summaryrefslogtreecommitdiffstats
path: root/test/recipes (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Limit scope of CN name constraintsViktor Dukhovni2018-05-231-1/+7
| | | | | | | | | | | | | | | Don't apply DNS name constraints to the subject CN when there's a least one DNS-ID subjectAlternativeName. Don't apply DNS name constraints to subject CN's that are sufficiently unlike DNS names. Checked name must have at least two labels, with all labels non-empty, no trailing '.' and all hyphens must be internal in each label. In addition to the usual LDH characters, we also allow "_", since some sites use these for hostnames despite all the standards. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Suport TLSv1.3 draft 28Matt Caswell2018-05-151-3/+4
| | | | | | | | | Also retains support for drafts 27 and 26 Fixes #6257 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6258)
* Add a CMS API testMatt Caswell2018-05-081-0/+21
| | | | | | | | | | Previous tests only invoked CMS via the command line app. This test uses the CMS API directly to do and encrypt and decrypt operation. This test would have caught the memory leak fixed by the previous commit (when building with enable-crypto-mdebug). Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6142)
* 15-test_out_option: Refactor and don't test directory write on VMSRichard Levitte2018-04-261-30/+39
| | | | | | | | | | | | | | | To my surprise, it turns out that on OpenVMS, opening './' (which is translated to '[]') for writing actually creates a file, '[].'. On OpenVMS, this is a perfectly valid file with no name or extension, just the delimiter between the two. Because of the mess the exception would generate in the test recipe, it gets refactored again, to clearly separate each test inside it, and use skips to avoid some of them (that makes it clear that they are skipped and why, when running the recipe). Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6100)
* test/recipes/15-test_out_option.t: refine testsRichard Levitte2018-04-251-34/+37
| | | | | | | | | Test writing to the null device. This should be successful. Also, refactor so the planned number of tests is calculated. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6033)
* [SM2_sign] add minimal EVP_PKEY functionality testingNicola Tuveri2018-04-251-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The actual functionality of generating signatures through the `EVP_PKEY` API is completely untested. Current tests under the `EVP_PKEY` API (`test/recipes/30-test_evp_data/evppkey.txt`) only cover `Verify` and `Decrypt`, while encryption and signature generation are tested with ad-hoc clients (`test/sm2crypttest.c`, `test/sm2signtest.c`) that do not call the `EVP_PKEY` interface at all but soon-to-be private functions that bypass it (cf. PR#5895 ). It is my opinion that an ideal solution for the future would consist on enhancing the `test/evp_pkey` facility and syntax to allow tests to take control of the PRNG to inject known nonces and validate the results of `EVP_PKEY` implementations against deterministic known answer tests, but it is probably too late to work on this feature in time for next release. Given that commit b5a85f70d8 highlights some critical bugs in the hook between the `EVP_PKEY` interface and SM2 signature generation and that these defects escaped testing and code review, I think that at least for now it is beneficial to at least add the kind of "bogus" testing provided by this patch: this is a "fake" test as it does only verify that the SM2 `EVP_PKEY` interface is capable of creating a signature without failing, but it does not say anything about the generated signature being valid, nor does it test the functional correctness of the cryptosystem. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6066)
* Add a test to verify the ClientHello version is the same in a renegMatt Caswell2018-04-241-1/+29
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6059)
* recipes/70-test_ssl{cbcpadding,extension,records}: make it work w/fragmentation.Andy Polyakov2018-04-183-57/+149
| | | | | | | | | | This fixes only those tests that were failing when network data was fragmented. Remaining ones might succeed for "wrong reasons". Bunch of tests have to fail to be considered successful and when data is fragmented they might fail for reasons other than originally intended. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5975)
* Update copyright yearRichard Levitte2018-04-172-2/+2
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5990)
* test/recipes/test_genrsa.t : don't fail because of size limit changesRichard Levitte2018-04-131-6/+34
| | | | | | | | | | | | | | There is a test to check that 'genrsa' doesn't accept absurdly low number of bits. Apart from that, this test is designed to check the working functionality of 'openssl genrsa', so instead of having a hard coded lower limit on the size key, let's figure out what it is. Partially fixes #5751 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/5754) (cherry picked from commit ec46830f8a4ce62c0c8ee7677b1eb8e53ee16df1)
* Add a test for SRPMatt Caswell2018-04-132-1/+10
