Skip to content

tests: fix test_client_nofail() ignoring callback_functions CA/cert/key #11388

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
thiagodoregosousa wants to merge 3 commits into
base: master
Choose a base branch
from
Open

tests: fix test_client_nofail() ignoring callback_functions CA/cert/key #11388

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2ef7836
tests: add regression test for test_client_nofail() ignoring custom CA
thiagodoregosousa Sep 6, 2026
70df961
tests: fix test_client_nofail() ignoring callback_functions CA/cert/key
thiagodoregosousa Sep 6, 2026
e8e86e8
tests: address review: guard test registration, honor client cert/key…
thiagodoregosousa Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 69 additions & 9 deletions tests/api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8467,6 +8467,9 @@ int test_client_nofail(void* args, cbType cb)
int sharedCtx = 0;
int doUdp = 0;
const char* cipherName1, *cipherName2;
const char* caFile;
const char* certFile;
const char* keyFile;

wolfSSL_SetLoggingPrefix("client");

Expand Down Expand Up @@ -8498,6 +8501,23 @@ int test_client_nofail(void* args, cbType cb)
if (cbf != NULL)
doUdp = cbf->doUdp;

/* Extend test_server_nofail()'s existing certFile/keyFile override
* pattern (a caller-supplied callback_functions can already replace
* the server's default cert/key) to this, the client side, and to
* the CA file as well -- previously this always loaded the hardcoded
* classical defaults below regardless of what was passed in. */
caFile = caCertFile;
certFile = cliCertFile;
keyFile = cliKeyFile;
if (cbf != NULL) {
if (cbf->caPemFile != NULL)
caFile = cbf->caPemFile;
if (cbf->certPemFile != NULL)
certFile = cbf->certPemFile;
if (cbf->keyPemFile != NULL)
keyFile = cbf->keyPemFile;
Comment thread
thiagodoregosousa marked this conversation as resolved.
Resolved
}

#ifdef WOLFSSL_ENCRYPTED_KEYS
wolfSSL_CTX_set_default_passwd_cb(ctx, PasswordCallBack);
#endif
Expand All @@ -8509,27 +8529,28 @@ int test_client_nofail(void* args, cbType cb)
if (doUdp)
udp_connect(&sockfd, wolfSSLIP, ((func_args*)args)->signal->port);

if (wolfSSL_CTX_load_verify_locations(ctx, caCertFile, 0) != WOLFSSL_SUCCESS)
if (wolfSSL_CTX_load_verify_locations(ctx, caFile, 0) !=
WOLFSSL_SUCCESS)
{
/* err_sys("can't load ca file, Please run from wolfSSL home dir");*/
goto done;
}
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
if (!sharedCtx && wolfSSL_CTX_use_certificate_file(ctx, cliCertFile,
if (!sharedCtx && wolfSSL_CTX_use_certificate_file(ctx, certFile,
CERT_FILETYPE) != WOLFSSL_SUCCESS) {
#else
if (wolfSSL_CTX_use_certificate_file(ctx, cliCertFile,
if (wolfSSL_CTX_use_certificate_file(ctx, certFile,
CERT_FILETYPE) != WOLFSSL_SUCCESS) {
#endif
/*err_sys("can't load client cert file, "
"Please run from wolfSSL home dir");*/
goto done;
}
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
if (!sharedCtx && wolfSSL_CTX_use_PrivateKey_file(ctx, cliKeyFile,
if (!sharedCtx && wolfSSL_CTX_use_PrivateKey_file(ctx, keyFile,
CERT_FILETYPE) != WOLFSSL_SUCCESS) {
#else
if (wolfSSL_CTX_use_PrivateKey_file(ctx, cliKeyFile,
if (wolfSSL_CTX_use_PrivateKey_file(ctx, keyFile,
CERT_FILETYPE) != WOLFSSL_SUCCESS) {
#endif

Expand Down Expand Up @@ -8565,21 +8586,21 @@ int test_client_nofail(void* args, cbType cb)
goto done;
}
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
if (sharedCtx && wolfSSL_use_certificate_file(ssl, cliCertFile,
if (sharedCtx && wolfSSL_use_certificate_file(ssl, certFile,
CERT_FILETYPE) != WOLFSSL_SUCCESS) {
#else
if (wolfSSL_use_certificate_file(ssl, cliCertFile,
if (wolfSSL_use_certificate_file(ssl, certFile,
CERT_FILETYPE) != WOLFSSL_SUCCESS) {
#endif
/*err_sys("can't load client cert file, "
"Please run from wolfSSL home dir");*/
goto done;
}
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
if (sharedCtx && wolfSSL_use_PrivateKey_file(ssl, cliKeyFile,
if (sharedCtx && wolfSSL_use_PrivateKey_file(ssl, keyFile,
CERT_FILETYPE) != WOLFSSL_SUCCESS) {
#else
if (wolfSSL_use_PrivateKey_file(ssl, cliKeyFile,
if (wolfSSL_use_PrivateKey_file(ssl, keyFile,
CERT_FILETYPE) != WOLFSSL_SUCCESS) {
#endif
/*err_sys("can't load client key file, "
Expand Down Expand Up @@ -8742,6 +8763,42 @@ void test_wolfSSL_client_server_nofail(callback_functions* client_cb,
test_wolfSSL_client_server_nofail_ex(client_cb, server_cb, NULL);
}

#ifdef HAVE_ECC
/* Regression test: test_client_nofail() (the client half of the driver
* above) used to ignore callback_functions.caPemFile/certPemFile/keyPemFile
* and always load the default caCertFile/cliCertFile/cliKeyFile (see
* wolfssl/test.h), even though test_server_nofail() already honors the
* equivalent server-side fields. A caller setting client_cb.caPemFile was
* silently ignored and the client kept trusting the default CA. This test
* uses the ECC server cert/key (signed by the ECC test CA), which the
* default RSA CA cannot verify: before the fix, the handshake fails even
* though the correct CA was supplied. */
static int test_client_nofail_custom_ca(void)
{
EXPECT_DECLS;
callback_functions func_cb_client;
callback_functions func_cb_server;

XMEMSET(&func_cb_client, 0, sizeof(func_cb_client));
XMEMSET(&func_cb_server, 0, sizeof(func_cb_server));

func_cb_server.certPemFile = eccCertFile;
func_cb_server.keyPemFile = eccKeyFile;
func_cb_client.caPemFile = caEccCertFile;

test_wolfSSL_client_server_nofail(&func_cb_client, &func_cb_server);

ExpectIntEQ(func_cb_client.return_code, TEST_SUCCESS);
ExpectIntEQ(func_cb_server.return_code, TEST_SUCCESS);

return EXPECT_RESULT();
}
#else
static int test_client_nofail_custom_ca(void)
{
return TEST_SKIPPED;
}
#endif

#if defined(OPENSSL_EXTRA) && !defined(NO_SESSION_CACHE) && \
!defined(WOLFSSL_NO_TLS12) && !defined(NO_WOLFSSL_CLIENT)
Expand Down Expand Up @@ -47399,6 +47456,9 @@ TEST_CASE testCases[] = {
#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER)
TEST_DECL(test_wolfSSL_ERR_peek_last_error_line),
#endif
#ifdef HAVE_IO_TESTS_DEPENDENCIES
TEST_DECL(test_client_nofail_custom_ca),
#endif
#ifndef NO_BIO
TEST_DECL(test_wolfSSL_ERR_print_errors_cb),
TEST_DECL(test_wolfSSL_GetLoggingCb),
Expand Down
Loading