Docker environment for run tests + enhancement for ssl_handshake

diff --git a/.gitignore b/.gitignore
index d0c69f81d2e96cf09541fbb5f3d1ab25e5308603..ddd7349675af01e4b9b7855da4cd673ee832a923 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -56,3 +56,4 @@
 /testdata/.perfstats.txt
 /doc/html
 /doc/xml
+.idea

diff --git a/Dockerfile b/Dockerfile
new file mode 100644 (file)
index 0000000..417dacc
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,11 @@
+FROM gcc:latest
+WORKDIR /usr/src/unbound
+RUN apt-get update
+# install semantic parser & lexical analyzer
+RUN apt-get install -y bison flex
+# install packages used in tests
+RUN apt-get install -y ldnsutils dnsutils xxd splint doxygen netcat
+# accept short rsa keys, which are used in tests
+RUN sed -i 's/SECLEVEL=2/SECLEVEL=1/g' /usr/lib/ssl/openssl.cnf
+
+CMD ["/bin/bash"]

diff --git a/Makefile.in b/Makefile.in
index 476545ea90411d92c96316ce2e25dbe73ddb5b89..3f2e9312b426ca6823b96780a1adb7d8ae86ed48 100644 (file)
--- a/Makefile.in
+++ b/Makefile.in
@@ -85,6 +85,8 @@ LINTFLAGS+=@NETBSD_LINTFLAGS@
 LINTFLAGS+="-Dsigset_t=long"
 # FreeBSD
 LINTFLAGS+="-D__uint16_t=uint16_t" "-DEVP_PKEY_ASN1_METHOD=int" "-D_RuneLocale=int" "-D__va_list=va_list" "-D__uint32_t=uint32_t" "-D_Alignof(x)=x" "-D__aligned(x)=" "-D__requires_exclusive(x)=" "-D__requires_unlocked(x)=" "-D__locks_exclusive(x)=" "-D__trylocks_exclusive(x)="  "-D__unlocks(x)=" "-D__locks_shared(x)=" "-D__trylocks_shared(x)="
+# GCC Docker
+LINTFLAGS+=@GCC_DOCKER_LINTFLAGS@
 
 INSTALL=$(SHELL) $(srcdir)/install-sh
 

diff --git a/configure b/configure
index 7e722b59eaf3ce59b7b8120a3eaf4a1f607cc054..57f8094a3d4fa4c36facfe9027050e819c9ca40b 100755 (executable)
--- a/configure
+++ b/configure
@@ -683,6 +683,7 @@ HAVE_SSL
 PC_CRYPTO_DEPENDENCY
 CONFIG_DATE
 NETBSD_LINTFLAGS
+GCC_DOCKER_LINTFLAGS
 PYUNBOUND_UNINSTALL
 PYUNBOUND_INSTALL
 PYUNBOUND_TARGET
@@ -17888,6 +17889,11 @@ if test "`uname`" = "NetBSD"; then
        NETBSD_LINTFLAGS='"-D__RENAME(x)=" -D_NETINET_IN_H_'
 
 fi
+
+if test "`uname -o`" = "GNU/Linux"; then
+       # splint cannot parse modern c99 header files
+       GCC_DOCKER_LINTFLAGS='-syntax'
+fi
 CONFIG_DATE=`date +%Y%m%d`
 
 

diff --git a/doc/README.tests b/doc/README.tests
index 5385e2b2221f7537a77bdad78988d65bee983261..122bf02f3fd8fd051eaf3c901ebfdeaba81881da 100644 (file)
--- a/doc/README.tests
+++ b/doc/README.tests
@@ -15,6 +15,14 @@ You need to have the following programs installed and in your PATH.
 * xxd and nc (optional) - for (malformed) packet transmission.
 The optional programs are detected and can be omitted.
 
