test-improvements

Author: lws-team

cmake/LwsCheckRequirements.cmake

@@ -155,3 +155,44 @@ function(lws_get_free_port VAR_NAME)
 
     set(${VAR_NAME} ${port} PARENT_SCOPE)
 endfunction()
+
+#
+# lws_get_free_ports(VAR_NAME COUNT)
+#
+# Like lws_get_free_port(), but reserves a contiguous block of COUNT adjacent
+# ports under the same counter lock, returning the base (lowest) port in
+# VAR_NAME.  Use this when a single test process listens on several ports at
+# once (eg, multi-stage tests that create a fresh vhost per stage), so the
+# block cannot be punched full of holes by sibling tests grabbing individual
+# ports between separate lws_get_free_port() calls in parallel CI.
+#
+function(lws_get_free_ports VAR_NAME COUNT)
+    if (WIN32)
+        set(COUNTER_FILE "$ENV{TEMP}/lws_port_counter_$ENV{USERNAME}")
+    else()
+        set(COUNTER_FILE "/tmp/lws_port_counter_$ENV{USER}")
+    endif()
+
+    file(LOCK "${COUNTER_FILE}.lock" GUARD PROCESS TIMEOUT 10)
+
+    if (EXISTS "${COUNTER_FILE}")
+        file(READ "${COUNTER_FILE}" port)
+        string(STRIP "${port}" port)
+    else()
+        set(port 15000)
+    endif()
+
+    if (port GREATER 30000)
+        set(port 15000)
+    endif()
+
+    set(${VAR_NAME} ${port} PARENT_SCOPE)
+
+    math(EXPR next_port "${port} + ${COUNT}")
+    if (next_port GREATER 30000)
+        set(next_port 15000)
+    endif()
+    file(WRITE "${COUNTER_FILE}" "${next_port}")
+
+    file(LOCK "${COUNTER_FILE}.lock" RELEASE)
+endfunction()

lib/tls/openhitls/openhitls-server.c

@@ -505,13 +505,22 @@ lws_tls_server_abort_connection(struct lws *wsi)
 	/*
 	 * HITLS_Close() (called from __lws_tls_shutdown) has been observed to
 	 * corrupt heap metadata.  Skip it; HITLS_Free() handles full cleanup.
+	 *
+	 * The BSL_UIO was allocated by us in lws_tls_server_new_nonblocking()
+	 * and only associated (refcounted) with the HITLS_Ctx by HITLS_SetUio();
+	 * HITLS_Free() drops that association but does not free the UIO itself,
+	 * so we must BSL_UIO_Free() it.  Detach the fd first so neither
+	 * HITLS_Free() nor BSL_UIO_Free() touches the wsi-owned socket.
 	 */
 	uio = HITLS_GetUio(wsi->tls.ssl);
 	if (uio) {
 		BSL_UIO_SetFD(uio, -1);
 	}
 	HITLS_Free(wsi->tls.ssl);
 	wsi->tls.ssl = NULL;
+	if (uio) {
+		BSL_UIO_Free(uio);
+	}
 
 	return LWS_SSL_CAPABLE_DONE;
 }
@@ -1043,8 +1052,18 @@ lws_tls_vhost_backend_create_ctx(struct lws_vhost *vhost)
         return 0; /* no action */
 }
 
+/*
+ * Called by the tls ctx ref system (lws_tls_ctx_ref_destroy_all) when the
+ * server config's refcount drops to zero, and also from
+ * lws_tls_cert_updated() when retiring an old context after a hot cert
+ * update.  HITLS_Config is itself refcounted (HITLS_New up-refs it per
+ * connection, HITLS_Free down-refs), so this is safe to call from both the
+ * ref system and lws_ssl_SSL_CTX_destroy() like the OpenSSL backend does
+ * with SSL_CTX_free().
+ */
 void
 lws_tls_vhost_backend_free_ctx(lws_tls_ctx *ctx)
 {
-        /* no action */
+	if (ctx)
+		HITLS_CFG_FreeConfig((HITLS_Config *)ctx);
 }

