 358    for (i = 0; i < sizeof(cert) - 1 && *begin != ' ' && *begin != '\0'; i++)
 359        cert[i] = *(begin++);
 360    cert[i] = '\0';
 361#ifdef WOLFSSL_STATIC_MEMORY
 362    fStream = XFOPEN(cert, "rb");
 363    if (fStream == NULL) {
 364        printf("Failed to open file %s\n", cert);
 365        printf("Invalid cert, skipping test\n");
 366        return 0;
 367    } else {
 368        printf("Successfully opened file\n");
 369    }
 370
 371    XFSEEK(fStream, 0L, SEEK_END);
 372    chkSz = XFTELL(fStream);
 373    XFCLOSE(fStream);
 374    if (chkSz > LARGEST_MEM_BUCKET) {
 375        printf("File is larger than largest bucket, skipping this test\n");
 376        return 0;
 377    }
 378#endif
 379
 380    ctx = wolfSSL_CTX_new(wolfSSLv23_server_method_ex(NULL));
 381    if (ctx == NULL)
 382        return 0;
 383    ret = wolfSSL_CTX_use_certificate_chain_file(ctx, cert) == WOLFSSL_SUCCESS;
 384    wolfSSL_CTX_free(ctx);
 385#endif /* !NO_FILESYSTEM && !NO_CERTS */
 386
 387    (void)line;
 388
 389    return ret;
 390}
 391
 392static int IsValidCA(const char* line)
 393{
 394    int ret = 1;
 395#if !defined(NO_FILESYSTEM) && !defined(NO_CERTS)
 396    WOLFSSL_CTX* ctx;
 397    size_t i;
 398    const char* begin;
 399    char cert[80];
 400
 401    begin = XSTRSTR(line, "-A ");
 402    if (begin == NULL)
 403        return 1;
 404
 405    begin += 3;
 406    for (i = 0; i < sizeof(cert) - 1 && *begin != ' ' && *begin != '\0'; i++)
 407        cert[i] = *(begin++);
 408    cert[i] = '\0';
 409
 410    ctx = wolfSSL_CTX_new(wolfSSLv23_server_method_ex(NULL));
 411    if (ctx == NULL)
 412        return 0;
 413    ret = wolfSSL_CTX_use_certificate_chain_file(ctx, cert) == WOLFSSL_SUCCESS;
 414    wolfSSL_CTX_free(ctx);
 415#endif /* !NO_FILESYSTEM && !NO_CERTS */
 416
 417    (void)line;
 418
 419    return ret;
 420}
 421
 422#ifdef WOLFSSL_NO_CLIENT_AUTH
 423static int IsClientAuth(const char* line, int* reqClientCert)
 424{
 425    const char* begin;
 426
 427    begin = XSTRSTR(line, "-H verifyFail");
 428    if (begin != NULL) {
 429        return 1;
 430    }
 431
 432    begin = XSTRSTR(line, "-d");
 433    if (begin != NULL) {
 434        *reqClientCert = 0;
 435    }
 436    else {
 437        *reqClientCert = 1;
 438    }
 439
 440    return 0;
 441}
 442#endif
 443
 444#ifdef NO_CERTS
 445static int IsUsingCert(const char* line)
 446{
 447    return XSTRSTR(line, "-c ") != NULL;
 448}
 449#endif
 450
 451#if defined(NO_CERTS) || defined(WOLFSSL_NO_CLIENT_AUTH)
 452static int IsNoClientCert(const char* line)
 453{
 454    const char* begin;
 455
 456    begin = XSTRSTR(line, "-x");
 457    if (begin != NULL) {
 458        return 1;
 459    }
 460
 461    return 0;
 462}
 463#endif
 464
 465#if (defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)) && \
 466    !defined(NO_RSA) && !defined(NO_CERTS) && !defined(WOLFSSL_NO_CLIENT_AUTH)
 467static int IsEcdsaCipherSuiteDefRsaCert(const char* line)
 468{
 469    int found;
 470
 471    found  = (strstr(line, "-ECDSA-") != NULL);
 472    found &= (strstr(line, "-c ") == NULL);
 473    found &= (strstr(line, "-x") == NULL);
 474
 475    return found;
 476}
 477#endif
 478
 479static int execute_test_case(int svr_argc, char** svr_argv,
 480                             int cli_argc, char** cli_argv,
 481                             int addNoVerify, int addNonBlocking,
 482                             int addDisableEMS, int forceSrvDefCipherList,
 483                             int forceCliDefCipherList)
 484{
 485#if defined(WOLFSSL_TIRTOS) || defined(WOLFSSL_SRTP)
 486    func_args cliArgs = {0, NULL, 0, NULL, NULL, NULL};
 487    func_args svrArgs = {0, NULL, 0, NULL, NULL, NULL};
 488#else
 489    func_args cliArgs = {0, NULL, 0, NULL, NULL};
 490    func_args svrArgs = {0, NULL, 0, NULL, NULL};
 491#endif
 492
 493    tcp_ready   ready;
 494    THREAD_TYPE serverThread;
 495    char        commandLine[MAX_COMMAND_SZ];
 496    char        cipherSuite[MAX_SUITE_SZ+1];
 497    int         i;
 498    size_t      added;
 499    static      int tests = 1;
 500#if !defined(USE_WINDOWS_API) && !defined(WOLFSSL_TIRTOS)
 501    static char portNumber[8];
 502#endif
 503    int         cliTestShouldFail = 0, svrTestShouldFail = 0;
 504#ifdef WOLFSSL_NO_CLIENT_AUTH
 505    int         reqClientCert;
 506#endif
 507#if defined(WOLFSSL_SRTP) && defined(WOLFSSL_COND)
 508    srtp_test_helper srtp_helper;
 509#endif
 510
 511    cliArgs.argc = cli_argc;
 512    cliArgs.argv = cli_argv;
 513    svrArgs.argc = svr_argc;
 514    svrArgs.argv = svr_argv;
 515
 516    /* Is Valid Cipher and Version Checks */
 517    /* build command list for the Is checks below */
 518    commandLine[0] = '\0';
 519    added = 0;
 520    for (i = 0; i < svrArgs.argc; i++) {
 521        added += XSTRLEN(svr_argv[i]) + 2;
 522        if (added >= MAX_COMMAND_SZ) {
 523            printf("server command line too long\n");
 524            break;
 525        }
 526        XSTRLCAT(commandLine, svr_argv[i], sizeof commandLine);
 527        XSTRLCAT(commandLine, flagSep, sizeof commandLine);
 528    }
 529    if (IsValidCipherSuite(commandLine, cipherSuite, sizeof cipherSuite) == 0) {
 530        #ifdef DEBUG_SUITE_TESTS
 531            printf("cipher suite %s not supported in build\n", cipherSuite);
 532        #endif
 533        return NOT_BUILT_IN;
 534    }
 535#ifdef WOLFSSL_HAVE_MLKEM
 536    if (!IsKyberLevelAvailable(commandLine)) {
 537        #ifdef DEBUG_SUITE_TESTS
 538            printf("Kyber level not supported in build: %s\n", commandLine);
 539        #endif
 540        return NOT_BUILT_IN;
 541    }
 542#endif
 543    if (!IsValidCert(commandLine)) {
 544        #ifdef DEBUG_SUITE_TESTS
 545            printf("certificate %s not supported in build\n", commandLine);
 546        #endif
 547        return NOT_BUILT_IN;
 548    }
 549
 550#ifndef WOLFSSL_ALLOW_SSLV3
 551    if (IsSslVersion(commandLine) == 1) {
 552        #ifdef DEBUG_SUITE_TESTS
 553            printf("protocol version on line %s is too old\n", commandLine);
 554        #endif
 555        return VERSION_TOO_OLD;
 556    }
 557#endif
 558#ifndef WOLFSSL_ALLOW_TLSV10
 559    if (IsTls10Version(commandLine) == 1) {
 560        #ifdef DEBUG_SUITE_TESTS
 561            printf("protocol version on line %s is too old\n", commandLine);
 562        #endif