+You can also use prepared Dockerfile to run tests inside docker based on latest gcc image:
+* build container: docker build -t unbound-tester .
+* run container: docker run -it --mount type=bind,source="$(pwd)",target=/usr/src/unbound --rm unbound-tester
+* configure environment: ./configure
+* run test: make test
+* run long tests: make longtest
+It is worth to mention that you need to enable [ipv6 in your docker daemon configuration](https://docs.docker.com/config/daemon/ipv6/) because some tests need ipv6 network stack.
+
 testdata/ contains the data for tests. 
 testcode/ contains scripts and c code for the tests.
 

diff --git a/testcode/petal.c b/testcode/petal.c
index 123684aab52da2a578065e01ed0127c0f71f9865..78f1ca2f57309058a407a28c2202a6febb06eef5 100644 (file)
--- a/testcode/petal.c
+++ b/testcode/petal.c
@@ -220,8 +220,11 @@ read_http_headers(SSL* ssl, char* file, size_t flen, char* host, size_t hlen,
        host[0] = 0;
        while(read_ssl_line(ssl, buf, sizeof(buf))) {
                if(verb>=2) printf("read: %s\n", buf);
-               if(buf[0] == 0)
+               if(buf[0] == 0) {
+                       int e = ERR_peek_error();
+                       printf("error string: %s\n", ERR_reason_error_string(e));
                        return 1;
+               }
                if(!process_one_header(buf, file, flen, host, hlen, vs))
                        return 0;
        }
@@ -238,8 +241,11 @@ setup_ctx(char* key, char* cert)
        (void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
 #endif
        (void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3);
-       if(!SSL_CTX_use_certificate_chain_file(ctx, cert))
+       if(!SSL_CTX_use_certificate_chain_file(ctx, cert)) {
+               int e = ERR_peek_error();
+               printf("error string: %s\n", ERR_reason_error_string(e));
                print_exit("cannot read cert");
+       }
        if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM))
                print_exit("cannot read key");
        if(!SSL_CTX_check_private_key(ctx))

diff --git a/testdata/fwd_zero.tdir/fwd_zero.test b/testdata/fwd_zero.tdir/fwd_zero.test
index 87a2dec9c323534abcb69a7cb12b38113ab79ee1..2e0806d6f401779b70886771582b50d2d76bd289 100644 (file)
--- a/testdata/fwd_zero.tdir/fwd_zero.test
+++ b/testdata/fwd_zero.tdir/fwd_zero.test
@@ -7,7 +7,7 @@
 PRE="../.."
 
 OPT="-i"
-if nc -h 2>&1 | grep -- "-w secs" >/dev/null; then
+if nc -h 2>&1 | grep -E -- "-w (timeout|secs)" >/dev/null; then
         OPT="-w"
 fi
 

diff --git a/util/iana_ports.inc b/util/iana_ports.inc
index f928d066947a2d8d261e55c0f59187fc2a3b96fd..b93af015da6fb8f4b72b0d7213c95532f099d1a2 100644 (file)
--- a/util/iana_ports.inc
+++ b/util/iana_ports.inc
@@ -4244,6 +4244,7 @@
 5504,
 5505,
 5506,
+5540,
 5553,
 5554,
 5555,

diff --git a/util/netevent.c b/util/netevent.c
index 01e44c9b6f301163189bb267fdfe7e400a3f922d..b1cc995c0ced2ee7532f0abc7f3f18151ee9e57f 100644 (file)
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -1232,6 +1232,13 @@ ssl_handshake(struct comm_point* c)
                if(want == SSL_ERROR_WANT_READ) {
                        if(c->ssl_shake_state == comm_ssl_shake_read)
                                return 1;
+                       /* According to https://www.openssl.org/docs/man1.1.1/man3/SSL_do_handshake.html
+                        * we should repeat handshake - for non blocking BIO
+                        */
+                       if(c->ssl_shake_state == comm_ssl_shake_write) {
+                           comm_point_listen_for_rw(c, 0, 1);
+                           return 1;
+                       }
                        c->ssl_shake_state = comm_ssl_shake_read;
                        comm_point_listen_for_rw(c, 1, 0);
                        return 1;