lib/tls/openhitls/openhitls-ssl.c

@@ -476,7 +476,7 @@ lws_ssl_info_callback(const lws_tls_conn *ssl, int where, int ret)
 int
 lws_ssl_close(struct lws *wsi)
 {
-	lws_sockfd_type n;
+	lws_sockfd_type n = LWS_SOCK_INVALID;
 	BSL_UIO *uio;
 
 	if (!wsi->tls.ssl) {
@@ -496,14 +496,24 @@ lws_ssl_close(struct lws *wsi)
 	 * Get the fd before any cleanup that may invalidate it.
 	 */
 	uio = HITLS_GetUio(wsi->tls.ssl);
-	BSL_UIO_Ctrl(uio, BSL_UIO_GET_FD, sizeof(lws_sockfd_type), &n);
-
-	
+	if (uio)
+		BSL_UIO_Ctrl(uio, BSL_UIO_GET_FD, sizeof(lws_sockfd_type), &n);
 
 	if (lws_socket_is_valid(n))
 		compatible_close(n);
+	/*
+	 * Detach the fd from the UIO so neither HITLS_Free() nor BSL_UIO_Free()
+	 * can touch the (already closed) wsi-owned socket, then drop the TLS
+	 * context.  The UIO was allocated by us (in client bio create / server
+	 * new_nonblocking) and only associated with the HITLS_Ctx; HITLS_Free()
+	 * does not free it, so we must BSL_UIO_Free() it ourselves.
+	 */
+	if (uio)
+		BSL_UIO_SetFD(uio, -1);
 	HITLS_Free(wsi->tls.ssl);
 	wsi->tls.ssl = NULL;
+	if (uio)
+		BSL_UIO_Free(uio);
 	lws_tls_restrict_return(wsi);
 
 	return 1; /* handled */

minimal-examples-lowlevel/http-server/minimal-http-server-openhitls-mtls-crl/CMakeLists.txt

@@ -28,8 +28,13 @@ if (requirements)
 	#
 	# CTest configuration
 	#
+	# This test opens three server sockets (one per stage, base_port + 0..2) in
+	# a single process, so reserve a contiguous block of three rather than a
+	# single port: otherwise a sibling test can grab an individual port from
+	# inside our block in parallel CI.
+	#
 	if (NOT WIN32)
-		lws_get_free_port(PORT_OH_MTLS_CRL)
+		lws_get_free_ports(PORT_OH_MTLS_CRL 3)
 
 		add_test(NAME http-server-mtls-crl COMMAND
 			${SAMP} --port ${PORT_OH_MTLS_CRL})

minimal-examples-lowlevel/http-server/minimal-http-server-openhitls-mtls-crl/minimal-http-server-openhitls-mtls-crl.c

@@ -18,7 +18,13 @@ static struct lws_context *context;
 static struct lws *client_wsi;
 
 static int test_stage;
-static int test_port = 7780;
+/*
+ * Base listen port; each stage uses base_port + stage (stages 0..2, so a
+ * contiguous block of three).  Default preserves standalone behaviour; ctest
+ * overrides it with a CI-allocated free port via --port so parallel runs (and
+ * sibling openHiTLS server tests) can't collide.
+ */
+static int base_port = 7780;
 static int app_data_sent;
 static int app_data_received;
 static int wsi_closed;
@@ -105,7 +111,7 @@ static struct lws_context* create_context_for_stage(int stage)
 
 	info.options = LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
 	info.protocols = protocols;
-	info.port = test_port + stage;
+	info.port = base_port + stage;
 
 	switch (stage) {
 		case 0:
@@ -153,13 +159,24 @@ static void sigint_handler(int sig)
 
 int main(int argc, const char **argv)
 {
+	const char *p;
 	int n = 0;
 	int idx;
 
 	signal(SIGINT, sigint_handler);
 
