Skip to content

Commit 5140cc3

Browse files
ColtonWilleyColtonWilley
authored
Merge pull request #347 from aidangarske/fix-provider-cmd-test
Fix provider cmd test
2 parents 2f3af89 + 7b4997d commit 5140cc3

File tree

7 files changed

+232
-67
lines changed

7 files changed

+232
-67
lines changed

‎.github/workflows/cmdline.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,5 @@ jobs:
3535
3636
- name: Run tests
3737
run: |
38+
source scripts/env-setup
3839
${{ matrix.force_fail }} ${{ matrix.debug }} ./scripts/cmd_test/do-cmd-tests.sh

‎.github/workflows/debian-package.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ jobs:
8686
run: |
8787
# Run the do-cmd-test.sh script to execute interoperability tests
8888
echo "Running OpenSSL provider interoperability tests..."
89-
OPENSSL_BIN=$(eval which openssl) ${{ matrix.force_fail }} ${{ matrix.fips_ref == 'FIPS' && 'WOLFSSL_ISFIPS=1' || '' }} ./scripts/cmd_test/do-cmd-tests.sh
89+
OPENSSL_BIN=$(eval which openssl) ${{ matrix.replace_default && 'WOLFPROV_REPLACE_DEFAULT=1' || '' }} ${{ matrix.force_fail }} ${{ matrix.fips_ref == 'FIPS' && 'WOLFSSL_ISFIPS=1' || '' }} ./scripts/cmd_test/do-cmd-tests.sh
9090
echo "PASS: All provider interoperability tests successful"
9191
9292
- name: Uninstall package and verify cleanup

‎.github/workflows/fips-ready.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,5 +57,6 @@ jobs:
5757
# Run cmd tests to verify functionality
5858
export WOLFSSL_ISFIPS=1
5959
export ${{matrix.force_fail}}
60+
source scripts/env-setup
6061
6162
${{ matrix.force_fail }} ./scripts/cmd_test/do-cmd-tests.sh

‎scripts/cmd_test/cmd-test-common.sh‎

Lines changed: 117 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,15 @@ source "${CMD_TEST_DIR}/../utils-general.sh"
3131

3232
# Function to setup the environment for the command-line tests
3333
cmd_test_env_setup() {
34-
export OPENSSL_BIN=${OPENSSL_BIN:-$(which openssl)}
34+
# Use OPENSSL_BIN if explicitly set, otherwise auto-detect
35+
if [ -z "${OPENSSL_BIN:-}" ]; then
36+
OPENSSL_BIN=$(which openssl 2>/dev/null || echo "")
37+
if [ -z "$OPENSSL_BIN" ]; then
38+
echo "ERROR: Cannot find openssl binary. Please set OPENSSL_BIN environment variable."
39+
exit 1
40+
fi
41+
fi
42+
export OPENSSL_BIN
3543
printf "Using OPENSSL_BIN: %s\n" "$OPENSSL_BIN"
3644

3745
OPENSSL_CONF_ORIG="${OPENSSL_CONF:-}"
@@ -59,87 +67,154 @@ cmd_test_init() {
5967

6068
# Function to use default provider only
6169
use_default_provider() {
62-
return 0
63-
64-
if [ -z "${OPENSSL_CONF_ORIG:-}" ]; then
65-
export OPENSSL_CONF="/dev/null"
66-
export OPENSSL_MODULES="/dev/null"
67-
else
68-
unset OPENSSL_CONF
69-
unset OPENSSL_MODULES
70-
fi
70+
# Detect mode BEFORE modifying environment variables
7171
detect_wolfprovider_mode
72-
72+
7373
# Check if wolfProvider is in replace-default mode
74-
if [ "$is_openssl_replace_default" = "1" ]; then
75-
echo "INFO: wolfProvider is installed in replace-default mode"
76-
echo "INFO: wolfProvider IS the default provider and cannot be switched off"
77-
78-
# Verify that wolfProvider (as default) is active
79-
if [ "$is_wp_active" = "1" ] && [ "$is_wp_default" = "1" ]; then
74+
if [ "$is_openssl_replace_default" = "1" ] || [ "${WOLFPROV_REPLACE_DEFAULT:-0}" = "1" ]; then
75+
# In replace-default mode, wolfProvider IS the default provider
76+
# No provider switching possible - just verify it's active
77+
echo "replace-default is set, using default provider"
78+
79+
# In replace-default mode, don't modify environment variables
80+
# Just verify that wolfProvider is active as the default
81+
if [ "$is_wp_active" = "1" ] && [ "$is_wp_default" = "1" ]; then
8082
echo "Using default provider (wolfProvider in replace-default mode)"
83+
return 0
8184
else
8285
echo "FAIL: Expected wolfProvider as default, but is_wp_active: $is_wp_active and is_wp_default: $is_wp_default"
8386
exit 1
8487
fi
8588
else
8689
# In non-replace-default mode, unsetting OPENSSL_MODULES should disable wolfProvider
87-
echo "INFO: wolfProvider is installed in non-replace-default mode"
90+
# Disable wolfProvider by setting OPENSSL_CONF and OPENSSL_MODULES to /dev/null
91+
if [ -z "${OPENSSL_CONF_ORIG:-}" ]; then
92+
export OPENSSL_CONF="/dev/null"
93+
export OPENSSL_MODULES="/dev/null"
94+
else
95+
unset OPENSSL_CONF
96+
unset OPENSSL_MODULES
97+
fi
98+
99+
# Re-detect after disabling
100+
detect_wolfprovider_mode
88101