 563        return VERSION_TOO_OLD;
 564    }
 565#endif
 566#ifdef NO_OLD_TLS
 567    if (IsOldTlsVersion(commandLine) == 1) {
 568        #ifdef DEBUG_SUITE_TESTS
 569            printf("protocol version on line %s is too old\n", commandLine);
 570        #endif
 571        return VERSION_TOO_OLD;
 572    }
 573#endif
 574#ifdef WOLFSSL_NO_CLIENT_AUTH
 575    if (IsClientAuth(commandLine, &reqClientCert)) {
 576        #ifdef DEBUG_SUITE_TESTS
 577            printf("client auth on line %s not supported in build\n",
 578                   commandLine);
 579        #endif
 580        return NOT_BUILT_IN;
 581    }
 582#endif
 583#ifdef NO_CERTS
 584    if (IsUsingCert(commandLine)) {
 585        #ifdef DEBUG_SUITE_TESTS
 586            printf("certificate %s not supported in build\n", commandLine);
 587        #endif
 588        return NOT_BUILT_IN;
 589    }
 590#endif
 591
 592    /* Build Server Command */
 593    if (addNoVerify) {
 594        printf("repeating test with client cert request off\n");
 595        if (svrArgs.argc >= MAX_ARGS)
 596            printf("server command line too long\n");
 597        else
 598            svr_argv[svrArgs.argc++] = noVerifyFlag;
 599    }
 600    if (addNonBlocking) {
 601        printf("repeating test with non blocking on\n");
 602        if (svrArgs.argc >= MAX_ARGS)
 603            printf("server command line too long\n");
 604        else
 605            svr_argv[svrArgs.argc++] = nonblockFlag;
 606    }
 607    #if !defined(USE_WINDOWS_API) && !defined(WOLFSSL_TIRTOS)
 608        /* add port */
 609        if (svrArgs.argc + 2 > MAX_ARGS)
 610            printf("cannot add the magic port number flag to server\n");
 611        else {
 612            svr_argv[svrArgs.argc++] = portFlag;
 613            svr_argv[svrArgs.argc++] = svrPort;
 614        }
 615    #endif
 616    if (forceSrvDefCipherList) {
 617        if (svrArgs.argc + 2 > MAX_ARGS)
 618            printf("cannot add the force def cipher list flag to server\n");
 619        else {
 620            svr_argv[svrArgs.argc++] = intTestFlag;
 621            svr_argv[svrArgs.argc++] = forceDefCipherListFlag;
 622        }
 623    }
 624#ifdef TEST_PK_PRIVKEY
 625    svr_argv[svrArgs.argc++] = (char*)"-P";
 626#endif
 627
 628
 629    /* update server flags list */
 630    commandLine[0] = '\0';
 631    added = 0;
 632    for (i = 0; i < svrArgs.argc; i++) {
 633        added += XSTRLEN(svr_argv[i]) + 2;
 634        if (added >= MAX_COMMAND_SZ) {
 635            printf("server command line too long\n");
 636            break;
 637        }
 638        XSTRLCAT(commandLine, svr_argv[i], sizeof commandLine);
 639        XSTRLCAT(commandLine, flagSep, sizeof commandLine);
 640    }
 641    printf("trying server command line[%d]: %s\n", tests, commandLine);
 642
 643    tests++; /* test count */
 644
 645    /* determine based on args if this test is expected to fail */
 646    if (XSTRSTR(commandLine, exitWithRetFlag) != NULL) {
 647        svrTestShouldFail = 1;
 648    }
 649
 650
 651    commandLine[0] = '\0';
 652    added = 0;
 653    for (i = 0; i < cliArgs.argc; i++) {
 654        added += XSTRLEN(cli_argv[i]) + 2;
 655        if (added >= MAX_COMMAND_SZ) {
 656            printf("client command line too long\n");
 657            break;
 658        }
 659        XSTRLCAT(commandLine, cli_argv[i], sizeof commandLine);
 660        XSTRLCAT(commandLine, flagSep, sizeof commandLine);
 661    }
 662    if (!IsValidCA(commandLine)) {
 663        #ifdef DEBUG_SUITE_TESTS
 664            printf("certificate %s not supported in build\n", commandLine);
 665        #endif
 666        return NOT_BUILT_IN;
 667    }
 668#ifdef WOLFSSL_NO_CLIENT_AUTH
 669    if (reqClientCert && IsNoClientCert(commandLine)) {
 670        #ifdef DEBUG_SUITE_TESTS
 671            printf("client auth on line %s not supported in build\n",
 672                   commandLine);
 673        #endif
 674        return NOT_BUILT_IN;
 675    }
 676#else
 677    if (!IsValidCert(commandLine)) {
 678        #ifdef DEBUG_SUITE_TESTS
 679            printf("certificate %s not supported in build\n", commandLine);
 680        #endif
 681        return NOT_BUILT_IN;
 682    }
 683#endif
 684#ifdef NO_CERTS
 685    if (IsNoClientCert(commandLine)) {
 686        #ifdef DEBUG_SUITE_TESTS
 687            printf("certificate %s not supported in build\n", commandLine);
 688        #endif
 689        return NOT_BUILT_IN;
 690    }
 691#endif
 692#if (defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)) && \
 693    !defined(NO_RSA) && !defined(NO_CERTS) && !defined(WOLFSSL_NO_CLIENT_AUTH)
 694    if (IsEcdsaCipherSuiteDefRsaCert(commandLine)) {
 695        return NOT_BUILT_IN;
 696    }
 697#endif
 698
 699
 700    InitTcpReady(&ready);
 701
 702#if defined(WOLFSSL_SRTP) && defined(WOLFSSL_COND)
 703    srtp_helper_init(&srtp_helper);
 704    cliArgs.srtp_helper = &srtp_helper;
 705    svrArgs.srtp_helper = &srtp_helper;
 706#endif
 707
 708#ifdef WOLFSSL_TIRTOS
 709    fdOpenSession(Task_self());
 710#endif
 711
 712    /* start server */
 713    svrArgs.signal = &ready;
 714    start_thread(server_test, &svrArgs, &serverThread);
 715    wait_tcp_ready(&svrArgs);
 716
 717
 718    /* Build Client Command */
 719    if (addNonBlocking) {
 720        if (cliArgs.argc >= MAX_ARGS)
 721            printf("cannot add the non block flag to client\n");
 722        else
 723            cli_argv[cliArgs.argc++] = nonblockFlag;
 724    }
 725    if (addDisableEMS) {
 726        printf("repeating test without extended master secret\n");
 727        if (cliArgs.argc >= MAX_ARGS)
 728            printf("cannot add the disable EMS flag to client\n");
 729        else
 730            cli_argv[cliArgs.argc++] = disableEMSFlag;
 731    }
 732#if !defined(USE_WINDOWS_API) && !defined(WOLFSSL_TIRTOS)
 733    if (ready.port != 0) {
 734        if (cliArgs.argc + 2 > MAX_ARGS)
 735            printf("cannot add the magic port number flag to client\n");
 736        else {
 737            (void)snprintf(portNumber, sizeof(portNumber), "%d",
 738                           (int)ready.port);
 739            cli_argv[cliArgs.argc++] = portFlag;
 740            cli_argv[cliArgs.argc++] = portNumber;
 741        }
 742    }
 743#endif
 744    if (forceCliDefCipherList) {
 745        if (cliArgs.argc + 2 > MAX_ARGS)
 746            printf("cannot add the force def cipher list flag to client\n");