 	lws_set_log_level(LLL_USER | LLL_ERR | LLL_WARN, NULL);
-	lwsl_user("LWS TLS12 mTLS with CRL test\n");
+
+	/*
+	 * ctest passes --port allocated by lws_get_free_ports(3) so the whole
+	 * base_port + 0..2 block is reserved and parallel runs can't tread on each
+	 * other or sibling tests.  Default keeps the original standalone range.
+	 */
+	p = lws_cmdline_option(argc, argv, "--port");
+	if (p)
+		base_port = atoi(p);
+
+	lwsl_user("LWS TLS12 mTLS with CRL test (base port %d)\n", base_port);
 	lwsl_user("Stage 0: Using NORMAL server cert + client cert required\n");
 
 	context = create_context_for_stage(test_stage);
@@ -172,7 +189,7 @@ int main(int argc, const char **argv)
 	struct lws_client_connect_info i;
 	memset(&i, 0, sizeof(i));
 	i.context = context;
-	i.port = test_port;
+	i.port = base_port;
 	i.address = "localhost";
 	i.ssl_connection = LCCSCF_USE_SSL |
 			   LCCSCF_ALLOW_SELFSIGNED |
@@ -225,7 +242,7 @@ int main(int argc, const char **argv)
 
 				memset(&i, 0, sizeof(i));
 				i.context = context;
-				i.port = test_port + test_stage;
+				i.port = base_port + test_stage;
 				i.address = "localhost";
 				i.ssl_connection = LCCSCF_USE_SSL |
 						   LCCSCF_ALLOW_SELFSIGNED |
@@ -260,13 +277,12 @@ int main(int argc, const char **argv)
 	lwsl_user("========================================\n");
 
 cleanup:
-	/*
-	 * openHiTLS currently traps in context teardown when a client and
-	 * embedded TLS server share the same context.  The test verdict is
-	 * known when the loop exits, so allow process exit to reclaim it.
-	 */
-	(void)all_contexts;
-	(void)idx;
+	for (idx = 0; idx < num_contexts; idx++) {
+		if (all_contexts[idx]) {
+			lws_context_destroy(all_contexts[idx]);
+			all_contexts[idx] = NULL;
+		}
+	}
 
 	return bad;
 }

minimal-examples-lowlevel/http-server/minimal-http-server-openhitls-sni-mismatch/CMakeLists.txt

@@ -28,8 +28,13 @@ if (requirements)
 	#
 	# CTest configuration
 	#
+	# This test opens four server sockets (one per stage, base_port + 0..3) in a
+	# single process, so reserve a contiguous block of four rather than a single
+	# port: otherwise a sibling test can grab an individual port from inside our
+	# block in parallel CI.
+	#
 	if (NOT WIN32)
-		lws_get_free_port(PORT_OH_SNI_MISMATCH)
+		lws_get_free_ports(PORT_OH_SNI_MISMATCH 4)
 
 		add_test(NAME http-server-sni-mismatch COMMAND
 			${SAMP} --port ${PORT_OH_SNI_MISMATCH})

minimal-examples-lowlevel/http-server/minimal-http-server-openhitls-sni-mismatch/minimal-http-server-openhitls-sni-mismatch.c

@@ -31,12 +31,12 @@ static const char *expected_cert_cn[] = {
 	"localhost"   /* Stage 3: no sni vhost, default cert */
 };
 
-static int test_ports[] = {
-	7781,  /* Stage 0 */
-	7782,  /* Stage 1 */
-    7783,  /* Stage 2 */
-    7784   /* Stage 3 */
-};
+/*
+ * Base listen port; each stage uses base_port + stage.  Default preserves
+ * standalone behaviour; ctest overrides it with a CI-allocated free port via
+ * --port so parallel runs (and sibling openHiTLS server tests) can't collide.
+ */
+static int base_port = 7781;
 static const struct lws_protocols protocols[];
 