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5925)
* Update copyright yearMatt Caswell2018-04-033-3/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5851)
* Refuse to run test_cipherlist unless shared library matches buildRichard Levitte2018-03-311-1/+6
| | | | | | | | | | | | | | | | | test/cipherlist_test.c is an internal consistency check, and therefore requires that the shared library it runs against matches what it was built for. test/recipes/test_cipherlist.t is made to refuse running unless library version and build version match. This adds a helper program test/versions.c, that simply displays the library and the build version. Partially fixes #5751 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5753) (cherry picked from commit cde87deafa7486f26bdf954867a6d72ca4ea06e7)
* Faster fuzz test: teach the fuzz test programs to handle directoriesRichard Levitte2018-03-291-5/+5
| | | | | | | | | | | | | | Instead of invoking the fuzz test programs once for every corpora file, we invoke them once for each directory of corpora files. This dramatically reduces the number of program invikations, as well as the time 99-test_fuzz.t takes to complete. fuzz/test-corpus.c was enhanced to handle directories as well as regular files. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5776)
* Revert "Temporarily disable some tests that hang"Matt Caswell2018-03-281-4/+0
| | | | | | | | | This reverts commit 37a385956461ab526ecea2739a8a40364a8db259. These tests should now be fixed by commit e6e9170d6. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5765)
* Temporarily disable some tests that hangMatt Caswell2018-03-271-0/+4
| | | | | | | The previous commit causes some tests to hang so we temporarily disable them. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5757)
* aes ctr_drbg: add cavs testsPatrick Steuer2018-03-211-1/+2
| | | | | | | Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #5580
* Add dladdr() for AIXMatthias Kraft2018-03-211-2/+4
| | | | | | | | | | | | | | | | | | | | | | | Although it deviates from the actual prototype of DSO_dsobyaddr(), this is now ISO C compliant and gcc -Wpedantic accepts the code. Added DATA segment checking to catch ptrgl virtual addresses. Avoid memleaks with every AIX/dladdr() call. Removed debug-fprintf()s. Added test case for DSO_dsobyaddr(), which will eventually call dladdr(). Removed unecessary AIX ifdefs again. The implementation can only lookup function symbols, no data symbols. Added PIC-flag to aix*-cc build targets. As AIX is missing a dladdr() implementation it is currently uncertain our exit()-handlers can still be called when the application exits. After dlclose() the whole library might have been unloaded already. Signed-off-by: Matthias Kraft <makr@gmx.eu> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5668)
* Reduce the verbosity of test_storeMatt Caswell2018-03-201-33/+38
| | | | | | | | | | | | The travis logs are going above 4Mb causing the builds to fail. One test creates excessive output. This change reduces that output by approx 180k. [extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5694)
* Update copyright yearMatt Caswell2018-03-203-3/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5689)
* Apply system_default configuration on SSL_CTX_new().Tomas Mraz2018-03-191-0/+23
| | | | | | | | | When SSL_CTX is created preinitialize it with system default configuration from system_default section. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4848)
* Support SM2 ECIES scheme via EVPJack Lloyd2018-03-191-0/+5
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4793)
* Add SM2 signature and ECIES schemesJack Lloyd2018-03-191-0/+14
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4793)
* Fix bio callback backward compatibilityBernd Edlinger2018-03-191-0/+12
| | | | | | | | | | Don't pass a pointer to uninitialized processed value for BIO_CB_READ and BIO_CB_WRITE Check the correct cmd code in BIO_callback_ctrl Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5516)
* Fix no-ecMatt Caswell2018-03-191-0/+1
| | | | | | | | | | | Raw private/public key loading may fail for X25519/X448 if ec has been disabled. Also fixed a missing blank line in evppkey.txt resulting in a warning in the test output. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5664)
* Fix miscellaneous typos in docs and sourceDr. Matthias St. Pierre2018-03-171-1/+1
| | | | | | | | | | - d2i_PKC8PrivateKey -> d2i_PKCS8PrivateKey - bechmark -> benchmark - ciperhsuite -> ciphersuite - EncyptedPreMasterSecret -> EncryptedPreMasterSecret Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5570)
* Add some test vectors for testing raw 448/25519 keysMatt Caswell2018-03-151-0/+79
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5520)
* Fix no-ecMatt Caswell2018-03-141-0/+1
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5618)
* Fix test_out_optionPatrick Steuer2018-03-141-1/+2
| | | | | | | | | | | | | Random path generation code in test/recipes/15-test_out_option.t does not work: The code sets rand_path to "/test.pem". I.e. the test will fail as expected for unprivileged user but will pass for root user. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5595)