 747        else {
 748            cli_argv[cliArgs.argc++] = intTestFlag;
 749            cli_argv[cliArgs.argc++] = forceDefCipherListFlag;
 750        }
 751    }
 752#ifdef TEST_PK_PRIVKEY
 753    cli_argv[cliArgs.argc++] = (char*)"-P";
 754#endif
 755
 756    commandLine[0] = '\0';
 757    added = 0;
 758    for (i = 0; i < cliArgs.argc; i++) {
 759        added += XSTRLEN(cli_argv[i]) + 2;
 760        if (added >= MAX_COMMAND_SZ) {
 761            printf("client command line too long\n");
 762            break;
 763        }
 764        XSTRLCAT(commandLine, cli_argv[i], sizeof commandLine);
 765        XSTRLCAT(commandLine, flagSep, sizeof commandLine);
 766    }
 767    printf("trying client command line[%d]: %s\n", tests, commandLine);
 768    tests++;
 769
 770    /* determine based on args if this test is expected to fail */
 771    if (XSTRSTR(commandLine, exitWithRetFlag) != NULL) {
 772        cliTestShouldFail = 1;
 773    }
 774
 775    /* start client */
 776    client_test(&cliArgs);
 777
 778    /* verify results */
 779    if ((cliArgs.return_code != 0 && cliTestShouldFail == 0) ||
 780        (cliArgs.return_code == 0 && cliTestShouldFail != 0)) {
 781        printf("client_test failed %d %s\n", cliArgs.return_code,
 782            cliTestShouldFail ? "(should fail)" : "");
 783        XEXIT(EXIT_FAILURE);
 784    }
 785
 786    join_thread(serverThread);
 787    if ((svrArgs.return_code != 0 && svrTestShouldFail == 0) ||
 788        (svrArgs.return_code == 0 && svrTestShouldFail != 0)) {
 789        printf("server_test failed %d %s\n", svrArgs.return_code,
 790            svrTestShouldFail ? "(should fail)" : "");
 791        XEXIT(EXIT_FAILURE);
 792    }
 793
 794#ifdef WOLFSSL_TIRTOS
 795    fdCloseSession(Task_self());
 796#endif
 797    FreeTcpReady(&ready);
 798
 799#if defined (WOLFSSL_SRTP) && defined(WOLFSSL_COND)
 800    srtp_helper_free(&srtp_helper);
 801#endif
 802
 803    /* only run the first test for expected failure cases */
 804    /* the example server/client are not designed to handle expected failure in
 805        all cases, such as non-blocking, etc... */
 806    if (svrTestShouldFail || cliTestShouldFail) {
 807        return NOT_BUILT_IN;
 808    }
 809
 810    return 0;
 811}
 812
 813static void test_harness(void* vargs)
 814{
 815    func_args* args = (func_args*)vargs;
 816    char* script;
 817    long  sz, len;
 818    int   cliMode = 0;   /* server or client command flag, server first */
 819    int   ret;
 820    FILE* file;
 821    char* svrArgs[MAX_ARGS];
 822    int   svrArgsSz;
 823    char* cliArgs[MAX_ARGS];
 824    int   cliArgsSz;
 825    char* cursor;
 826    char* comment;
 827    char  lastChar = '\0';
 828    int   do_it = 0;
 829    const char* fname = "tests/test.conf";
 830    const char* addArgs = NULL;
 831
 832    if (args->argc == 1) {
 833        printf("notice: using default file %s\n", fname);
 834    }
 835    else if (args->argc == 3) {
 836        addArgs = args->argv[2];
 837    }
 838    else if (args->argc > 3) {
 839        printf("usage: harness [FILE] [ARG]\n");
 840        args->return_code = 1;
 841        return;
 842    }
 843
 844    if (args->argc >= 2) {
 845        fname = args->argv[1];
 846    }
 847
 848    file = fopen(fname, "rb");
 849    if (file == NULL) {
 850        fprintf(stderr, "unable to open %s\n", fname);
 851        args->return_code = 1;
 852        return;
 853    }
 854    if (fseek(file, 0, SEEK_END) < 0) {
 855        fprintf(stderr, "error %d fseeking %s\n", errno, fname);
 856        fclose(file);
 857        args->return_code = 1;
 858        return;
 859    }
 860    sz = ftell(file);
 861    if (sz <= 0) {
 862        fprintf(stderr, "%s is empty\n", fname);
 863        fclose(file);
 864        args->return_code = 1;
 865        return;
 866    }
 867    if (fseek(file, 0, SEEK_SET) < 0) {
 868        fprintf(stderr, "error %d fseeking %s\n", errno, fname);
 869        fclose(file);
 870        args->return_code = 1;
 871        return;
 872    }
 873
 874    script = (char*)malloc((size_t)(sz+1));
 875    if (script == 0) {
 876        fprintf(stderr, "unable to allocate script buffer\n");
 877        fclose(file);
 878        args->return_code = 1;
 879        return;
 880    }
 881
 882    len = (long) fread(script, 1, (size_t)sz, file);
 883    if (len != sz) {
 884        fprintf(stderr, "read error\n");
 885        fclose(file);
 886        free(script);
 887        args->return_code = 1;
 888        return;
 889    }
 890
 891    fclose(file);
 892    script[sz] = 0;
 893
 894    cursor = script;
 895    svrArgsSz = 1;
 896    svrArgs[0] = args->argv[0];
 897    cliArgsSz = 1;
 898    cliArgs[0] = args->argv[0];
 899
 900    while (cursor && *cursor != 0) {
 901        switch (*cursor) {
 902            case '\n':
 903                /* A blank line triggers test case execution or switches
 904                   to client mode if we don't have the client command yet */
 905                if (lastChar != '\n' && (cliArgsSz > 1 || svrArgsSz > 1)) {
 906                    if (cliMode == 0)
 907                        cliMode = 1;  /* switch to client mode processing */
 908                    else
 909                        do_it = 1;    /* Do It, we have server and client */
 910                }
 911            #ifdef DEBUG_SUITE_TESTS
 912                else {
 913                    /* skip extra new-lines */
 914                    printf("skipping extra new line\n");
 915                }
 916            #endif
 917                lastChar = *cursor;
 918                cursor++;
 919                break;
 920            case '#':
 921                lastChar = *cursor;
 922                /* Ignore lines that start with a # */
 923                comment = XSTRSEP(&cursor, "\n");
 924            #ifdef DEBUG_SUITE_TESTS
 925                printf("%s\n", comment);
 926            #else
 927                (void)comment;
 928            #endif
 929                break;
 930            case '-':
 931            default:
 932                /* Parameters start with a -. They end in either a newline
 933                 * or a space. Capture until either, save in Args list. */
 934                lastChar = *cursor;
 935                if (cliMode)
 936                    cliArgs[cliArgsSz++] = XSTRSEP(&cursor, " \n");