89102
# Verify that we are using the OpenSSL default provider (not wolfProvider)
90103
if [ "$is_openssl_default_provider" != "1" ]; then
91104
echo "FAIL: unable to switch to default provider, wolfProvider is still active"
92105
echo "is_openssl_default_provider: $is_openssl_default_provider"
93106
exit 1
94107
fi
95-
echo "INFO: Switched to default provider (OpenSSL)"
108+
echo "INFO: Switched to OpenSSL default provider"
109+
return 0
96110
fi
97111
}
98112

99113

100114
# Function to use wolf provider only
101115
use_wolf_provider() {
102-
return 0
103-
104-
if [ -z "${OPENSSL_CONF_ORIG:-}" ]; then
105-
unset OPENSSL_CONF
106-
unset OPENSSL_MODULES
107-
else
108-
export OPENSSL_CONF="${OPENSSL_CONF_ORIG:-}"
109-
export OPENSSL_MODULES="${OPENSSL_MODULES_ORIG:-}"
110-
fi
116+
# Detect mode BEFORE modifying environment variables
111117
detect_wolfprovider_mode
112-
118+
113119
# Check if wolfProvider is in replace-default mode
114-
if [ "$is_openssl_replace_default" = "1" ]; then
115-
# In replace-default mode, wolfProvider is already the default
116-
# No need to set OPENSSL_MODULES or OPENSSL_CONF
117-
echo "INFO: wolfProvider is installed in replace-default mode"
118-
echo "INFO: wolfProvider is already active as the default provider"
119-
120-
# Verify that wolfProvider is active
121-
if [ "$is_wp_active" = "1" ] && [ "$is_wp_default" = "1" ]; then
120+
if [ "$is_openssl_replace_default" = "1" ] || [ "${WOLFPROV_REPLACE_DEFAULT:-0}" = "1" ]; then
121+
# In replace-default mode, wolfProvider IS the default provider
122+
# No provider switching possible - just verify it's active
123+
echo "replace-default is set, using default provider"
124+
125+
# In replace-default mode, don't modify environment variables
126+
# Just verify that wolfProvider is active as the default
127+
if [ "$is_wp_active" = "1" ] && [ "$is_wp_default" = "1" ]; then
122128
echo "Using wolfProvider (replace-default mode)"
129+
return 0
123130
else
124131
echo "FAIL: wolfProvider is not active"
125132
echo "is_wp_active: $is_wp_active"
126133
echo "is_wp_default: $is_wp_default"
127134
exit 1
128135
fi
129136
else
130-
# In non-replace-default mode, we need to set OPENSSL_MODULES and OPENSSL_CONF
131-
echo "INFO: wolfProvider is installed in non-replace-default mode"
137+
# In non-replace-default mode, we need to set OPENSSL_MODULES and OPENSSL_CONF to enable wolfProvider
138+
echo "INFO: Switched to libwolfprov"
139+
140+
# Get paths to enable wolfProvider
141+
# Use WOLFPROV_PATH/WOLFPROV_CONFIG if set (from env-setup), otherwise derive from OPENSSL_BIN path
142+
local wolfprov_lib_path="${WOLFPROV_PATH:-}"
143+
local provider_conf="${WOLFPROV_CONFIG:-}"
144+
145+
# If not set, try to find library path
146+
if [ -z "$wolfprov_lib_path" ]; then
147+
# Try MODULESDIR from openssl version -a (simplest approach)
148+
local openssl_modules_dir=""
149+
openssl_modules_dir=$($OPENSSL_BIN version -a 2>/dev/null | grep -i "^MODULESDIR" | sed -E 's/.*["'\'']([^"'\'']+)["'\''].*/\1/' | head -1)
150+
if [ -n "$openssl_modules_dir" ] && [ -d "$openssl_modules_dir" ]; then
