summaryrefslogtreecommitdiffstats
path: root/test/recipes
AgeCommit message (Collapse)Author
2017-01-06Implement TLSv1.3 style CertificateStatusMatt Caswell
We remove the separate CertificateStatus message for TLSv1.3, and instead send back the response in the appropriate Certificate message extension. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2020)
2017-01-06Create Certificate messages in TLS1.3 formatMatt Caswell
Also updates TLSProxy to be able to understand the format and parse the contained extensions. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2020)
2017-01-04Don't run MSBLOB conversion tests when RSA or DSA are disabledRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2174)
2017-01-04Don't run OCSP tests when OCSP is disabledRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2173)
2017-01-04Don't test SRP when it's disabledRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2172)
2017-01-04Don't run NPN tests when NPN is disabledRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2171)
2016-12-2970-test_sslvertol.t: skip test 1 and 2 if too few protocols are enabledRichard Levitte
These tests depend on there being at least one protocol version below TLSv1.3 enabled. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2144)
2016-12-2980-test_ssl_new.t: Make 19-mac-then-encrypt.conf work without TLSv1.2Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2144)
2016-12-2970-test_sslvertol.t: Make sure to check a max TLS version that matches ↵Richard Levitte
configuration Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2144)
2016-12-2970-test_sslmessages.t: Don't check EXT_SIG_ALGS if TLS 1.2 is disabledRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2144)
2016-12-29Fix CT test_sslmessages hangsMatt Caswell
The CT tests in test_sslmessages require EC to be available, therefore we must skip these if no-ec Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2153)
2016-12-29Add a test to check the EC point formats extension appears when we expectMatt Caswell
The previous commit fixed a bug where the EC point formats extensions did not appear in the ServerHello. This should have been caught by 70-test_sslmessages but that test never tries an EC ciphersuite. This updates the test to do that. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2153)
2016-12-16Fix no-ct, skip tests recipes that try to test CTRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2096)
2016-12-14CRL critical extension bugfixRich Salz
More importantly, port CRL test from boringSSL crypto/x509/x509_test.cc Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1775)
2016-12-08And client fuzzerKurt Roeckx
Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #2041
2016-12-08Fix various indentationMatt Caswell
The indentation was a bit off in some of the perl files following the extensions refactor. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Move the checkhandshake.pm module into test/testlibMatt Caswell
Move this module into the same place as other test helper modules. It simplifies the code and keeps like things together. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Fix more style issues following extensions refactor feedbackMatt Caswell
Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Correct imports for checkhandshake moduleMatt Caswell
Ensure the tests can find the checkhandshake module on all platforms Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add some extra key_share testsMatt Caswell
Check that the extension framework properly handles extensions specific to a protocol version Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Remove some spurious whitespaceMatt Caswell
Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add a renegotiation testMatt Caswell
Make sure we did not break the unsafe legacy reneg checks with the extension work. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add more extension tests to test_sslmessagesMatt Caswell
Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Merge common code between test_tls13messages and test_sslmessagesMatt Caswell
Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add extension tests in test_sslmessagesMatt Caswell
Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Enable status_request test in test_sslmessagesMatt Caswell
The s_server option -status_file has been added so this test can be enabled. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add a test to check messsages sent are the ones we expectMatt Caswell
Repeat for various handshake types Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add tests for new extension codeMatt Caswell
Extend test_tls13messages to additionally check the expected extensions under different options given to s_client/s_server. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Split ServerHello extensionsMatt Caswell
In TLS1.3 some ServerHello extensions remain in the ServerHello, while others move to the EncryptedExtensions message. This commit performs that move. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add EncryptedExtensions messageMatt Caswell
At this stage the message is just empty. We need to fill it in with extension data. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Send and Receive a TLSv1.3 format ServerHelloMatt Caswell
There are some minor differences in the format of a ServerHello in TLSv1.3. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add a test for the UI APIRichard Levitte
The best way to test the UI interface is currently by using an openssl command that uses password_callback. The only one that does this is 'genrsa'. Since password_callback uses a UI method derived from UI_OpenSSL(), it ensures that one gets tested well enough as well. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2040)
2016-12-05Add more TLS1.3 record testsMatt Caswell
Add some tests for the new record construction Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-29Add a test for TLSv1.3 encryption using the new nonce constructionMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-29Fix mac-then-encrypt test with enable-tls1_3Matt Caswell
Commit b3618f44 added a test for mac-then-encrypt. However the test fails when running with "enable-tls1_3". The problem is that the test creates a connection, which ends up being TLSv1.3. However it also restricts the ciphers to a single mac-then-encrypt ciphersuite that is not TLSv1.3 compatible so the connection aborts and the test fails. Mac-then-encrypt is not relevant to TLSv1.3, so the test should disable that protocol version. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-11-28Make bntest be (mostly) file-based.Rich Salz
Test suite used from boring, written by David Benjamin. Test driver converted from C++ to C. Added a Perl program to check the testsuite file. Extensive review feedback incorporated (thanks folks). Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-11-28Test mac-then-encryptEmilia Kasper
Verify that the encrypt-then-mac negotiation is handled correctly. Additionally, when compiled with no-asm, this test ensures coverage for the constant-time MAC copying code in ssl3_cbc_copy_mac. The proxy-based CBC padding test covers that as well but it's nevertheless better to have an explicit handshake test for mac-then-encrypt. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-11-25add CMS SHA1 signing testDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-24Run BoringSSL tests on TravisEmilia Kasper
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-11-23Extend test_tls13messagesMatt Caswell
Add various different handshake types that are possible. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-23Add a test for the TLSv1.3 state machineMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-23Fix the tests following the state machine changes for TLSv1.3Matt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-23Remove old style NewSessionTicket from TLSv1.3Matt Caswell
TLSv1.3 has a NewSessionTicket message, but it is *completely* different to the TLSv1.2 one and may as well have been called something else. This commit removes the old style NewSessionTicket from TLSv1.3. We will have to add the new style one back in later. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-20Add test to check EVP_PKEY method ordering.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-17Add conversion test for MSBLOB format.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-16Fixed various style issues in the key_share codeMatt Caswell
Numerous style issues as well as references to TLS1_3_VERSION instead of SSL_IS_TLS13(s) Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-16Add some tests for the key_share extensionMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-16Start using the key_share data to derive the PMSMatt Caswell
The previous commits put in place the logic to exchange key_share data. We now need to do something with that information. In <= TLSv1.2 the equivalent of the key_share extension is the ServerKeyExchange and ClientKeyExchange messages. With key_share those two messages are no longer necessary. The commit removes the SKE and CKE messages from the TLSv1.3 state machine. TLSv1.3 is completely different to TLSv1.2 in the messages that it sends and the transitions that are allowed. Therefore, rather than extend the existing <=TLS1.2 state transition functions, we create a whole new set for TLSv1.3. Intially these are still based on the TLSv1.2 ones, but over time they will be amended. The new TLSv1.3 transitions remove SKE and CKE completely. There's also some cleanup for some stuff which is not relevant to TLSv1.3 and is easy to remove, e.g. the DTLS support (we're not doing DTLSv1.3 yet) and NPN. I also disable EXTMS for TLSv1.3. Using it was causing some added complexity, so rather than fix it I removed it, since eventually it will not be needed anyway. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-13Remove heartbeat supportRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1669)
2016-11-10Link internal tests with static OpenSSL libraries when neededRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1889)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-06 03:25:00 +0000