 937                else
 938                    svrArgs[svrArgsSz++] = XSTRSEP(&cursor, " \n");
 939                if (cursor == NULL || *cursor == '\0') /* eof */
 940                    do_it = 1;
 941                break;
 942        }
 943
 944        if (svrArgsSz == MAX_ARGS || cliArgsSz == MAX_ARGS) {
 945            fprintf(stderr, "too many arguments, forcing test run\n");
 946            do_it = 1;
 947        }
 948
 949        if (do_it) {
 950            /* additional arguments processing */
 951            if (cliArgsSz+2 < MAX_ARGS && svrArgsSz+2 < MAX_ARGS) {
 952                if (addArgs == NULL || XSTRSTR(addArgs, "doDH") == NULL) {
 953                    /* The `-2` disable DH prime check is added to all tests by default */
 954                    cliArgs[cliArgsSz++] = disableDHPrimeTest;
 955                    svrArgs[svrArgsSz++] = disableDHPrimeTest;
 956                }
 957                if (addArgs && XSTRSTR(addArgs, "expFail")) {
 958                    /* Tests should expect to fail */
 959                    cliArgs[cliArgsSz++] = intTestFlag;
 960                    cliArgs[cliArgsSz++] = exitWithRetFlag;
 961                    svrArgs[svrArgsSz++] = intTestFlag;
 962                    svrArgs[svrArgsSz++] = exitWithRetFlag;
 963                }
 964            }
 965
 966            ret = execute_test_case(svrArgsSz, svrArgs,
 967                                    cliArgsSz, cliArgs, 0, 0, 0, 0, 0);
 968            /* don't repeat if not supported in build */
 969            if (ret == 0) {
 970                /* test with default cipher list on server side */
 971                execute_test_case(svrArgsSz, svrArgs,
 972                                  cliArgsSz, cliArgs, 0, 0, 0, 1, 0);
 973                /* test with default cipher list on client side */
 974                execute_test_case(svrArgsSz, svrArgs,
 975                                  cliArgsSz, cliArgs, 0, 0, 0, 0, 1);
 976
 977                execute_test_case(svrArgsSz, svrArgs,
 978                                  cliArgsSz, cliArgs, 0, 1, 0, 0, 0);
 979                execute_test_case(svrArgsSz, svrArgs,
 980                                  cliArgsSz, cliArgs, 1, 0, 0, 0, 0);
 981                execute_test_case(svrArgsSz, svrArgs,
 982                                  cliArgsSz, cliArgs, 1, 1, 0, 0, 0);
 983#ifdef HAVE_EXTENDED_MASTER
 984                execute_test_case(svrArgsSz, svrArgs,
 985                                  cliArgsSz, cliArgs, 0, 0, 1, 0, 0);
 986                execute_test_case(svrArgsSz, svrArgs,
 987                                  cliArgsSz, cliArgs, 0, 1, 1, 0, 0);
 988                execute_test_case(svrArgsSz, svrArgs,
 989                                  cliArgsSz, cliArgs, 1, 0, 1, 0, 0);
 990                execute_test_case(svrArgsSz, svrArgs,
 991                                  cliArgsSz, cliArgs, 1, 1, 1, 0, 0);
 992#endif
 993            }
 994            svrArgsSz = 1;
 995            cliArgsSz = 1;
 996            cliMode   = 0;
 997            do_it     = 0;
 998        }
 999    }
1000
1001    free(script);
1002    args->return_code = 0;
1003}
1004#endif /* !NO_WOLFSSL_SERVER && !NO_WOLFSSL_CLIENT */
1005
1006
1007int SuiteTest(int argc, char** argv)
1008{
1009#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \
1010    !defined(NO_TLS) && !defined(SINGLE_THREADED) && \
1011    (defined(WOLFSSL_SWDEV) || \
1012     (!defined(WOLF_CRYPTO_CB_ONLY_RSA) && !defined(WOLF_CRYPTO_CB_ONLY_ECC)))
1013    func_args args;
1014    char argv0[3][80];
1015    char* myArgv[3];
1016
1017#ifdef WOLFSSL_STATIC_MEMORY
1018    byte memory[320000];
1019#endif
1020
1021    printf(" Begin Cipher Suite Tests\n");
1022
1023    /* setup */
1024    myArgv[0] = argv0[0];
1025    myArgv[1] = argv0[1];
1026    myArgv[2] = argv0[2];
1027    args.argv = myArgv;
1028    XSTRLCPY(argv0[0], "SuiteTest", sizeof(argv0[0]));
1029
1030    cipherSuiteCtx = wolfSSL_CTX_new(wolfSSLv23_client_method());
1031    if (cipherSuiteCtx == NULL) {
1032        printf("can't get cipher suite ctx\n");
1033        args.return_code = EXIT_FAILURE;
1034        goto exit;
1035    }
1036
1037    /* load in static memory buffer if enabled */
1038#ifdef WOLFSSL_STATIC_MEMORY
1039    if (wolfSSL_CTX_load_static_memory(&cipherSuiteCtx, NULL,
1040                                                   memory, sizeof(memory), 0, 1)
1041            != WOLFSSL_SUCCESS) {
1042        printf("unable to load static memory and create ctx");
1043        args.return_code = EXIT_FAILURE;
1044        goto exit;
1045    }
1046#endif
1047
1048#ifdef WOLFSSL_ASYNC_CRYPT
1049    if (wolfAsync_DevOpen(&devId) < 0) {
1050        printf("Async device open failed");
1051        args.return_code = EXIT_FAILURE;
1052        goto exit;
1053    }
1054    wolfSSL_CTX_SetDevId(cipherSuiteCtx, devId);
1055#endif /* WOLFSSL_ASYNC_CRYPT */
1056
1057    /* support for custom command line tests */
1058    if (argc > 1) {
1059        /* Examples:
1060            ./tests/unit.test tests/test-altchains.conf
1061            ./tests/unit.test tests/test-fails.conf expFail
1062            ./tests/unit.test tests/test-dhprime.conf doDH
1063        */
1064        args.argc = argc;
1065        args.argv = argv;
1066        test_harness(&args);
1067        if (args.return_code != 0) {
1068            printf("error from script %d\n", args.return_code);
1069            args.return_code = EXIT_FAILURE;
1070        }
1071        goto exit;
1072    }
1073
1074    /* default case */
1075    args.argc = 1;
1076    printf("starting default cipher suite tests\n");
1077    test_harness(&args);
1078    if (args.return_code != 0) {
1079        printf("error from script %d\n", args.return_code);
1080        args.return_code = EXIT_FAILURE;
1081        goto exit;
1082    }
1083
1084    /* any extra cases will need another argument */
1085    args.argc = 2;
1086
1087#ifdef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
1088    /* SHA-2 cipher suites in old TLS versions */
1089    XSTRLCPY(argv0[1], "tests/test-sha2.conf", sizeof(argv0[1]));
1090    printf("starting SHA-2 cipher suite in old TLS versions tests\n");
1091    test_harness(&args);
1092    if (args.return_code != 0) {
1093        printf("error from script %d\n", args.return_code);
1094        args.return_code = EXIT_FAILURE;
1095        goto exit;