* Split configuration of TLSv1.3 ciphers from older ciphersMatt Caswell2018-03-144-21/+29
| | | | | | | | | | | | | | | | | | | With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
* Use the TLSv1.3 record header as AADMatt Caswell2018-03-141-3/+3
| | | | | | | As of TLSv1.3 draft-25 the record header data must be used as AAD Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5604)
* CONF inclusion test: Add VMS specific testsRichard Levitte2018-03-123-1/+19
| | | | | | | We want to see that VMS syntax paths are treated correctly. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5587)
* Session Ticket app dataTodd Short2018-03-121-1/+1
| | | | | | | | Adds application data into the encrypted session ticket Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3802)
* Fix issues in ia32 RDRAND asm leading to reduced entropyBryan Donlan2018-03-081-0/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes two issues in the ia32 RDRAND assembly code that result in a (possibly significant) loss of entropy. The first, less significant, issue is that, by returning success as 0 from OPENSSL_ia32_rdrand() and OPENSSL_ia32_rdseed(), a subtle bias was introduced. Specifically, because the assembly routine copied the remaining number of retries over the result when RDRAND/RDSEED returned 'successful but zero', a bias towards values 1-8 (primarily 8) was introduced. The second, more worrying issue was that, due to a mixup in registers, when a buffer that was not size 0 or 1 mod 8 was passed to OPENSSL_ia32_rdrand_bytes or OPENSSL_ia32_rdseed_bytes, the last (n mod 8) bytes were all the same value. This issue impacts only the 64-bit variant of the assembly. This change fixes both issues by first eliminating the only use of OPENSSL_ia32_rdrand, replacing it with OPENSSL_ia32_rdrand_bytes, and fixes the register mixup in OPENSSL_ia32_rdrand_bytes. It also adds a sanity test for OPENSSL_ia32_rdrand_bytes and OPENSSL_ia32_rdseed_bytes to help catch problems of this nature in the future. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5342)
* Add support for .include directive in config filesTomas Mraz2018-03-056-0/+121
| | | | | | | | | | Either files or directories of *.cnf or *.conf files can be included. Recursive inclusion of directories is not supported. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5351)
* Add test vectors for X448 and Ed448Matt Caswell2018-03-021-0/+251
| | | | | | | | | This adds the Ed448 test vectors from RFC8032 and the X448 test vectors from RFC7748. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/5481)
* Adapt 15-test_out_option.t for more than just UnixRichard Levitte2018-02-281-4/+4
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4008)
* Enable the -out option test on VMS as wellRichard Levitte2018-02-281-2/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4008)
* Add test cases for this -out option checkPaul Yang2018-02-281-0/+60
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3709)
* Update copyright yearMatt Caswell2018-02-273-3/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove executable bit from test/recipes/03-test_internal_sm4.tBernd Edlinger2018-02-231-0/+0
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5434)
* Test the storeutl searching optionsRichard Levitte2018-02-231-5/+49
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2688)
* Test the storeutl expectation optionsRichard Levitte2018-02-231-2/+16
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2688)
* Fix no-ec buildMatt Caswell2018-02-211-0/+3
| | | | | | | [extended tests] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5418)
* test/recipes/80-test_pkcs12.t: handle lack of Win32::API.Andy Polyakov2018-02-211-0/+2
| | | | | | | | | | So far check for availability of Win32::API served as implicit check for $^O being MSWin32. Reportedly it's not safe assumption, and check for MSWin32 has to be explicit. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5416)
* Move curve448_test.c to be a full internal testMatt Caswell2018-02-201-0/+19
| | | | | | | This ensures that this test is run as part of the test suite Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5105)
* test_ssl_old: avoid empty strings for flagsRichard Levitte2018-02-191-1/+2
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5396)
* Update copyright yearMatt Caswell2018-02-1324-24/+24
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fixes for no-tls1_2 and no-tls1_2-methodMatt Caswell2018-02-096-47/+64
| | | | | | | | The no-tls1_2 option does not work properly in conjunction with TLSv1.3 being enabled (which is now the default). This commit fixes the issues. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5301)
* Don't run tls13encryptiontest on a shared Windows buildMatt Caswell2018-02-071-0/+3
| | | | | | | | | | tls13encryptiontest is an "internal" test. As with all the other internal tests it should not be run on a shared native Windows build. [extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5266)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-19 17:12:47 +0100