#-------------------------------------------------------------------------#

# Generate a random port number, guaranteed unique within this script run.

# Checks both the intra-run used_ports list and system-level bound ports.

#-------------------------------------------------------------------------#

local attempts=0 collision p

while true; do

if [[ "$OSTYPE" == "linux"* ]]; then

p=$(($(od -An -N2 /dev/urandom) % (65535-49512) + 49512))

elif [[ "$OSTYPE" == "darwin"* ]]; then

p=$(($(od -An -N2 /dev/random) % (65535-49512) + 49512))

else

echo "Unknown OS TYPE"

exit 1

fi

# Check against ports already assigned in this run

collision=0

for up in "${used_ports[@]}"; do

if [ "$up" = "$p" ]; then

collision=1

break

fi

done

# Also check if the port is already bound on this system

if [ "$collision" -eq 0 ]; then

if command -v ss &>/dev/null; then

ss -lnt 2>/dev/null | grep -q ":${p}[[:space:]]" && collision=1

elif command -v netstat &>/dev/null; then

netstat -lnt 2>/dev/null | grep -q ":${p}[[:space:]]" && collision=1

fi

fi

[ "$collision" -eq 0 ] && break

((attempts++))

if [ "$attempts" -ge 100 ]; then

echo "ERROR: generate_port could not find a free port after 100 attempts"

exit 1

fi

done

port=$p

used_ports+=("$p")

case $version in "0")

versionName="SSLv3"

;;

"1")

versionName="TLSv1"

;;

"2")

versionName="TLSv1.1"

;;

"3")

versionName="TLSv1.2"

;;

"4")

versionName="TLSv1.3"

;;

"d")

versionName="Down"

;;

"")

versionName="Def"

;;

"5")

versionName="ALL"

;;

esac

echo "in cleanup"

IFS=$OIFS #restore separator

sleepseconds=1

for s in $servers

do

f2=${s%:*}

sname=${f2%:*}

pid=${f2##*:}

port=${s##*:}

if kill -0 "$pid" 2>&-

then

# sleep to give sanitizers time to dump backtraces.

sleep $sleepseconds

sleepseconds=0

echo "killing server: $sname ($port)"

kill -9 "$pid"

fi

done

echo "got trap"

do_cleanup

exit 1

if [ "$wolfssl_client_avail" = "" ]

then

return

fi

generate_port

server_port=$port

found_free_port=0

counter=0

# If OPENSSL_ENGINE_ID has been set then check that the desired engine can

# be loaded successfully and error out if not. Otherwise the OpenSSL app

# will fall back to default engine.

if [ -n "${OPENSSL_ENGINE_ID}" ]; then

OUTPUT=$($OPENSSL engine -tt "$OPENSSL_ENGINE_ID")

if ! echo "$OUTPUT" | grep -q "available"; then

printf "not able to load engine or engine not available\n"

printf '%s\n' "$OPENSSL engine -tt $OPENSSL_ENGINE_ID"

do_cleanup

exit 1

fi

OPENSSL_ENGINE_ID="-engine ${OPENSSL_ENGINE_ID}"

fi

while [ "$counter" -lt 20 ]; do

echo -e "\n# Trying to start $openssl_suite OpenSSL server on port $server_port..."

echo "#"

if [ "$cert_file" != "" ]

then

echo "# $OPENSSL s_server -accept $server_port $OPENSSL_ENGINE_ID -cert \"$cert_file\" -key \"$key_file\" -quiet -CAfile \"$ca_file\" -www -dhparam \"${CERT_DIR}/dh2048.pem\" -verify 10 -verify_return_error -psk $psk_hex -cipher \"ALL:eNULL\" $openssl_nodhe"

# shellcheck disable=SC2086

$OPENSSL s_server -accept "$server_port" $OPENSSL_ENGINE_ID -cert "$cert_file" -key "$key_file" -quiet -CAfile "$ca_file" -www -dhparam "${CERT_DIR}/dh2048.pem" -verify 10 -verify_return_error -psk "$psk_hex" -cipher "ALL:eNULL" $openssl_nodhe &

else

echo "# $OPENSSL s_server -accept $server_port $OPENSSL_ENGINE_ID -quiet -nocert -www -dhparam \"${CERT_DIR}/dh2048.pem\" -verify 10 -verify_return_error -psk $psk_hex -cipher \"ALL:eNULL\" $openssl_nodhe"

# shellcheck disable=SC2086

$OPENSSL s_server -accept "$server_port" $OPENSSL_ENGINE_ID -quiet -nocert -www -dhparam "${CERT_DIR}/dh2048.pem" -verify 10 -verify_return_error -psk "$psk_hex" -cipher "ALL:eNULL" $openssl_nodhe &

fi

server_pid=$!

