Skip to content

Commit 7e9f9dc

Browse files
sebastian-carpentersebastian-carpenter
committed
refactor openssl-ech workflow + add suite testing
1 parent 8445493 commit 7e9f9dc

4 files changed

Lines changed: 265 additions & 117 deletions

File tree

‎.github/scripts/openssl-ech.sh‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
cleanup() {
6+
cat "$TMP_LOG"
7+
rm -f "$TMP_LOG"
8+
}
9+
trap cleanup EXIT
10+
11+
usage() {
12+
echo "Usage: $0 <client|server> [--suite <KEM,KDF,AEAD>] [--workspace <path>]"
13+
exit 1
14+
}
15+
16+
MODE=""
17+
SUITE=""
18+
19+
WORKSPACE=${GITHUB_WORKSPACE:-"."}
20+
21+
if [ $# -lt 1 ]; then
22+
usage
23+
fi
24+
25+
case "$1" in
26+
client|server) MODE="$1" ;;
27+
*) usage ;;
28+
esac
29+
shift
30+
31+
while [ $# -gt 0 ]; do
32+
case "$1" in
33+
--suite)
34+
[ -z "$2" ] && { echo "ERROR: --suite requires a value"; exit 1; }
35+
SUITE="$2"
36+
shift 2
37+
echo ""
38+
echo "Using suite: $SUITE"
39+
echo ""
40+
;;
41+
--workspace)
42+
[ -z "$2" ] && { echo "ERROR: --workspace requires a value"; exit 1; }
43+
WORKSPACE="$2"
44+
shift 2
45+
;;
46+
*) echo "Unknown argument: $1"; usage ;;
47+
esac
48+
done
49+
50+
OPENSSL=${OPENSSL:-"openssl"}
51+
WOLFSSL_CLIENT=${WOLFSSL_CLIENT:-"$WORKSPACE/examples/client/client"}
52+
WOLFSSL_SERVER=${WOLFSSL_SERVER:-"$WORKSPACE/examples/server/server"}
53+
CERT_DIR=${CERT_DIR:-"$WORKSPACE/certs"}
54+
55+
TMP_LOG="$WORKSPACE/tmp_file.log"
56+
PRIV_NAME="ech-private-name.com"
57+
PUB_NAME="ech-public-name.com"
58+
MAX_WAIT=50
59+
60+
openssl_server(){
61+
local ech_file="$WORKSPACE/ech_config.pem"
62+
local ech_config=""
63+
local port=""
64+
65+
rm -f "$ech_file"
66+
67+
$OPENSSL ech -public_name "$PUB_NAME" -out "$ech_file" $SUITE &>> "$TMP_LOG"
68+
69+
# parse ECH config from file
70+
ech_config=$(sed -n '/BEGIN ECHCONFIG/,/END ECHCONFIG/{/BEGIN ECHCONFIG\|END ECHCONFIG/d;p}' "$ech_file" | tr -d '\n')
71+
echo "parsed ech config: $ech_config" &>> "$TMP_LOG"
72+
73+
# start OpenSSL ECH server with ephemeral port and make sure it is
74+
# line-buffered
75+
stdbuf -oL $OPENSSL s_server \
76+
-tls1_3 \
77+
-cert "$CERT_DIR/server-cert.pem" \
78+
-key "$CERT_DIR/server-key.pem" \
79+
-cert2 "$CERT_DIR/server-cert.pem" \
80+
-key2 "$CERT_DIR/server-key.pem" \
81+
-ech_key "$ech_file" \
82+
-servername "$PRIV_NAME" \
83+
-accept 0 \
84+
-naccept 1 \
85+
&>> "$TMP_LOG" <<< "wolfssl!" &
86+
87+
# wait for server port to be ready and capture it
88+
counter=0
89+
while [ -z "$port" ]; do
90+