151+
# Check if provider library exists
152+
if [ -f "$openssl_modules_dir/libwolfprov.so" ] || \
153+
[ -f "$openssl_modules_dir/libwolfprov.so.0" ] || \
154+
[ -f "$openssl_modules_dir/libwolfprov.so.0.0.0" ]; then
155+
wolfprov_lib_path="$openssl_modules_dir"
156+
fi
157+
fi
158+
159+
# If still not found, try local build location
160+
if [ -z "$wolfprov_lib_path" ]; then
161+
local openssl_install_dir=$(dirname "$(dirname "$OPENSSL_BIN")" 2>/dev/null || echo "")
162+
local repo_root=$(dirname "$openssl_install_dir" 2>/dev/null || echo "")
163+
if [ -n "$repo_root" ] && [ -d "$repo_root/wolfprov-install/lib" ]; then
164+
wolfprov_lib_path="$repo_root/wolfprov-install/lib"
165+
fi
166+
fi
167+
fi
168+
169+
# If not set, try to find config file (optional - system installs may not need it)
170+
if [ -z "$provider_conf" ]; then
171+
# Try system location first
172+
if [ -f "/etc/ssl/openssl.cnf.d/wolfprovider.conf" ]; then
173+
provider_conf="/etc/ssl/openssl.cnf.d/wolfprovider.conf"
174+
else
175+
# Try local build location
176+
local openssl_install_dir=$(dirname "$(dirname "$OPENSSL_BIN")" 2>/dev/null || echo "")
177+
local repo_root=$(dirname "$openssl_install_dir" 2>/dev/null || echo "")
178+
if [ -n "$repo_root" ]; then
179+
if [ "${WOLFSSL_ISFIPS:-0}" = "1" ] && [ -f "$repo_root/provider-fips.conf" ]; then
180+
provider_conf="$repo_root/provider-fips.conf"
181+
elif [ -f "$repo_root/provider.conf" ]; then
182+
provider_conf="$repo_root/provider.conf"
183+
fi
184+
fi
185+
fi
186+
fi
187+
188+
# Set environment variables to enable wolfProvider
189+
# In system installations, the provider may be auto-loaded via openssl.cnf,
190+
# so library path is optional - only set it if we found it
191+
if [ -n "$wolfprov_lib_path" ] && [ -d "$wolfprov_lib_path" ]; then
192+
export OPENSSL_MODULES="$wolfprov_lib_path"
193+
else
194+
# Library path not found - this is OK for system installs with openssl.cnf configuration
195+
# Just warn about it, don't fail
196+
echo "WARNING: Cannot find wolfProvider library path - will rely on system openssl.cnf configuration"
197+
echo " WOLFPROV_PATH: ${WOLFPROV_PATH:-not set}"
198+
echo " OPENSSL_BIN: ${OPENSSL_BIN:-not set}"
199+
$OPENSSL_BIN version -a 2>&1 | grep -i "^MODULESDIR" || echo " MODULESDIR not found in openssl version output"
200+
fi
201+
202+
# Config file is optional - system installs may use openssl.cnf instead
203+
if [ -n "$provider_conf" ] && [ -f "$provider_conf" ]; then
204+
export OPENSSL_CONF="$provider_conf"
205+
fi
206+
207+
# Re-detect after setting environment
208+
detect_wolfprovider_mode
132209

133210
# Verify that we are using wolfProvider
134211
if [ "$is_wp_active" != "1" ]; then
135212
echo "FAIL: unable to switch to wolfProvider, default provider is still active"
136-
$OPENSSL_BIN list -providers
137213
echo "is_wp_active: $is_wp_active"
138214
echo "is_wp_default: $is_wp_default"
139215
exit 1
140216
fi
141-
echo "INFO: Switched to wolfProvider"
142-
$OPENSSL_BIN list -providers
217+
return 0
143218
fi
144219
}
145220