1096    }
1097#endif
1098
1099#ifdef WOLFSSL_TLS13
1100    /* add TLSv13 extra suites */
1101    XSTRLCPY(argv0[1], "tests/test-tls13.conf", sizeof(argv0[1]));
1102    printf("starting TLSv13 extra cipher suite tests\n");
1103    test_harness(&args);
1104    if (args.return_code != 0) {
1105        printf("error from script %d\n", args.return_code);
1106        args.return_code = EXIT_FAILURE;
1107        goto exit;
1108    }
1109    #ifdef HAVE_ECC
1110    /* add TLSv13 ECC extra suites */
1111    XSTRLCPY(argv0[1], "tests/test-tls13-ecc.conf", sizeof(argv0[1]));
1112    printf("starting TLSv13 ECC extra cipher suite tests\n");
1113    test_harness(&args);
1114    if (args.return_code != 0) {
1115        printf("error from script %d\n", args.return_code);
1116        args.return_code = EXIT_FAILURE;
1117        goto exit;
1118    }
1119    #endif
1120    #ifndef WOLFSSL_NO_TLS12
1121    /* add TLSv13 downgrade tests */
1122    XSTRLCPY(argv0[1], "tests/test-tls13-down.conf", sizeof(argv0[1]));
1123    printf("starting TLSv13 Downgrade extra tests\n");
1124    test_harness(&args);
1125    if (args.return_code != 0) {
1126        printf("error from script %d\n", args.return_code);
1127        args.return_code = EXIT_FAILURE;
1128        goto exit;
1129    }
1130    #endif
1131    #ifdef WOLFSSL_HAVE_MLKEM
1132    #ifndef WOLFSSL_TLS_NO_MLKEM_STANDALONE
1133    /* add TLSv13 pq standalone tests */
1134    XSTRLCPY(argv0[1], "tests/test-tls13-pq-standalone.conf", sizeof(argv0[1]));
1135    printf("starting TLSv13 post-quantum groups tests\n");
1136    test_harness(&args);
1137    if (args.return_code != 0) {
1138        printf("error from script %d\n", args.return_code);
1139        args.return_code = EXIT_FAILURE;
1140        goto exit;
1141    }
1142    #endif /* !WOLFSSL_TLS_NO_MLKEM_STANDALONE */
1143    #ifdef WOLFSSL_PQC_HYBRIDS
1144    /* add TLSv13 pq hybrid tests */
1145    XSTRLCPY(argv0[1], "tests/test-tls13-pq-hybrid.conf", sizeof(argv0[1]));
1146    printf("starting TLSv13 post-quantum groups tests\n");
1147    test_harness(&args);
1148    if (args.return_code != 0) {
1149        printf("error from script %d\n", args.return_code);
1150        args.return_code = EXIT_FAILURE;
1151        goto exit;
1152    }
1153    #endif /* WOLFSSL_PQC_HYBRIDS */
1154    #ifdef WOLFSSL_EXTRA_PQC_HYBRIDS
1155    /* add TLSv13 pq extra hybrid tests */
1156    XSTRLCPY(argv0[1], "tests/test-tls13-pq-hybrid-extra.conf", sizeof(argv0[1]));
1157    printf("starting TLSv13 post-quantum groups tests\n");
1158    test_harness(&args);
1159    if (args.return_code != 0) {
1160        printf("error from script %d\n", args.return_code);
1161        args.return_code = EXIT_FAILURE;
1162        goto exit;
1163    }
1164    #endif
1165    #endif
1166    #if defined(WOLFSSL_HAVE_MLKEM) && defined(WOLFSSL_DTLS13)
1167    #ifndef WOLFSSL_TLS_NO_MLKEM_STANDALONE
1168    /* add DTLSv13 pq standalone tests */
1169    XSTRLCPY(argv0[1], "tests/test-dtls13-pq-standalone.conf", sizeof(argv0[1]));
1170    printf("starting DTLSv13 post-quantum groups tests\n");
1171    test_harness(&args);
1172    if (args.return_code != 0) {
1173        printf("error from script %d\n", args.return_code);
1174        args.return_code = EXIT_FAILURE;
1175        goto exit;
1176    }
1177    #endif /* !WOLFSSL_TLS_NO_MLKEM_STANDALONE */
1178    #ifdef WOLFSSL_EXTRA_PQC_HYBRIDS
1179    /* add DTLSv13 pq extra hybrid tests */
1180    XSTRLCPY(argv0[1], "tests/test-dtls13-pq-hybrid-extra.conf", sizeof(argv0[1]));
1181    printf("starting DTLSv13 post-quantum 2 groups tests\n");
1182    test_harness(&args);
1183    if (args.return_code != 0) {
1184        printf("error from script %d\n", args.return_code);
1185        args.return_code = EXIT_FAILURE;
1186        goto exit;
1187    }
1188    #endif
1189    #ifdef WOLFSSL_DTLS_CH_FRAG
1190    #ifndef WOLFSSL_TLS_NO_MLKEM_STANDALONE
1191    /* add DTLSv13 pq standalone frag tests */
1192    XSTRLCPY(argv0[1], "tests/test-dtls13-pq-standalone-frag.conf", sizeof(argv0[1]));
1193    printf("starting DTLSv13 post-quantum groups tests with fragmentation\n");
1194    test_harness(&args);
1195    if (args.return_code != 0) {
1196        printf("error from script %d\n", args.return_code);
1197        args.return_code = EXIT_FAILURE;
1198        goto exit;
1199    }
1200    #endif /* !WOLFSSL_TLS_NO_MLKEM_STANDALONE */
1201    #ifdef WOLFSSL_PQC_HYBRIDS
1202    /* add DTLSv13 pq hybrid frag tests */
1203    XSTRLCPY(argv0[1], "tests/test-dtls13-pq-hybrid-frag.conf", sizeof(argv0[1]));
1204    printf("starting DTLSv13 post-quantum 2 groups tests with fragmentation\n");
1205    test_harness(&args);
1206    if (args.return_code != 0) {
1207        printf("error from script %d\n", args.return_code);
1208        args.return_code = EXIT_FAILURE;
1209        goto exit;
1210    }
1211    #endif /* WOLFSSL_PQC_HYBRIDS */
1212    #ifdef WOLFSSL_EXTRA_PQC_HYBRIDS
1213    /* add DTLSv13 pq extra hybrid frag tests */
1214    XSTRLCPY(argv0[1], "tests/test-dtls13-pq-hybrid-extra-frag.conf", sizeof(argv0[1]));
1215    printf("starting DTLSv13 post-quantum 2 groups tests with fragmentation\n");
1216    test_harness(&args);
1217    if (args.return_code != 0) {
1218        printf("error from script %d\n", args.return_code);
1219        args.return_code = EXIT_FAILURE;
1220        goto exit;
1221    }
1222    #endif
1223    #endif
1224    #endif
1225#endif
1226#if defined(WC_RSA_PSS) && (!defined(HAVE_FIPS) || \
1227     (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2))) && \
1228     (!defined(HAVE_SELFTEST) || (defined(HAVE_SELFTEST_VERSION) && \
1229                      (HAVE_SELFTEST_VERSION > 2)))
1230    /* add RSA-PSS certificate cipher suite tests */
1231    XSTRLCPY(argv0[1], "tests/test-rsapss.conf", sizeof(argv0[1]));
1232    printf("starting RSA-PSS extra cipher suite tests\n");
1233    test_harness(&args);
1234    if (args.return_code != 0) {
1235        printf("error from script %d\n", args.return_code);
1236        args.return_code = EXIT_FAILURE;
1237        goto exit;
1238    }
1239#endif
1240#if defined(HAVE_CURVE25519) && defined(HAVE_ED25519) && \
1241    defined(HAVE_ED25519_SIGN) && defined(HAVE_ED25519_VERIFY) && \
1242    defined(HAVE_ED25519_KEY_IMPORT) && defined(HAVE_ED25519_KEY_EXPORT)
1243    /* add ED25519 certificate cipher suite tests */
