summaryrefslogtreecommitdiffstats
path: root/test/ssl_test_ctx.c
AgeCommit message (Collapse)Author
2017-04-03Add ExpectedServerCANamesDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3015)
2017-03-16Add ExpectedClientCANamesDr. Stephen Henson
Add ExpectedClientCANames: for client auth this checks to see if the list of certificate authorities supplied by the server matches the expected value. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2969)
2017-03-14Port SRP tests to the new test frameworkEmilia Kasper
Also add negative tests for password mismatch. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-02Use the built in boolean type for CompressionExpectedMatt Caswell
Don't create a custom boolean type for parsing CompressionExpected. Use the existing one instead. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2814)
2017-03-02Add compression testsMatt Caswell
Check whether we negotiate compression in various scenarios. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2814)
2017-02-23Tests for SSL early callbackBenjamin Kaduk
Plumb things through in the same place as the SNI callback, since we recommend that the early callback replace (and supplement) the SNI callback, and add a few test cases. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
2017-02-17Add some KeyUpdate testsMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2609)
2017-02-16Fix a mem leak in ssl_test_ctx.cMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2650)
2017-02-16Provide a test for the Encrypt-Then-Mac renegotiation crashMatt Caswell
In 1.1.0 changing the ciphersuite during a renegotiation can result in a crash leading to a DoS attack. In master this does not occur with TLS (instead you get an internal error, which is still wrong but not a security issue) - but the problem still exists in the DTLS code. This commit provides a test for the issue. CVE-2017-3733 Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-01-30Add test support for TLS signature types.Dr. Stephen Henson
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2301)
2017-01-25Fix small typoRichard Levitte
In test/ssl_test, parsing ExpectedClientSignHash ended up in the expected_server_sign_hash field. Reviewed-by: Stephen Henson <steve@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2289)
2017-01-20Add options to check TLS signing hashesDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2235)
2017-01-15Add options to check certificate types.Dr. Stephen Henson
Reviewed-by: Emilia Käsper <emilia@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2224)
2017-01-08Add new ssl_test option.Dr. Stephen Henson
Add option ExpectedTmpKeyType to test the temporary key the server sends is of the correct type. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2191)
2016-11-02Add the SSL_METHOD for TLSv1.3 and all other base changes requiredMatt Caswell
Includes addition of the various options to s_server/s_client. Also adds one of the new TLS1.3 ciphersuites. This isn't "real" TLS1.3!! It's identical to TLS1.2 apart from the protocol and the ciphersuite...and the ciphersuite is just a renamed TLS1.2 one (not a "real" TLS1.3 ciphersuite). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-28Extend the renegotiation testsMatt Caswell
Add the ability to test both server initiated and client initiated reneg. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-30Add some CertStatus testsMatt Caswell
The previous commit revealed a long standing problem where CertStatus processing was broken in DTLS. This would have been revealed by better testing - so add some! Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-18Port multi-buffer testsEmilia Kasper
Make maximum fragment length configurable and add various fragmentation tests, in addition to the existing multi-buffer tests. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-16SSL tests: send some application dataEmilia Kasper
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-10Add TEST_checkEmilia Kasper
Like OPENSSL_assert, but also prints the error stack before exiting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-10SSL tests: port CT tests, add a few moreEmilia Kasper
This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-08Reorganize SSL test structuresEmilia Kasper
Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-02Fix tests for no-nextprotonegMatt Caswell
Fix the 80-test_ssl_test_ctx and 80-test_ssl_new tests when used with the no-nextprotoneg option Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-01Fix various no-*s.Ben Laurie
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-22Make boolean SSL test conf values case-insensitiveEmilia Kasper
Undo review mistake: I changed the wrong strcmp in a previous pull request. Add test. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-20SSL test framework: port resumption testsEmilia Kasper
Systematically test every server-side version downgrade or upgrade. Client version upgrade or downgrade could be tested analogously but will be done in a later change. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-19SSL test framework: port NPN and ALPN testsEmilia Kasper
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-18Fix SSLv3 ClientAuth alert checkingMatt Caswell
In TLS during ClientAuth if the CA is not recognised you should get an UnknownCA alert. In SSLv3 this does not exist and you should get a BadCertificate alert. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-28SSL test framework: port SNI testsEmilia Kasper
Observe that the old tests were partly ill-defined: setting sn_server1 but not sn_server2 in ssltest_old.c does not enable the SNI callback. Fix this, and also explicitly test both flavours of SNI mismatch (ignore / fatal alert). Tests still pass. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-13Port DTLS version negotiation testsEmilia Kasper
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-13Clean up following new SNI testsEmilia Kasper
- Only send SNI in SNI tests. This allows us to test handshakes without the SNI extension as well. - Move all handshake-specific machinery to handshake_helper.c - Use enum types to represent the enum everywhere (Resorting to plain ints can end in sign mismatch when the enum is represented by an unsigned type.) Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-09Fix session ticket and SNITodd Short
When session tickets are used, it's possible that SNI might swtich the SSL_CTX on an SSL. Normally, this is not a problem, because the initial_ctx/session_ctx are used for all session ticket/id processes. However, when the SNI callback occurs, it's possible that the callback may update the options in the SSL from the SSL_CTX, and this could cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things can happen: 1. The session ticket TLSEXT may not be written when the ticket expected flag is set. The state machine transistions to writing the ticket, and the client responds with an error as its not expecting a ticket. 2. When creating the session ticket, if the ticket key cb returns 0 the crypto/hmac contexts are not initialized, and the code crashes when trying to encrypt the session ticket. To fix 1, if the ticket TLSEXT is not written out, clear the expected ticket flag. To fix 2, consider a return of 0 from the ticket key cb a recoverable error, and write a 0 length ticket and continue. The client-side code can explicitly handle this case. Fix these two cases, and add unit test code to validate ticket behavior. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-17Copyright consolidation 02/10Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-12Remove proxy tests. Add verify callback tests.Emilia Kasper
The old proxy tests test the implementation of an application proxy policy callback defined in the test itself, which is not particularly useful. It is, however, useful to test cert verify overrides in general. Therefore, replace these tests with tests for cert verify callback behaviour. Also glob the ssl test inputs on the .in files to catch missing generated files. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-05New SSL test frameworkEmilia Kasper
Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-27 17:57:38 +0000