‎scripts/cmd_test/do-cmd-tests.sh‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,11 @@ TESTS (if none specified, all tests run):
5151
ecc Run ECC key generation test
5252
req Run certificate request test
5353
54-
ENVIRONMENT VARIABLES (env vars get detected from verify-install.sh):
55-
OPENSSL_BIN Path to OpenSSL binary (auto-detected with which(openssl) if not set)
56-
WOLFSSL_ISFIPS Set to 1 for FIPS mode (or use --fips flag)
57-
WOLFPROV_FORCE_FAIL Set to 1 for force-fail mode (or use --force-fail flag)
54+
ENVIRONMENT VARIABLES:
55+
OPENSSL_BIN Path to OpenSSL binary (auto-detected with which(openssl) if not set)
56+
WOLFSSL_ISFIPS Set to 1 for FIPS mode (auto-detected from OpenSSL if not set)
57+
WOLFPROV_REPLACE_DEFAULT Set to 1 to force replace-default mode (auto-detected from OpenSSL version if not set)
58+
WOLFPROV_FORCE_FAIL Set to 1 for force-fail mode
5859
5960
EOF
6061
exit 0

‎scripts/env-setup‎

Lines changed: 75 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
# 'source' this file, don't run it directly
44
# To disable wolfProvider, run 'unset OPENSSL_CONF'
55
# To enable FIPS mode, set WOLFSSL_ISFIPS=1 before sourcing this file
6+
# To use replace-default mode, set WOLFPROV_REPLACE_DEFAULT=1 before sourcing this file
7+
# (or the script will auto-detect replace-default mode from OpenSSL version)
68

79
if [[ -n "${ZSH_VERSION:-}" ]]; then
810
[[ $ZSH_EVAL_CONTEXT =~ :file$ ]] && is_sourced=1 || is_sourced=0
@@ -57,22 +59,58 @@ WOLFPROV_LIB_PATH="$REPO_ROOT/wolfprov-install/lib"
5759
# ${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} expands to :$LD_LIBRARY_PATH only if LD_LIBRARY_PATH was already set
5860
export LD_LIBRARY_PATH="$WOLFPROV_LIB_PATH:$WOLFSSL_LIB_PATH:$OPENSSL_LIB_PATH${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
5961

60-
# Auto-detect FIPS mode and use appropriate config
61-
if [ "${WOLFSSL_ISFIPS:-0}" = "1" ]; then
62-
DEFAULT_PROVIDER_CONF="$REPO_ROOT/provider-fips.conf"
63-
echo "FIPS mode detected, using provider-fips.conf"
64-
else
65-
DEFAULT_PROVIDER_CONF="$REPO_ROOT/provider.conf"
62+
# Set OPENSSL_BIN - use existing if set, otherwise use local build
63+
if [ -z "${OPENSSL_BIN:-}" ]; then
64+
export OPENSSL_BIN="${REPO_ROOT}/openssl-install/bin/openssl"
6665
fi
67-
export OPENSSL_CONF="${OPENSSL_CONF:=$DEFAULT_PROVIDER_CONF}"
68-
69-
export OPENSSL_MODULES="${OPENSSL_MODULES:=$WOLFPROV_LIB_PATH}"
70-
export PKG_CONFIG_PATH="${PKG_CONFIG_PATH:=$OPENSSL_LIB_PATH/pkgconfig}"
7166