port=$(grep -m1 "ACCEPT" "$TMP_LOG" | sed 's/.*:\([0-9]*\)$/\1/')
91+
sleep 0.1
92+
counter=$((counter + 1))
93+
if [ "$counter" -gt "$MAX_WAIT" ]; then
94+
echo "ERROR: server port not found" &>> "$TMP_LOG"
95+
exit 1
96+
fi
97+
done
98+
echo "parsed port: $port" &>> "$TMP_LOG"
99+
100+
# test with wolfssl client
101+
$WOLFSSL_CLIENT -v 4 \
102+
-p "$port" \
103+
-S "$PRIV_NAME" \
104+
--ech "$ech_config" \
105+
&>> "$TMP_LOG"
106+
107+
rm -f "$ech_file"
108+
109+
grep -q "ech_success=1" "$TMP_LOG"
110+
}
111+
112+
openssl_client(){
113+
local ready_file="$WORKSPACE/wolfssl_tls13_ready$$"
114+
local ech_config=""
115+
local port=0
116+
117+
rm -f "$ready_file"
118+
119+
# start server with ephemeral port + ready file
120+
# also set server to be line buffered so the log can be grepped
121+
stdbuf -oL $WOLFSSL_SERVER \
122+
-v 4 \
123+
-R "$ready_file" \
124+
-p "$port" \
125+
-S "$PRIV_NAME" \
126+
--ech "$PUB_NAME" \
127+
$SUITE \
128+
&>> "$TMP_LOG" &
129+
130+
# wait for server to be ready, then get port
131+
counter=0
132+
while [ ! -s "$ready_file" ]; do
133+
sleep 0.1
134+
counter=$((counter + 1))
135+
if [ "$counter" -gt "$MAX_WAIT" ]; then
136+
echo "ERROR: no ready file" &>> "$TMP_LOG"
137+
exit 1
138+
fi
139+
done
140+
port="$(cat "$ready_file")"
141+
rm -f "$ready_file"
142+
echo "parsed port: $port" &>> "$TMP_LOG"
143+
144+
# get ECH config from server
145+
counter=0
146+
while [ -z "$ech_config" ]; do
147+
ech_config=$(grep -m1 "ECH config (base64): " "$TMP_LOG" \
148+
2>/dev/null | sed 's/ECH config (base64): //g')
149+
sleep 0.1
150+
counter=$((counter + 1))
151+
if [ "$counter" -gt "$MAX_WAIT" ]; then
152+
echo "ERROR: no ECH configs" &>> "$TMP_LOG"
153+
exit 1
154+
fi
155+
done
156+
echo "parsed ech config: $ech_config" &>> "$TMP_LOG"
157+
158+
# Test with OpenSSL s_client using ECH
159+
echo "wolfssl" | $OPENSSL s_client \
160+
-tls1_3 \
161+
-connect "localhost:$port" \
162+
-cert "$CERT_DIR/client-cert.pem" \
163+
-key "$CERT_DIR/client-key.pem" \
164+
-CAfile "$CERT_DIR/ca-cert.pem" \
165+
-servername "$PRIV_NAME" \
166+
-ech_config_list "$ech_config" \
167+
&>> "$TMP_LOG"
168+
169+
grep -q "ECH: success: 1" "$TMP_LOG"
170+
}
171+
172+
rm -f "$TMP_LOG"
173+
174+
case "$MODE" in
175+
server)
176+
if [ -n "$SUITE" ]; then
177+
SUITE="-suite $SUITE"
178+
fi
179+
openssl_server
180+
;;
181+
client)
182+
if [ -n "$SUITE" ]; then
183+
SUITE="--ech-suite $SUITE"
184+
fi
185+
openssl_client
186+
;;
187+
*)
188+
exit 1
189+
;;
190+
esac