1244    XSTRLCPY(argv0[1], "tests/test-ed25519.conf", sizeof(argv0[1]));
1245    printf("starting ED25519 extra cipher suite tests\n");
1246    test_harness(&args);
1247    if (args.return_code != 0) {
1248        printf("error from script %d\n", args.return_code);
1249        args.return_code = EXIT_FAILURE;
1250        goto exit;
1251    }
1252#endif
1253#if defined(HAVE_CURVE448) && defined(HAVE_ED448) && \
1254    defined(HAVE_ED448_SIGN) && defined(HAVE_ED448_VERIFY) && \
1255    defined(HAVE_ED448_KEY_IMPORT) && defined(HAVE_ED448_KEY_EXPORT)
1256    /* add ED448 certificate cipher suite tests */
1257    XSTRLCPY(argv0[1], "tests/test-ed448.conf", sizeof(argv0[1]));
1258    printf("starting ED448 extra cipher suite tests\n");
1259    test_harness(&args);
1260    if (args.return_code != 0) {
1261        printf("error from script %d\n", args.return_code);
1262        args.return_code = EXIT_FAILURE;
1263        goto exit;
1264    }
1265#endif
1266#if defined(WOLFSSL_HAVE_SLHDSA) && defined(HAVE_DILITHIUM) && \
1267    defined(WOLFSSL_SLHDSA_PARAM_128S) && \
1268    defined(WOLFSSL_TLS13) && !defined(WOLFSSL_NO_ML_DSA_44)
1269    /* SLH-DSA-SHAKE-128s root + ML-DSA-44 entity cert tests (TLS 1.3) */
1270    XSTRLCPY(argv0[1], "tests/test-tls13-slhdsa-shake.conf",
1271             sizeof(argv0[1]));
1272    printf("starting TLSv13 SLH-DSA-SHAKE-128s root + ML-DSA-44 entity tests\n");
1273    test_harness(&args);
1274    if (args.return_code != 0) {
1275        printf("error from script %d\n", args.return_code);
1276        args.return_code = EXIT_FAILURE;
1277        goto exit;
1278    }
1279
1280    /* Negative: client trusting an unrelated CA must reject the
1281     * SLH-DSA-rooted server chain. */
1282    args.argc = 3;
1283    XSTRLCPY(argv0[1], "tests/test-tls13-slhdsa-fail.conf",
1284             sizeof(argv0[1]));
1285    XSTRLCPY(argv0[2], "expFail", sizeof(argv0[2]));
1286    printf("starting TLSv13 SLH-DSA wrong-CA tests that expect failure\n");
1287    test_harness(&args);
1288    if (args.return_code != 0) {
1289        printf("error from script %d\n", args.return_code);
1290        args.return_code = EXIT_FAILURE;
1291        goto exit;
1292    }
1293    XSTRLCPY(argv0[2], "", sizeof(argv0[2]));
1294    args.argc = 2;
1295#endif
1296#if defined(WOLFSSL_HAVE_SLHDSA) && defined(WOLFSSL_SLHDSA_SHA2) && \
1297    defined(WOLFSSL_SLHDSA_PARAM_SHA2_128S) && defined(HAVE_DILITHIUM) && \
1298    defined(WOLFSSL_TLS13) && !defined(WOLFSSL_NO_ML_DSA_44)
1299    /* SLH-DSA-SHA2-128s root + ML-DSA-44 entity cert tests (TLS 1.3) */
1300    XSTRLCPY(argv0[1], "tests/test-tls13-slhdsa-sha2.conf",
1301             sizeof(argv0[1]));
1302    printf("starting TLSv13 SLH-DSA-SHA2-128s root + ML-DSA-44 entity tests\n");
1303    test_harness(&args);
1304    if (args.return_code != 0) {
1305        printf("error from script %d\n", args.return_code);
1306        args.return_code = EXIT_FAILURE;
1307        goto exit;
1308    }
1309#endif
1310#if defined(HAVE_ECC) && defined(WOLFSSL_SHA512) && \
1311    (defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES))
1312    /* add P-521 certificate cipher suite tests */
1313    XSTRLCPY(argv0[1], "tests/test-p521.conf", sizeof(argv0[1]));
1314    printf("starting P-521 extra cipher suite tests\n");
1315    test_harness(&args);
1316    if (args.return_code != 0) {
1317        printf("error from script %d\n", args.return_code);
1318        args.return_code = EXIT_FAILURE;
1319        goto exit;
1320    }
1321#endif
1322#if defined(HAVE_ECC) && !defined(NO_SHA256) && defined(WOLFSSL_CUSTOM_CURVES) && \
1323    defined(HAVE_ECC_KOBLITZ) && defined(HAVE_ECC_BRAINPOOL) && \
1324        /* Intel QuickAssist and Cavium Nitrox do not support custom curves */ \
1325        !defined(HAVE_INTEL_QA) && !defined(HAVE_CAVIUM_V) && \
1326        /* only supported with newer ASN template code */ \
1327        defined(WOLFSSL_ASN_TEMPLATE)
1328
1329    /* TLS non-NIST curves (Koblitz / Brainpool) */
1330    XSTRLCPY(argv0[1], "tests/test-ecc-cust-curves.conf", sizeof(argv0[1]));
1331    printf("starting TLS test of non-NIST curves (Koblitz / Brainpool)\n");
1332    test_harness(&args);
1333    if (args.return_code != 0) {
1334        printf("error from script %d\n", args.return_code);
1335        args.return_code = EXIT_FAILURE;
1336        goto exit;
1337    }
1338#endif
1339#ifdef WOLFSSL_DTLS
1340    /* add dtls extra suites */
1341    XSTRLCPY(argv0[1], "tests/test-dtls.conf", sizeof(argv0[1]));
1342    printf("starting dtls extra cipher suite tests\n");
1343    test_harness(&args);
1344    if (args.return_code != 0) {
1345        printf("error from script %d\n", args.return_code);
1346        args.return_code = EXIT_FAILURE;
1347        goto exit;
1348    }
1349    /* add dtls grouping tests */
1350    XSTRLCPY(argv0[1], "tests/test-dtls-group.conf", sizeof(argv0[1]));
1351    printf("starting dtls message grouping tests\n");
1352    test_harness(&args);
1353    if (args.return_code != 0) {
1354        printf("error from script %d\n", args.return_code);
1355        args.return_code = EXIT_FAILURE;
1356        goto exit;
1357    }
1358    /* add dtls session resumption tests */
1359    XSTRLCPY(argv0[1], "tests/test-dtls-resume.conf", sizeof(argv0[1]));
1360    printf("starting dtls session resumption tests\n");
1361    test_harness(&args);
1362    if (args.return_code != 0) {
1363        printf("error from script %d\n", args.return_code);
1364        args.return_code = EXIT_FAILURE;
1365        goto exit;
1366    }
1367#ifdef HAVE_SECURE_RENEGOTIATION
1368    /* add dtls renegotiation tests */
1369    XSTRLCPY(argv0[1], "tests/test-dtls-reneg-client.conf", sizeof(argv0[1]));
1370    printf("starting dtls secure renegotiation client tests\n");
1371    test_harness(&args);
1372    if (args.return_code != 0) {
1373        printf("error from script %d\n", args.return_code);
1374        args.return_code = EXIT_FAILURE;
1375        goto exit;
1376    }
1377    XSTRLCPY(argv0[1], "tests/test-dtls-reneg-server.conf", sizeof(argv0[1]));
1378    printf("starting dtls secure renegotiation server tests\n");
1379    test_harness(&args);
1380    if (args.return_code != 0) {
1381        printf("error from script %d\n", args.return_code);
1382        args.return_code = EXIT_FAILURE;
1383        goto exit;
1384    }
1385#endif
1386#ifdef WOLFSSL_DTLS_MTU
1387    /* Add dtls different MTU size tests.