7267
# Other variables used by test scripts
7368
export WOLFPROV_PATH="${WOLFPROV_LIB_PATH}"
74-
export WOLFPROV_CONFIG="${DEFAULT_PROVIDER_CONF}"
75-
export OPENSSL_BIN="${REPO_ROOT}/openssl-install/bin/openssl"
69+
70+
# Detect if we're in replace-default mode
71+
# Check environment variable first, then check OpenSSL version string and providers
72+
WOLFPROV_IN_REPLACE_DEFAULT_MODE=0
73+
if [ "${WOLFPROV_REPLACE_DEFAULT:-0}" = "1" ]; then
74+
WOLFPROV_IN_REPLACE_DEFAULT_MODE=1
75+
else
76+
# Try to detect from OpenSSL version and provider list if OPENSSL_BIN exists
77+
if [ -f "$OPENSSL_BIN" ]; then
78+
openssl_version=$($OPENSSL_BIN version 2>/dev/null)
79+
openssl_providers=$($OPENSSL_BIN list -providers 2>/dev/null)
80+
# Check for "replace-default" in version string
81+
if echo "$openssl_version" | grep -qi "replace-default"; then
82+
WOLFPROV_IN_REPLACE_DEFAULT_MODE=1
83+
# Or check if provider list shows "default" with "wolfSSL Provider" name but NOT "OpenSSL Default Provider"
84+
elif echo "$openssl_providers" | grep -q "^ default$" && \
85+
echo "$openssl_providers" | grep -q "wolfSSL Provider" && \
86+
! echo "$openssl_providers" | grep -q "OpenSSL Default Provider"; then
87+
WOLFPROV_IN_REPLACE_DEFAULT_MODE=1
88+
fi
89+
fi
90+
fi
91+
92+
if [ "$WOLFPROV_IN_REPLACE_DEFAULT_MODE" = "1" ]; then
93+
echo "using default provider"
94+
# In replace-default mode, don't set OPENSSL_CONF or OPENSSL_MODULES
95+
# Let OpenSSL use the default provider behavior (wolfProvider IS the default)
96+
unset OPENSSL_CONF
97+
unset OPENSSL_MODULES
98+
export WOLFPROV_CONFIG=""
99+
else
100+
echo "loading wolfProvider as a module provider"
101+
# Auto-detect FIPS mode and use appropriate config
102+
if [ "${WOLFSSL_ISFIPS:-0}" = "1" ]; then
103+
DEFAULT_PROVIDER_CONF="$REPO_ROOT/provider-fips.conf"
104+
echo "FIPS mode detected, using provider-fips.conf"
105+
else
106+
DEFAULT_PROVIDER_CONF="$REPO_ROOT/provider.conf"
107+
fi
108+
export OPENSSL_CONF="${OPENSSL_CONF:=$DEFAULT_PROVIDER_CONF}"
109+
export OPENSSL_MODULES="${OPENSSL_MODULES:=$WOLFPROV_LIB_PATH}"
110+
export WOLFPROV_CONFIG="${DEFAULT_PROVIDER_CONF}"
111+
fi
112+
113+
export PKG_CONFIG_PATH="${PKG_CONFIG_PATH:=$OPENSSL_LIB_PATH/pkgconfig}"
76114

77115
# If openssl-install does not exist, exit with failure status to terminate
78116
# any workflows which depend on the result.
@@ -87,12 +125,31 @@ fi
87125

88126
echo "Checking OpenSSL providers:"
89127
PROVIDER_LIST=$(mktemp -t provider-list.XXXXXX)
90-
$OPENSSL_BIN list -providers | tee $PROVIDER_LIST
91-
if grep -q libwolfprov $PROVIDER_LIST; then
92-
echo "libwolfprov found in OpenSSL providers"
128+
$OPENSSL_BIN list -providers 2>&1 | tee $PROVIDER_LIST
129+
130+
# Check if wolfProvider is available
131+
# In replace-default mode: provider appears as "default" with name "wolfSSL Provider"
132+
# In normal mode: provider appears as "libwolfprov" with name "wolfSSL Provider"
133+
if [ "$WOLFPROV_IN_REPLACE_DEFAULT_MODE" = "1" ]; then
134+
# In replace-default mode, check for "default" provider with "wolfSSL Provider" name
135+
# Or just check that "default" provider exists (since it IS wolfProvider)
136+
if grep -qi "wolfSSL Provider" $PROVIDER_LIST || grep -q "^ default$" $PROVIDER_LIST; then
137+
echo "wolfProvider found as default provider"
138+
else
139+
echo "ERROR: wolfProvider (default provider) not found in OpenSSL providers"
140+
rm -f $PROVIDER_LIST
141+
return 1
142+
fi
93143
else
94-
echo "ERROR: libwolfprov not found in OpenSSL providers"
95-
return 1
96-
fi
144+
# In normal mode, check for "libwolfprov" or "wolfSSL Provider"
145+
if grep -qi "wolfSSL Provider" $PROVIDER_LIST || grep -q libwolfprov $PROVIDER_LIST; then
146+
echo "wolfProvider found in OpenSSL providers"
147+
else
148+
echo "ERROR: wolfProvider not found in OpenSSL providers"
149+
rm -f $PROVIDER_LIST
150+
return 1
151+
fi
152+
fi
153+
rm -f $PROVIDER_LIST
97154

98155
echo "Done!"

0 commit comments

Comments
 (0)