‎.github/workflows/openssl-ech.yml‎

Lines changed: 20 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ jobs:
2323
uses: wolfSSL/actions-build-autotools-project@v1
2424
with:
2525
path: wolfssl
26-
configure: --enable-ech CFLAGS='-DUSE_FLAT_TEST_H'
26+
configure: >-
27+
--enable-ech --enable-sha512 --enable-aes CFLAGS='-DUSE_FLAT_TEST_H'
2728
install: true
2829

2930
- name: tar build-dir
@@ -38,6 +39,10 @@ jobs:
3839
cp -r "$GITHUB_WORKSPACE/wolfssl/certs" build-dir/certs
3940
tar -zcf build-dir.tgz build-dir
4041
42+
# need the ech script to run tests
43+
cp "$GITHUB_WORKSPACE/wolfssl/.github/scripts/openssl-ech.sh" \
44+
build-dir/openssl-ech.sh
45+
4146
- name: Upload built wolfSSL
4247
uses: actions/upload-artifact@v4
4348
with:
@@ -117,76 +122,23 @@ jobs:
117122
118123
export LD_LIBRARY_PATH="$GITHUB_WORKSPACE/openssl-install/lib64:$GITHUB_WORKSPACE/openssl-install/lib:$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH"
119124
120-
OPENSSL=$GITHUB_WORKSPACE/openssl-install/bin/openssl
121-
WOLFSSL_SERVER=$GITHUB_WORKSPACE/build-dir/bin/server
122-
125+
OPENSSL="$GITHUB_WORKSPACE/openssl-install/bin/openssl"
126+
WOLFSSL_SERVER="$GITHUB_WORKSPACE/build-dir/bin/server"
123127
CERT_DIR="$GITHUB_WORKSPACE/build-dir/certs"
124-
READY_FILE="$GITHUB_WORKSPACE/wolfssl_tls13_ready$$"
125128
LOG_FILE="$GITHUB_WORKSPACE/log_file.log"
126-
PRIV_NAME="ech-private-name.com"
127-
PUB_NAME="ech-public-name.com"
128-
ECH_CONFIG=""
129-
PORT=0
130-
131-
rm -f "$READY_FILE"
132129
133130
# need to cd into build-dir so the certs/ dir is available for server
134131
cd build-dir
135132
136133
$OPENSSL version | tee "$LOG_FILE"
137134
138-
# start server with ephemeral port + ready file
139-
# also set server to be line buffered so the log can be grepped
140-
stdbuf -oL $WOLFSSL_SERVER \
141-
-v 4 \
142-
-R "$READY_FILE" \
143-
-p "$PORT" \
144-
-S "$PRIV_NAME" \
145-
--ech "$PUB_NAME" \
146-
&>> "$LOG_FILE" &
147-
148-
# wait for server to be ready, then get port
149-
counter=0
150-
while [ ! -s "$READY_FILE" ]; do
151-
sleep 0.1
152-
counter=$((counter + 1))
153-
if [ "$counter" -gt 50 ]; then
154-
echo "ERROR: no ready file" &>> "$LOG_FILE"
155-
exit 1
156-
fi
157-
done
158-
PORT="$(cat "$READY_FILE")"
159-
echo "parsed port: $PORT" &>> "$LOG_FILE"
160-
161-
# get ECH config from server
162-
counter=0
163-
while [ -z "$ECH_CONFIG" ]; do
164-
ECH_CONFIG=$(grep -m1 "ECH config (base64): " "$LOG_FILE" \
165-
2>/dev/null | sed 's/ECH config (base64): //g')
166-
sleep 0.1
167-
counter=$((counter + 1))
168-
if [ "$counter" -gt 50 ]; then
169-
echo "ERROR: no ECH configs" &>> "$LOG_FILE"
170-
exit 1
171-
fi
172-
done
173-
echo "parsed ech config: $ECH_CONFIG" &>> "$LOG_FILE"
174-
175-
# Test with OpenSSL s_client using ECH
176-
echo "wolfssl" | $OPENSSL s_client \
177-
-tls1_3 \
178-
-connect "localhost:$PORT" \
179-
-cert "$CERT_DIR/client-cert.pem" \
180-
-key "$CERT_DIR/client-key.pem" \
181-
-CAfile "$CERT_DIR/ca-cert.pem" \
182-
-servername "$PRIV_NAME" \
183-
-ech_config_list "$ECH_CONFIG" \
184-
&>> "$LOG_FILE"
185-
186-
grep "ECH: success: 1" "$LOG_FILE"