1388     * These also use grouping to force wolfSSL to
1389     * bounce off the MTU limit more */
1390    XSTRLCPY(argv0[1], "tests/test-dtls-mtu.conf", sizeof(argv0[1]));
1391    printf("starting dtls MTU tests\n");
1392    test_harness(&args);
1393    if (args.return_code != 0) {
1394        printf("error from script %d\n", args.return_code);
1395        args.return_code = EXIT_FAILURE;
1396        goto exit;
1397    }
1398#endif
1399
1400    /* Add dtls downgrade test */
1401    XSTRLCPY(argv0[1], "tests/test-dtls-downgrade.conf", sizeof(argv0[1]));
1402    printf("starting dtls downgrade tests\n");
1403    test_harness(&args);
1404    if (args.return_code != 0) {
1405        printf("error from script %d\n", args.return_code);
1406        args.return_code = EXIT_FAILURE;
1407        goto exit;
1408    }
1409
1410#ifdef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
1411    /* add dtls extra suites */
1412    XSTRLCPY(argv0[1], "tests/test-dtls-sha2.conf", sizeof(argv0[1]));
1413    printf("starting dtls extra cipher suite tests - old TLS sha-2 cs\n");
1414    test_harness(&args);
1415    if (args.return_code != 0) {
1416        printf("error from script %d\n", args.return_code);
1417        args.return_code = EXIT_FAILURE;
1418        goto exit;
1419    }
1420#endif
1421#ifndef WOLFSSL_NO_DTLS_SIZE_CHECK
1422    /* failure tests */
1423    args.argc = 3;
1424    XSTRLCPY(argv0[1], "tests/test-dtls-fails.conf", sizeof(argv0[1]));
1425    XSTRLCPY(argv0[2], "expFail", sizeof(argv0[2])); /* tests are expected to fail */
1426    printf("starting dtls tests that expect failure\n");
1427    test_harness(&args);
1428    if (args.return_code != 0) {
1429        printf("error from script %d\n", args.return_code);
1430        args.return_code = EXIT_FAILURE;
1431        goto exit;
1432    }
1433    XSTRLCPY(argv0[2], "", sizeof(argv0[2]));
1434#endif
1435#if defined(WOLFSSL_EXTRA_ALERTS) && defined(WOLFSSL_AES_256)
1436    /* failure tests */
1437    args.argc = 3;
1438    XSTRLCPY(argv0[1], "tests/test-dtls-fails-cipher.conf", sizeof(argv0[1]));
1439    XSTRLCPY(argv0[2], "expFail", sizeof(argv0[2])); /* tests are expected to fail */
1440    printf("starting dtls cipher mismatch tests that expect failure\n");
1441    test_harness(&args);
1442    if (args.return_code != 0) {
1443        printf("error from script %d\n", args.return_code);
1444        args.return_code = EXIT_FAILURE;
1445        goto exit;
1446    }
1447    XSTRLCPY(argv0[2], "", sizeof(argv0[2]));
1448#endif
1449
1450#ifdef WOLFSSL_SRTP
1451    args.argc = 2;
1452    strcpy(argv0[1], "tests/test-dtls-srtp.conf");
1453    printf("starting dtls srtp suite tests\n");
1454    test_harness(&args);
1455    if (args.return_code != 0) {
1456        printf("error from script %d\n", args.return_code);
1457        args.return_code = EXIT_FAILURE;
1458        goto exit;
1459    }
1460
1461    /* failure tests */
1462    args.argc = 3;
1463    strcpy(argv0[1], "tests/test-dtls-srtp-fails.conf");
1464    strcpy(argv0[2], "expFail"); /* tests are expected to fail */
1465    printf("starting dtls srtp profile mismatch tests that expect failure\n");
1466    test_harness(&args);
1467    if (args.return_code != 0) {
1468        printf("error from script %d\n", args.return_code);
1469        args.return_code = EXIT_FAILURE;
1470        goto exit;
1471    }
1472    strcpy(argv0[2], "");
1473#endif
1474
1475#ifdef WOLFSSL_DTLS13
1476    args.argc = 2;
1477    strcpy(argv0[1], "tests/test-dtls13.conf");
1478    printf("starting DTLSv1.3 suite\n");
1479    test_harness(&args);
1480    if (args.return_code != 0) {
1481        printf("error from script %d\n", args.return_code);
1482        args.return_code = EXIT_FAILURE;
1483        goto exit;
1484    }
1485
1486#ifndef WOLFSSL_NO_TLS12
1487    args.argc = 2;
1488    strcpy(argv0[1], "tests/test-dtls13-downgrade.conf");
1489    printf("starting DTLSv1.3 suite - downgrade\n");
1490    test_harness(&args);
1491    if (args.return_code != 0) {
1492        printf("error from script %d\n", args.return_code);
1493        args.return_code = EXIT_FAILURE;
1494        goto exit;
1495    }
1496    args.argc = 3;
1497    strcpy(argv0[1], "tests/test-dtls13-downgrade-fails.conf");
1498    strcpy(argv0[2], "expFail");
1499    printf("starting DTLSv1.3 suite - downgrade - (expFails)\n");
1500    test_harness(&args);
1501    if (args.return_code != 0) {
1502        printf("error from script %d\n", args.return_code);
1503        args.return_code = EXIT_FAILURE;
1504        goto exit;
1505    }
1506    args.argc = 2;
1507    XMEMSET(argv0[2], 0, sizeof(argv0[2]));
1508#endif /* WOLFSSL_NO_TLS12 */
1509
1510#ifndef NO_PSK
1511    XSTRLCPY(argv0[1], "tests/test-dtls13-psk.conf", sizeof(argv0[1]));
1512    printf("starting DTLS 1.3 psk suite tests\n");
1513    test_harness(&args);
1514    if (args.return_code != 0) {
1515        printf("error from script %d\n", args.return_code);
1516        args.return_code = EXIT_FAILURE;
1517        goto exit;
1518    }
1519#endif /* NO_PSK */
1520
1521#ifdef WOLFSSL_DTLS_CID
1522    XSTRLCPY(argv0[1], "tests/test-dtls13-cid.conf", sizeof(argv0[1]));
1523    printf("starting DTLS 1.3 ConnectionID suite tests\n");
1524    test_harness(&args);
1525    if (args.return_code != 0) {
1526        printf("error from script %d\n", args.return_code);
1527        args.return_code = EXIT_FAILURE;
1528        goto exit;
1529    }
1530#endif /* WOLFSSL_DTLS_CID */
1531
1532#endif /* WOLFSSL_DTLS13 */
1533
1534#endif
1535#ifdef WOLFSSL_SCTP
1536    /* add dtls-sctp extra suites */
1537    XSTRLCPY(argv0[1], "tests/test-sctp.conf", sizeof(argv0[1]));
1538    printf("starting dtls-sctp extra cipher suite tests\n");
1539    test_harness(&args);
1540    if (args.return_code != 0) {
1541        printf("error from script %d\n", args.return_code);
1542        args.return_code = EXIT_FAILURE;
1543        goto exit;
1544    }
1545#ifdef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
1546    /* add dtls-sctp extra suites */
1547    XSTRLCPY(argv0[1], "tests/test-sctp-sha2.conf", sizeof(argv0[1]));
1548    printf("starting dtls-sctp extra cipher suite tests - old TLS sha-2 cs\n");
1549    test_harness(&args);
1550    if (args.return_code != 0) {
1551        printf("error from script %d\n", args.return_code);
1552        args.return_code = EXIT_FAILURE;
1553        goto exit;
1554    }
1555#endif
1556#endif
1557#ifndef WC_STRICT_SIG
1558#if !defined(NO_RSA) && defined(HAVE_ECC) /* testing mixed ECC/RSA cert */
1559    /* add extra signature test suites */
1560    XSTRLCPY(argv0[1], "tests/test-sig.conf", sizeof(argv0[1]));
