Repository navigation
Bound the DER re-encode in wolfSSL_ECDSA_do_verify under WOLF_CRYPTO_CB_ONLY_ECC #17049
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: socat Tests | |
| # START OF COMMON SECTION | |
| on: | |
| push: | |
| branches: [ 'release/**' ] | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| branches: [ '*' ] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| # END OF COMMON SECTION | |
| jobs: | |
| build_wolfssl: | |
| name: Build wolfSSL | |
| if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 4 | |
| steps: | |
| - name: Build wolfSSL | |
| uses: wolfSSL/actions-build-autotools-project@v1 | |
| with: | |
| path: wolfssl | |
| configure: --enable-all --enable-oldtls --enable-tlsv10 --enable-ipv6 'CPPFLAGS=-DWOLFSSL_NO_DTLS_SIZE_CHECK -DOPENSSL_COMPATIBLE_DEFAULTS' | |
| install: true | |
| - name: tar build-dir | |
| run: tar -zcf build-dir.tgz build-dir | |
| - name: Upload built lib | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: wolf-install-socat | |
| path: build-dir.tgz | |
| retention-days: 5 | |
| socat_check: | |
| name: socat ${{ matrix.socat_version }} | |
| if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }} | |
| runs-on: ubuntu-24.04 | |
| # This should be a safe limit for the parallel tests to run. | |
| timeout-minutes: 15 | |
| needs: build_wolfssl | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - socat_version: "1.8.0.0" | |
| expect_fail: "23,36,64,146,155,156,205,207,216,227,307,309,310,321,386,399,402,403,459,460,467,468,475,478,491,492,494,528,529" | |
| - socat_version: "1.8.0.3" | |
| expect_fail: "23,146,155,156,205,207,307,321,386,399,402,459,460,467,468,475,478,491,492,494,495,528,529" | |
| steps: | |
| - name: Checkout wolfSSL CI actions | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: | | |
| .github/actions | |
| .github/scripts | |
| fetch-depth: 1 | |
| - name: Install prereqs | |
| uses: ./.github/actions/install-apt-deps | |
| with: | |
| packages: build-essential autoconf libtool pkg-config clang libc++-dev bubblewrap | |
| ghcr-debs-tag: ubuntu-24.04-full | |
| - name: Download lib | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: wolf-install-socat | |
| - name: untar build-dir | |
| run: tar -xf build-dir.tgz | |
| - name: Download socat | |
| run: curl -O http://www.dest-unreach.org/socat/download/socat-${{ matrix.socat_version }}.tar.gz && tar xvf socat-${{ matrix.socat_version }}.tar.gz | |
| - name: Checkout OSP | |
| uses: actions/checkout@v5 | |
| with: | |
| repository: wolfssl/osp | |
| path: osp | |
| fetch-depth: 1 | |
| - name: Build socat | |
| working-directory: ./socat-${{ matrix.socat_version }} | |
| run: | | |
| patch -p1 < ../osp/socat/${{ matrix.socat_version }}/socat-${{ matrix.socat_version }}.patch | |
| autoreconf -vfi | |
| ./configure --with-wolfssl=$GITHUB_WORKSPACE/build-dir --enable-default-ipv=4 | |
| make -j | |
| # Ubuntu 24.04 can restrict unprivileged user namespaces via AppArmor, | |
| # which leaves CAP_NET_ADMIN ineffective inside bwrap's netns; the shards | |
| # need it to re-create IPv6 loopback there. Relax the restriction. | |
| - name: Allow unprivileged user namespaces (for bwrap) | |
| run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true | |
| - name: Run socat tests | |
| env: | |
| SOCAT_SRC: ${{ github.workspace }}/socat-${{ matrix.socat_version }} | |
| EXPECT_FAIL: ${{ matrix.expect_fail }} | |
| run: | | |
| export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH | |
| # The socat suite is sleep-bound, so run it as parallel shards via the | |
| # shared parallel runner. The work is almost all waiting (timeouts and | |
| # sleeps; only ~16% CPU even when packed), so oversubscribe: ~6 shards | |
| # per CPU below, run 2 per CPU at once (--threads), so several overlap | |
| # their waits (bigger runners get proportionally more). Each shard runs | |
| # a round-robin slice of the tests ($SHARD/$SHARDS) in its own bwrap | |
| # network namespace (no port collisions) and its own build-dir copy. | |
| # ${tests:-0} keeps a shard that drew no test numbers a no-op (test 0 | |
| # matches nothing) instead of letting test.sh fall back to running the | |
| # whole suite. | |
| # | |
| # bwrap --unshare-net gives each shard a fresh netns with loopback up | |
| # but IPv4-only; re-create IPv6 loopback (CAP_NET_ADMIN is granted by | |
| # the runner) so the suite's ::1 / dual-stack tests work as in the host | |
| # namespace. fc00::1 and 192.0.2.1 are non-loopback placeholders so | |
| # glibc's AI_ADDRCONFIG still returns IPv6/IPv4: with only loopback | |
| # configured it drops the family, and socat's getaddrinfo then fails on | |
| # numeric non-loopback addresses (e.g. the multicast tests). Best-effort | |
| # (|| true), errors left visible so a runner without IPv6 still runs the | |
| # IPv4 tests and any failure stays diagnosable in the log. | |
| # | |
| # The inverted OPENSSL testserversec tests run a one-shot foreground | |
| # listener with no port-wait; the background connector quits after | |
| # 2s (retry=2), and a later listener then hangs in accept() forever. | |
| # retry=30 widens the window at no cost to passing runs. timeout | |
| # makes any remaining hang fail fast with the culprit test named in | |
| # the shard output instead of stalling into the 15-min job kill. | |
| # Assert the retry=2 pattern is present first: a silent sed no-op | |
| # (upstream test.sh changed) would otherwise reintroduce the hang | |
| # while the run still looked green. | |
| cat > socat-configs.json <<'EOF' | |
| [{ | |
| "name": "socat", "build": false, "netns": true, "shards": __SHARDS__, | |
| "run": [["bash", "-c", "set -e; ip link set lo up || true; sysctl -wq net.ipv6.conf.lo.disable_ipv6=0 || true; ip addr add ::1/128 dev lo || true; ip addr add fc00::1/128 dev lo || true; ip addr add 192.0.2.1/32 dev lo || true; sysctl -wq net.ipv6.bindv6only=0 || true; cp -a \"$SOCAT_SRC/.\" .; grep -q 'fork,retry=2,' test.sh || { echo 'socat test.sh: fork,retry=2 pattern gone, retry-widen would silently no-op (upstream changed?)' >&2; exit 1; }; sed -i 's/fork,retry=2,/fork,retry=30,/' test.sh; tests=$(seq \"$SHARD\" \"$SHARDS\" 999); SOCAT=\"$PWD/socat\" SHELL=/bin/bash timeout -k 10 600 ./test.sh -t 1.0 --expect-fail \"$EXPECT_FAIL\" ${tests:-0}"]] | |
| }] | |
| EOF | |
| sed -i "s/__SHARDS__/$(( 6 * $(nproc) ))/" socat-configs.json | |
| # Run 2 shards per CPU at once: the per-shard netns isolates ports, so | |
| # the only real cost of overlap is CPU, and the suite barely uses any | |
| # (mostly waiting), so this just overlaps the waits. fail-fast (the | |
| # default) aborts the rest on the first failure. | |
| .github/scripts/parallel-make-check.py \ | |
| --threads "$(( 2 * $(nproc) ))" socat-configs.json |