summaryrefslogtreecommitdiffstats
path: root/test/recipes (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Update copyright yearMatt Caswell2021-04-0816-16/+16
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
* test/recipes/02-test_errstr.t: Do not test negative system error codesRichard Levitte2021-04-071-0/+4
| | | | | | | | | | | | It's been deemed unlikely that these will end up in OpenSSL error records, so we simply don't test them if they happen to be among the error codes that perl has support for. Fixes #14763 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14779)
* 80-test_cmp_http.t: Add diagnostic info on starting/stopping mock serverDr. David von Oheimb2021-03-311-1/+6
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14630)
* Fix change in behaviour of EVP_PKEY_CTRL_RSA_KEYGEN_BITSMatt Caswell2021-03-301-1/+1
| | | | | | | | | | | | | | | | | In 1.1.1 the ctrl EVP_PKEY_CTRL_RSA_KEYGEN_BITS would fail immediately if the number of bits was too small. In 3.0 it always succeeds, and only fails later during the key generation stage. We fix that so that it fails early like it used to in 1.1.1. Note that in 1.1.1 it fails with a -2 return code. That is not the case in 3.0 and has not been addressed here (see #14442) Fixes #14443 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14702)
* Merge OFB encrypt and decrypt test vectors.David Benjamin2021-03-301-102/+3
| | | | | | | | | | | There's no point in specifying them separately, since they're the same. Also the OFB-AES192.Decrypt vectors specified the wrong operation, so we were running some encryption tests twice and missing some decryption tests. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14625)
* Disable cmp_http test on AIXShane Lontis2021-03-281-2/+2
| | | | | | | | | | AIX has permission problems of the form: lsof: can't open /dev/mem: Permission denied lsof: can't open /dev/kmem: Permission denied Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14692)
* TEST: Cleanup test recipesRichard Levitte2021-03-2770-15/+19
| | | | | | | | Name mixups cleared, and a few more test case result files that arent't removed, making forensics on failed tests easier. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14505)
* Make the SM2 group the default group for the SM2 algorithmTomas Mraz2021-03-261-0/+9
| | | | | | | | | Fixes #14481 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14684)
* Remove the external BoringSSL testTomas Mraz2021-03-261-30/+0
| | | | | | | Fixes #14424 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14682)
* Add a test for CVE-2021-3449Matt Caswell2021-03-251-1/+35
| | | | | | | | | We perform a reneg handshake, where the second ClientHello drops the sig_algs extension. It must also contain cert_sig_algs for the test to work. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
* Fix DER reading from stdin for BIO_f_readbufferShane Lontis2021-03-221-0/+29
| | | | | | | | | | | | | | | Fixes #14559 The intitial implementation of the gets() function tried using the next bio's gets() function. For a file BIO this returned incorrect data for binary data containing 0x00. Just buffering all data during gets() did not work however since some applications open and close the bio multiple times when dealing with pem files containing multiple entries.. This does not work when reading from stdin unless the data if buffered one byte at a time. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14599)
* TEST: Clarify and adjust test/recipes/30-test_evp.tRichard Levitte2021-03-191-19/+33
| | | | | | | | | | There are a few test cases at the end of test/recipes/30-test_evp.t, which are designed to check that loading DSA keys when DSA is disabled, or SM2 keys when SM2 is disables fail in an understandable way. These needed a small adjustment. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14314)
* TS and CMS CAdES-BES: Refactor check_signing_certs() funcs into common ESS funcDr. David von Oheimb2021-03-181-5/+5
| | | | | | | Also constify related CMS/PKCS7 functions and improve error codes thrown. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
* TS ESS: Invert the search logic of ts_check_signing_certs() to correctly ↵Dr. David von Oheimb2021-03-188-28/+238
| | | | | | | | | cover cert ID list Fixes #14190 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
* Add testing for non-default library context into evp_extra_testJon Spillett2021-03-171-1/+5
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14478)
* TS ESS: Let TS_RESP_verify_signature() make use of untrusted certs also from ↵Dr. David von Oheimb2021-03-131-28/+28
| | | | | | | token response Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14504)
* TEST: Stop the cleanup in test/recipes/20-test_mac.tRichard Levitte2021-03-111-7/+13
| | | | | | | | Let the files remain to make test forensics easy Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14484)
* Update copyright yearMatt Caswell2021-03-1123-23/+23
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14512)
* test: convert store test to use relative pathsPauli2021-03-111-2/+3
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14419)
* Use BIO_f_readbuffer() in the decoder to support stdin.Shane Lontis2021-03-101-1/+5
| | | | | | | | | | | | Fixes #13185 Fixes #13352 Removed the existing code in file_store that was trying to figure out the input type. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14407)
* gost_engine test: further cleanups and fixesTomas Mraz2021-03-051-13/+12