# wait to see if s_server successfully starts before continuing

sleep 0.1

if kill -0 "$server_pid" 2>/dev/null

then

echo "s_server started successfully on port $server_port"

found_free_port=1

break

else

#port already started, try a different port

counter=$((counter+ 1))

generate_port

server_port=$port

fi

done

if [ "$found_free_port" = 0 ]

then

echo -e "Couldn't find free port for server"

do_cleanup

exit 1

fi

servers="$servers OpenSSL_$openssl_suite:$server_pid:$server_port"

if [ "$wolfssl_server_avail" = "" ]

then

echo "# wolfSSL server not available"

return

fi

wolfssl_cert=""

wolfssl_key=""

wolfssl_caCert=""

if [ "$cert_file" != "" ]

then

wolfssl_cert="-c$cert_file"

fi

if [ "$key_file" != "" ]

then

wolfssl_key="-k$key_file"

fi

if [ "$ca_file" != "" ]

then

wolfssl_caCert="-A$ca_file"

fi

generate_port

server_port=$port

found_free_port=0

counter=0

while [ "$counter" -lt 20 ]; do

echo -e "\n# Trying to start $wolfssl_suite wolfSSL server on port $server_port..."

echo "#"

echo "# $WOLFSSL_SERVER -p $server_port -g -v d -x -i $psk $crl -l ALL \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\""

# shellcheck disable=SC2086

$WOLFSSL_SERVER -p "$server_port" -g -v d -x -i $psk $crl -l ALL "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" &

server_pid=$!

# wait to see if server successfully starts before continuing

sleep 0.1

if kill -0 "$server_pid" 2>/dev/null

then

echo "wolfSSL server started successfully on port $server_port"

found_free_port=1

break

else

#port already started, try a different port

counter=$((counter+ 1))

generate_port

server_port=$port

fi

done

if [ "$found_free_port" = 0 ]

then

echo -e "Couldn't find free port for server"

do_cleanup

exit 1

fi

servers="$servers wolfSSL_$wolfssl_suite:$server_pid:$server_port"

# server should be ready, let's make sure

server_ready=0

while [ "$counter" -lt 20 ]; do

echo -e "waiting for $server_name ready..."

echo -e Checking | nc -4 -w 1 -z localhost "$server_port"

nc_result=$?

if [ "$nc_result" = 0 ]

then

echo -e "$server_name ready!"

server_ready=1

break

fi

sleep 0.1

counter=$((counter+ 1))

done

if [ $server_ready = 0 ]

then

echo -e "Couldn't verify $server_name is running, timeout error"

do_cleanup

exit 1

fi

if [ "$wolfssl_client_avail" = "" ]

then

return

fi

wolfssl_cert=""

wolfssl_key=""

wolfssl_caCert=""

if [ "$cert" != "" ]

then

wolfssl_cert="-c$cert"

fi

if [ "$key" != "" ]

then

wolfssl_key="-k$key"

fi

if [ "$caCert" != "" ]

then

wolfssl_caCert="-A$caCert"

fi

wolfssl_resume="-r"

if [ "$openssl_psk_resume_bug" != "" ] && [ "$tls13_suite" != "" ]

then

wolfssl_resume=

fi

if [ "$wolfssl_no_resume" = "yes" ]

then

wolfssl_resume=

fi

if [ "$version" != "5" ] && [ "$version" != "" ]

then

echo "#"

echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite -v $version $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"

# shellcheck disable=SC2086

$WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" -v "$version" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl

else

echo "#"

echo "# $WOLFSSL_CLIENT -p $port -g $wolfssl_resume -l $wolfSuite $psk $adh \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\" $crl"

# do all versions

# shellcheck disable=SC2086

$WOLFSSL_CLIENT -p "$port" -g $wolfssl_resume -l "$wolfSuite" $psk $adh "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" $crl

fi

client_result=$?

if [ "$client_result" != 0 ]

then

echo -e "client failed! Suite = $wolfSuite version = $version"

do_cleanup

exit 1

fi

wolf_temp_cases_tested=$((wolf_temp_cases_tested+1))

if [ "$wolfssl_server_avail" = "" ]

then

return

fi

if [ "$version" = "" ] || [ "$version" = "5" ]

then

if [ "$tls13_cipher" = "" ] && [ "$openssl_tls13" != "" ]

then

openssl_version="-no_tls1_3"

fi

fi

if [ "$cert" != "" ]

then

openssl_cert1="-cert"

openssl_cert2="$cert"

fi

if [ "$key" != "" ]

then

openssl_key1="-key"

openssl_key2="$key"

fi

if [ "$caCert" != "" ]

then

openssl_caCert1="-CAfile"

openssl_caCert2="$caCert"

fi

# Integrity-only cipher suites require SECLEVEL=0 to allow NULL encryption

openssl_seclevel=""

if [ "$tls13_integrity_only" = "yes" ]

then

openssl_seclevel="-cipher ALL:@SECLEVEL=0"

fi

if [ "$tls13_cipher" = "" ]

then

echo "#"

echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""

echo "Hello" | eval "$OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -cipher $cmpSuite $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""

else

echo "#"

echo "# $OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""

echo "Hello" | eval "$OPENSSL s_client -connect localhost:$port -reconnect -legacy_renegotiation -ciphersuites=$cmpSuite $openssl_seclevel $openssl_version $openssl_psk $openssl_cert1 \"$openssl_cert2\" $openssl_key1 \"$openssl_key2\" $openssl_caCert1 \"$openssl_caCert2\""

fi

client_result=$?

if [ "$client_result" != 0 ]

then

echo -e "client failed! Suite = $wolfSuite version = $version"

do_cleanup

exit 1

fi

open_temp_cases_tested=$((open_temp_cases_tested+1))