1561    printf("starting sig extra cipher suite tests\n");
1562    test_harness(&args);
1563    if (args.return_code != 0) {
1564        printf("error from script %d\n", args.return_code);
1565        args.return_code = EXIT_FAILURE;
1566        goto exit;
1567    }
1568#endif /* !NO__RSA and HAVE_ECC */
1569#endif /* !WC_STRICT_SIG */
1570#if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3) && \
1571    (defined(WOLFSSL_SM4_GCM) || defined(WOLFSSL_SM4_CCM))
1572    /* add SM2/SM3/SM4 test suites */
1573    XSTRLCPY(argv0[1], "tests/test-sm2.conf", sizeof(argv0[1]));
1574    printf("starting SM2/SM3/SM4 cipher suite tests\n");
1575    test_harness(&args);
1576    if (args.return_code != 0) {
1577        printf("error from script %d\n", args.return_code);
1578        args.return_code = EXIT_FAILURE;
1579        goto exit;
1580    }
1581#endif
1582#ifndef NO_PSK
1583    #ifndef WOLFSSL_NO_TLS12
1584        #if !defined(NO_RSA) || defined(HAVE_ECC)
1585        /* add psk cipher suites */
1586        XSTRLCPY(argv0[1], "tests/test-psk.conf", sizeof(argv0[1]));
1587        printf("starting psk cipher suite tests\n");
1588        test_harness(&args);
1589        if (args.return_code != 0) {
1590            printf("error from script %d\n", args.return_code);
1591            args.return_code = EXIT_FAILURE;
1592            goto exit;
1593        }
1594        #endif
1595    #endif
1596    #if defined(WOLFSSL_TLS13) && !defined(NO_PSK)
1597    /* add psk extra suites */
1598    XSTRLCPY(argv0[1], "tests/test-tls13-psk.conf", sizeof(argv0[1]));
1599    printf("starting TLS 1.3 psk no identity extra cipher suite tests\n");
1600    test_harness(&args);
1601    if (args.return_code != 0) {
1602        printf("error from script %d\n", args.return_code);
1603        args.return_code = EXIT_FAILURE;
1604        goto exit;
1605    }
1606    #ifdef WOLFSSL_CERT_WITH_EXTERN_PSK
1607    /* add psk with certificates (cert_with_extern_psk) suites */
1608    XSTRLCPY(argv0[1], "tests/test-tls13-psk-certs.conf", sizeof(argv0[1]));
1609    printf("starting TLS 1.3 PSK with certificates extra suite tests\n");
1610    test_harness(&args);
1611    if (args.return_code != 0) {
1612        printf("error from script %d\n", args.return_code);
1613        args.return_code = EXIT_FAILURE;
1614        goto exit;
1615    }
1616    #endif
1617    #endif
1618#endif
1619#if defined(WOLFSSL_ENCRYPTED_KEYS) && !defined(NO_DES3) && !defined(NO_MD5) &&\
1620    !defined(NO_SHA)
1621    /* test encrypted keys */
1622    XSTRLCPY(argv0[1], "tests/test-enckeys.conf", sizeof(argv0[1]));
1623    printf("starting encrypted keys extra cipher suite tests\n");
1624    test_harness(&args);
1625    if (args.return_code != 0) {
1626        printf("error from script %d\n", args.return_code);
1627        args.return_code = EXIT_FAILURE;
1628        goto exit;
1629    }
1630#endif
1631
1632#ifdef HAVE_MAX_FRAGMENT
1633    /* Max fragment cipher suite tests */
1634    XSTRLCPY(argv0[1], "tests/test-maxfrag.conf", sizeof(argv0[1]));
1635    printf("starting max fragment cipher suite tests\n");
1636    test_harness(&args);
1637    if (args.return_code != 0) {
1638        printf("error from script %d\n", args.return_code);
1639        args.return_code = EXIT_FAILURE;
1640        goto exit;
1641    }
1642
1643    #ifdef WOLFSSL_DTLS
1644    XSTRLCPY(argv0[1], "tests/test-maxfrag-dtls.conf", sizeof(argv0[1]));
1645    printf("starting dtls max fragment cipher suite tests\n");
1646    test_harness(&args);
1647    if (args.return_code != 0) {
1648        printf("error from script %d\n", args.return_code);
1649        args.return_code = EXIT_FAILURE;
1650        goto exit;
1651    }
1652    #endif
1653#endif
1654
1655#ifdef WOLFSSL_ALT_CERT_CHAINS
1656    /* tests for alt chains */
1657    XSTRLCPY(argv0[1], "tests/test-altchains.conf", sizeof(argv0[1]));
1658    printf("starting certificate alternate chain cipher suite tests\n");
1659    test_harness(&args);
1660    if (args.return_code != 0) {
1661        printf("error from script %d\n", args.return_code);
1662        args.return_code = EXIT_FAILURE;
1663        goto exit;
1664    }
1665#else
1666    /* tests for chains */
1667    XSTRLCPY(argv0[1], "tests/test-chains.conf", sizeof(argv0[1]));
1668    printf("starting certificate chain cipher suite tests\n");
1669    test_harness(&args);
1670    if (args.return_code != 0) {
1671        printf("error from script %d\n", args.return_code);
1672        args.return_code = EXIT_FAILURE;
1673        goto exit;
1674    }
1675#endif
1676
1677#ifdef WOLFSSL_TRUST_PEER_CERT
1678    /* tests for trusted peer cert */
1679    XSTRLCPY(argv0[1], "tests/test-trustpeer.conf", sizeof(argv0[1]));
1680    printf("starting trusted peer certificate cipher suite tests\n");
1681    test_harness(&args);
1682    if (args.return_code != 0) {
1683        printf("error from script %d\n", args.return_code);
1684        args.return_code = EXIT_FAILURE;
1685        goto exit;
1686    }
1687#endif
1688
1689    /* tests for dh prime */
1690    args.argc = 3;
1691    XSTRLCPY(argv0[1], "tests/test-dhprime.conf", sizeof(argv0[1]));
1692    XSTRLCPY(argv0[2], "doDH", sizeof(argv0[2])); /* add DH prime flag */
1693    printf("starting dh prime tests\n");
1694    test_harness(&args);
1695    if (args.return_code != 0) {
1696        printf("error from script %d\n", args.return_code);
1697        args.return_code = EXIT_FAILURE;
1698        goto exit;
1699    }
1700
1701    /* failure tests */
1702    args.argc = 3;
1703    XSTRLCPY(argv0[1], "tests/test-fails.conf", sizeof(argv0[1]));
1704    XSTRLCPY(argv0[2], "expFail", sizeof(argv0[2])); /* tests are expected to fail */
1705    printf("starting tests that expect failure\n");
1706    test_harness(&args);
1707    if (args.return_code != 0) {
1708        printf("error from script %d\n", args.return_code);
1709        args.return_code = EXIT_FAILURE;
1710        goto exit;
1711    }
1712
1713exit:
1714
1715    if (args.return_code == 0)
1716        printf("\n Success -- All results as expected.\n");
1717
1718    printf(" End Cipher Suite Tests\n");
1719
1720    wolfSSL_CTX_free(cipherSuiteCtx);
1721    wolfSSL_Cleanup();
1722
1723#if defined(HAVE_ECC) && defined(FP_ECC) && defined(HAVE_THREAD_LS) \
1724                      && (defined(NO_MAIN_DRIVER) || defined(HAVE_STACK_SIZE))
1725    wc_ecc_fp_free();  /* free per thread cache */
1726#endif
1727#ifdef WOLFSSL_ASYNC_CRYPT
1728    wolfAsync_DevClose(&devId);
1729#endif
1730
1731    return args.return_code;
1732#else
1733    (void)argc;
1734    (void)argv;
1735    return NOT_COMPILED_IN;
1736#endif /* !NO_WOLFSSL_SERVER && !NO_WOLFSSL_CLIENT && !NO_TLS */
1737}