| | | | | | | | | | Allow absolute paths for $SRCTOP and $BLDTOP. Do not build the gost_engine in tree. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14416)
* gost_engine test: Run also perl and tcl testsTomas Mraz2021-03-051-12/+23
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14416)
* CI: add job with external testsTomas Mraz2021-03-051-1/+1
| | | | | | | | | | | Update gost-engine submodule. Update pyca-cryptography submodule. Fix condition for skipping krb5 test. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14416)
* test/x509: Test for issuer being overwritten when printing.Tomas Mraz2021-03-041-2/+2
| | | | | | | | | | | The regression from commit 05458fd was fixed, but there is no test for that regression. This adds it simply by having a certificate that we compare for -text output having a different subject and issuer. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14353)
* Add a new test recipe to verify the generated test fipsmodule.cnfRichard Levitte2021-03-031-0/+37
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
* TEST: Remove the build of fipsmodule.cnf from test recipesRichard Levitte2021-03-0323-207/+39
| | | | | | | | The exception is the test recipe that tests 'openssl fipsinstall'. However, that one uses a different output file name, so it's safe. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
* evp_test: updates for the new additional MAC_init argumentsPauli2021-02-283-4/+25
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14310)
* Fix -pkeyopt handling in apps/pkeyutl -rawinPetr Gotthard2021-02-221-1/+9
| | | | | | | | | | The EVP_DigestSignInit and EVP_DigestVerifyInit actually have to be initialized before EVP_PKEY_CTX_ctrl_str is invoked. Otherwise, when the ctx not initialized, the ctrl command fails. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13828)
* 81-test_cmp_cli_data: fixup on CSR test casesDr. David von Oheimb2021-02-193-9/+18
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14019)
* Fix DH ASN1 decode so that it detects named groups.Shane Lontis2021-02-193-1/+44
| | | | | | | | | | | | | | | The dh->nid was not being set if the loaded p,g matched an inbuilt named group for "DH". NOTE: The "DHX" related path already worked since it calls DH_set0_pqg() (which does the name group check). This bug was detected when new tests were added for dh5114 groups, combined with the no-cache tests i.e. loading+import+export set the nid, but just loading did not. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14207)
* Don't forget the type of thing we are loadingMatt Caswell2021-02-181-11/+48
| | | | | | | | | | | | | The apps helper function load_key_certs_crls() is a general purpose function for loading different types of objects from a given URI. It sets up an OSSL_STORE and calls OSSL_STORE_expect() so that the store knows what type of thing to expect to load. Unfortunately this wasn't working and was always setting "expect" to 0 - which means "anything". Fixes #13709 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14191)
* Update copyright yearMatt Caswell2021-02-1828-28/+28
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14235)
* dsa_check: Perform simple parameter check if seed is not availableTomas Mraz2021-02-183-5/+26
| | | | | | | | | | | | Added primality check on p and q in the ossl_ffc_params_simple_validate(). Checking for p and q sizes in the default provider is made more lenient. Added two testcases for invalid parameters. Fixes #13950 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14148)
* DSA parameter check using pkeyparamDmitry Belyavskiy2021-02-1827-0/+442
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14148)
* test: DRBG test with long seed.Pauli2021-02-171-0/+16
| | | | | | | Fixes: #14101 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14162)
* Fix the dhparam_check testMatt Caswell2021-02-158-18/+9
| | | | | | | | | | | | | | | | genpkey can sometimes create files that fail "openssl dhparam -check". See issue #14145. We had some instances of such invalid files in the dhparam_check test. Now that "openssl dhparam -check" has been fixed to work the same way as it did in 1.1.1 these tests were failing. We move the invalid files inot the "invalid" directory. A future PR will have to fix genpkey to not generate invalid files. We also remove a "SKIP" block that was skipping tests in a no deprecated build unnecessarily. Nothing being tested is deprecated. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14146)
* Change the ASN1 variant of x942kdf so that it can test acvp data.Shane Lontis2021-02-101-0/+32
| | | | | | | | | | This 'special' way of specifying the data should only be used for testing purposes. It should not be used in production environments. ACVP passes a blob of DER encoded data for some of the fields rather than passing them as separate fields that need to be DER encoded. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14077)
* Enable fipsload test on NonStop x86.Randall S. Becker2021-02-081-1/+1
| | | | | | | | | | | | CLA: Trivial Fixes: #14005 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14006)
* Stop disabling TLSv1.3 if ec and dh are disabledMatt Caswell2021-02-0520-32/+71
| | | | | | | | | | Even if EC and DH are disabled then we may still be able to use TLSv1.3 if we have groups that have been plugged in by an external provider. Fixes #13767 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* TEST: Add an algorithm ID tester for libcrypto vs providerRichard Levitte2021-02-051-0/+60