 struct pss_sni_server {
@@ -189,27 +189,32 @@ create_context_for_stage(int stage)
         case 0:
             /* Stage 0: vhost="nosni.com" with default cert */
             lwsl_user("Stage 0: Creating vhost 'nosni.com' with default cert\n");
-            vh = create_vhost_with_sni(context, test_ports[0], "nosni.com",
+            vh = create_vhost_with_sni(context, base_port + 0, "nosni.com",
                               "certs/default.pem", "certs/default.key");
             break;
         case 1:
             /* Stage 1: vhost="sni.com" with sni.com cert */
             lwsl_user("Stage 1: Creating vhost 'sni.com' with sni.com cert\n");
-            vh = create_vhost_with_sni(context, test_ports[1], "sni.com",
+            vh = create_vhost_with_sni(context, base_port + 1, "sni.com",
                               "certs/sni.pem", "certs/sni.key");
             break;
         case 2:
             /* Stage 2: vhost="sni.com" with default cert */
             lwsl_user("Stage 2: Creating vhost 'sni.com' with default cert\n");
-            vh = create_vhost_with_sni(context, test_ports[2], "sni.com",
+            vh = create_vhost_with_sni(context, base_port + 2, "sni.com",
                               "certs/default.pem", "certs/default.key");
             break;
         case 3:
             /* Stage 3: no SNI vhost at all, only default vhost */
             lwsl_user("Stage 3: Creating default vhost 'localhost' (no SNI vhost)\n");
-            vh = create_vhost_with_sni(context, test_ports[3], "localhost",
+            vh = create_vhost_with_sni(context, base_port + 3, "localhost",
                               "certs/default.pem", "certs/default.key");
             break;
+        default:
+            /* stage is bounded to 0..3 by the caller; reject anything else */
+            lwsl_err("Stage %d: invalid stage\n", stage);
+            lws_context_destroy(context);
+            return NULL;
     }
 
     if (!vh) {
@@ -228,7 +233,7 @@ connect_to_stage(int stage)
 
     memset(&i, 0, sizeof(i));
     i.context = context;
-    i.port = test_ports[stage];
+    i.port = base_port + stage;
     i.address = "localhost";
     i.ssl_connection = LCCSCF_USE_SSL |
                    LCCSCF_ALLOW_SELFSIGNED |
@@ -254,13 +259,24 @@ connect_to_stage(int stage)
 
 int main(int argc, const char **argv)
 {
+    const char *p;
     int n = 0;
     int stage;
 
     signal(SIGINT, sigint_handler);
 
     lws_set_log_level(LLL_USER | LLL_ERR | LLL_WARN, NULL);
-    lwsl_user("LWS SNI Test - 4 Scenarios\n\n");
+
+    /*
+     * ctest passes --port allocated by lws_get_free_ports(4) so the whole
+     * base_port + 0..3 block is reserved and parallel runs can't tread on each
+     * other or sibling tests.  Default keeps the original standalone range.
+     */
+    p = lws_cmdline_option(argc, argv, "--port");
+    if (p)
+	    base_port = atoi(p);
+
+    lwsl_user("LWS SNI Test - 4 Scenarios (base port %d)\n\n", base_port);
 
     /* Test all 4 stages */
     for (stage = 0; stage < 4 && !bad && !interrupted; stage++) {
@@ -295,12 +311,7 @@ int main(int argc, const char **argv)
 
         lwsl_user("Stage %d: Completed\n\n", stage);
 
-        /*
-         * openHiTLS currently traps in context teardown when a client
-         * and embedded TLS server share the same context.  The test
-         * verdict is known when the loop exits, so allow process exit
-         * to reclaim it.
-         */
+        lws_context_destroy(context);
     }
 
     lwsl_user("========================================\n");

minimal-examples-lowlevel/http-server/minimal-http-server-openhitls-tls13/minimal-http-server-openhitls-tls13.c

@@ -280,11 +280,7 @@ int main(int argc, const char **argv)
 	lwsl_user("Bytes received: %zu\n", received_len);
 	lwsl_user("========================================\n");
 
-	/*
-	 * openHiTLS currently traps in context teardown when a client and
-	 * embedded TLS server share the same context.  The test verdict is
-	 * known when the loop exits, so allow process exit to reclaim it.
-	 */
+	lws_context_destroy(context);
 
 	return bad;
 }