135+
# default suite (DHKEM_X25519_HKDF_SHA256, HKDF_SHA256, HPKE_AES_128_GCM)
136+
bash ./openssl-ech.sh client &>> "$LOG_FILE"
137+
138+
# weird suite (DHKEM_P521_HKDF_SHA512, HKDF_SHA256, HPKE_AES_256_GCM)
139+
bash ./openssl-ech.sh client --suite "18,3,2" &>> "$LOG_FILE"
187140
188141
# cleanup
189-
rm -f "$READY_FILE"
190142
rm -f "$LOG_FILE"
191143
192144
- name: Print debug info on failure
@@ -238,69 +190,24 @@ jobs:
238190
239191
export LD_LIBRARY_PATH="$GITHUB_WORKSPACE/openssl-install/lib64:$GITHUB_WORKSPACE/openssl-install/lib:$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH"
240192
241-
OPENSSL=$GITHUB_WORKSPACE/openssl-install/bin/openssl
242-
WOLFSSL_CLIENT=$GITHUB_WORKSPACE/build-dir/bin/client
243-
193+
OPENSSL="$GITHUB_WORKSPACE/openssl-install/bin/openssl"
194+
WOLFSSL_CLIENT="$GITHUB_WORKSPACE/build-dir/bin/client"
244195
CERT_DIR="$GITHUB_WORKSPACE/build-dir/certs"
245196
LOG_FILE="$GITHUB_WORKSPACE/log_file.log"
246-
ECH_FILE="$GITHUB_WORKSPACE/ech_config.pem"
247-
PRIV_NAME="ech-private-name.com"
248-
PUB_NAME="ech-public-name.com"
249-
PORT=""
250-
ECH_CONFIG=""
251-
252-
rm -f "$ECH_FILE"
253197
254198
# need to cd into build-dir so the certs/ dir is available for client
255199
cd build-dir
256200
257201
$OPENSSL version | tee "$LOG_FILE"
258202
259-
$OPENSSL ech -public_name "$PUB_NAME" -out "$ECH_FILE" &>> "$LOG_FILE"
260-
261-
# parse ECH config from file
262-
ECH_CONFIG=$(sed -n '/BEGIN ECHCONFIG/,/END ECHCONFIG/{/BEGIN ECHCONFIG\|END ECHCONFIG/d;p}' "$ECH_FILE" | tr -d '\n')
263-
echo "parsed ech config: $ECH_CONFIG" &>> "$LOG_FILE"
264-
265-
# start OpenSSL ECH server with ephemeral port and make sure it is
266-
# line-buffered
267-
stdbuf -oL $OPENSSL s_server \
268-
-tls1_3 \
269-
-cert "$CERT_DIR/server-cert.pem" \
270-
-key "$CERT_DIR/server-key.pem" \
271-
-cert2 "$CERT_DIR/server-cert.pem" \
272-
-key2 "$CERT_DIR/server-key.pem" \
273-
-ech_key "$ECH_FILE" \
274-
-servername "$PRIV_NAME" \
275-
-accept 0 \
276-
-naccept 1 \
277-
&>> "$LOG_FILE" <<< "wolfssl!" &
278-
279-
# wait for server port to be ready and capture it
280-
counter=0
281-
while [ -z "$PORT" ]; do
282-
PORT=$(grep -m1 "ACCEPT" "$LOG_FILE" | sed 's/.*:\([0-9]*\)$/\1/')
283-
sleep 0.1
284-
counter=$((counter + 1))
285-
if [ "$counter" -gt 50 ]; then
286-
echo "ERROR: server port not found" &>> "$LOG_FILE"
287-
exit 1
288-
fi
289-
done
290-
echo "parsed port: $PORT" &>> "$LOG_FILE"
291-
292-
# test with wolfssl client
293-
$WOLFSSL_CLIENT -v 4 \
294-
-p "$PORT" \
295-
-S "$PRIV_NAME" \
296-
--ech "$ECH_CONFIG" \
297-
&>> "$LOG_FILE"
298-
299-
grep "ech_success=1" "$LOG_FILE"
203+
# default suite (DHKEM_X25519_HKDF_SHA256, HKDF_SHA256, HPKE_AES_128_GCM)
204+
bash ./openssl-ech.sh server &>> "$LOG_FILE"
205+
206+
# weird suite (DHKEM_P521_HKDF_SHA512, HKDF_SHA256, HPKE_AES_256_GCM)
207+
bash ./openssl-ech.sh server --suite "18,3,2" &>> "$LOG_FILE"
300208
301209
# cleanup
302210
rm -f "$LOG_FILE"
303-
rm -f "$ECH_FILE"
304211
305212
- name: Print debug info on failure
306213
if: ${{ failure() }}

0 commit comments

Comments
 (0)