| | | | | | | | | | | | | | | | | | | Providers produce algorithm IDs of their own, and we need to compare them against the same thing produced by libcrypto's ASN.1 code and with legacy keys. This tester can compare algorithm IDs for signatures and for keys, given certificates that hold such data. To verify key algorithm IDs, only one certificate is necessary, and its public key is used. To verify certificate algorithm IDs, we need to launch the signature operation that would verify a certificate against the public key of its signing CA, so that test needs two files. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14049)
* RSA: properly generate algorithm identifier for RSA-PSS signaturesTomas Mraz2021-02-051-3/+51
| | | | | | | | | | | | | | | | | Fixes #13969 - properly handle the mandatory RSA-PSS key parameters - improve parameter checking when setting the parameters - compute the algorithm id at the time it is requested so it reflects the actual parameters set - when generating keys do not override previously set parameters with defaults - tests added to the test_req recipe that should cover the PSS signature handling Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13988)
* apps/openssl: add -propquery command line optionPetr Gotthard2021-02-052-1/+9
| | | | | | | | | | | | | | | | | Fixes #13656. Right now all openssl commands use a NULL propq. This patch adds a possibility to specify a custom propq. The implementation follows the example of set_nameopt/get_nameopt. Various tools had to be modified to call app_get0_propq after it has been populated. Otherwise the -propquery has no effect. The tests then verify the -propquery affects the tool behaviour by requesting a non-existing property. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13707)
* DH/DHX parameter check using pkeyparamDmitry Belyavskiy2021-02-0420-0/+345
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13930)
* test/recipes: split 81_test_cmp_cli.t, add test using -engine loader_atticDr. David von Oheimb2021-02-0431-286/+321
| | | | | | | | The HTTP-based tests are now in 80_test_cmp_http.t, to start a little earlier. This should decrease total test run time due to better parallelization. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13551)
* Add a multi-thread test for shared EVP_PKEYsMatt Caswell2021-02-022-3/+31
| | | | | | | | | | EVP_PKEYs may be shared across mutliple threads. For example this is common for users of libssl who provide a single EVP_PKEY private key for an SSL_CTX, which is then shared between multiple threads for each SSL object. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
* rsa_kmgmt: Return OSSL_PKEY_PARAM_DEFAULT_DIGEST for unrestricted PSS keysTomas Mraz2021-01-291-1/+34
| | | | | | | | | Add a testcase to the test_req covering the issue. Fixes #13957 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13967)
* check_sig_alg_match(): weaken sig nid comparison to allow RSA{,PSS} key ↵Dr. David von Oheimb2021-01-281-1/+6
| | | | | | | | | verify RSA-PSS This is an upstream fix for #13931 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13968)
* Update copyright yearRichard Levitte2021-01-2813-13/+13
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
* Fix running mingw dhparam test under wineMatt Caswell2021-01-271-1/+3
| | | | | | | | | | The dhparam test was failing to properly handle line endings when running a mingw configured build under wine. Fixes #13557 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13923)
* TLS client: allow cert verify callback return -1 for SSL_ERROR_WANT_RETRY_VERIFYDr. David von Oheimb2021-01-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The client-side cert verification callback function may not only return as usual for success or 0 for failure, but also -1, typically on failure verifying the server certificate. This makes the handshake suspend and return control to the calling application with SSL_ERROR_WANT_RETRY_VERIFY. The app can for instance fetch further certificates or cert status information needed for the verification. Calling SSL_connect() again resumes the connection attempt by retrying the server certificate verification step. This process may even be repeated if need be. The core implementation of the feature is in ssl/statem/statem_clnt.c, splitting tls_process_server_certificate() into a preparation step that just copies the certificates received from the server to s->session->peer_chain (rather than having them in a local variable at first) and returns to the state machine, and a post-processing step in tls_post_process_server_certificate() that can be repeated: Try verifying the current contents of s->session->peer_chain basically as before, but give the verification callback function the chance to pause connecting and make the TLS state machine later call tls_post_process_server_certificate() again. Otherwise processing continues as usual. The documentation of the new feature is added to SSL_CTX_set_cert_verify_callback.pod and SSL_want.pod. This adds two tests: * A generic test in test/helpers/handshake.c on the usability of the new server cert verification retry feature. It is triggered via test/ssl-tests/03-custom_verify.cnf.in (while the bulky auto- generated changes to test/ssl-tests/03-custom_verify.cnf can be basically ignored). * A test in test/sslapitest.c that demonstrates the effectiveness of the approach for augmenting the cert chain provided by the server in between SSL_connect() calls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13906)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 03:44:16 +0100