summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2020-09-13Fix safestack issues in conf.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in ct.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in crmf.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in srp.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in pkcs7.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in ocsp.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in cmp.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in asn1.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix stacks of OPENSSL_STRING, OPENSSL_CSTRING and OPENSSL_BLOCKMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in x509v3.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in x509.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in ssl.hMatt Caswell
We fix 3 problems with safestack: - Including an openssl header file without linking against libcrypto can cause compilation failures (even if the app does not otherwise need to link against libcrypto). See issue #8102 - Recent changes means that applications in no-deprecated builds will need to include additional macro calls in the source code for all stacks that they need to use - which is an API break. This changes avoids that necessity. - It is not possible to write code using stacks that works in both a no-deprecated and a normal build of OpenSSL. See issue #12707. Fixes #12707 Contains a partial fix for #8102. A similar PR will be needed for hash to fully fix. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-12NonStop port updates for 3.0.0.Randall S. Becker
HPE NonStop Port Changes for 3.0.0 Includes unthreaded, PUT, and SPT for OSS. The port changes include wrapping where necessary for FLOSS and appropriate configuration changes to support that. Two tests are excluded as being inappropriate for the platform. The changes are: * Added /usr/local/include to nonstop-nsx_spt_floss to load floss.h * Added SPT Floss variant for NonStop * Wrapped FLOSS definitions in OPENSSL_TANDEM_FLOSS to allow selective enablement. * SPT build configuration for NonStop * Skip tests not relevant for NonStop * PUT configuration changes required for NonStop platforms * Configurations/50-nonstop.conf: updates for TNS/X platform. * FLOSS instrumentation for HPE NonStop TNS/X and TNS/E platforms. * Configurations/50-nonstop.conf: modifications for non-PUT TNS/E platform b * Fix use of DELAY in ssltestlib.c for HPNS. * Fixed commit merge issues and added floss to http_server.c CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #5087. Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12800)
2020-09-12TEST: Add a test of EC key generation with encoding specRichard Levitte
The primary function of this test is to exercise EVP_PKEY_CTX_set_ec_param_enc(). Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12853)
2020-09-12Fix coverity issue: CID 1466482 - Resource leak in ↵Shane Lontis
OSSL_STORE_SEARCH_by_key_fingerprint() Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
2020-09-12Fix coverity issue: CID 1466485 - Explicit NULL dereference in OSSL_STORE_find()Shane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
2020-09-12Fix coverity issue: CID 1466486 - Resource leak in OSSL_STOREShane Lontis
Note that although this is a false positive currently, it could become possible if any of the methods called change behaviour - so it is safer to add the fix than to ignore it. Added a simple test so that I could prove this was the case. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
2020-09-12TEST: skip POSIX errcode zero in tesst/recipes/02-test_errstr.tRichard Levitte
On most systems, there is no E macro for errcode zero in <errno.h>, which means that it seldom comes up here. However, reports indicate that some platforms do have an E macro for errcode zero. With perl, errcode zero is a bit special. Perl consistently gives the empty string for that one, while the C strerror() may give back something else. The easiest way to deal with that possible mismatch is to skip this errcode. Fixes #12798 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12799)
2020-09-11apps/ca: allow CRL lastUpdate/nextUpdate fields to be specifiedChris Novakovic
When generating a CRL using the "ca" utility, allow values for the lastUpdate and nextUpdate fields to be specified using the command line options -crl_lastupdate and -crl_nextupdate respectively. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12784)
2020-09-11Extend X509 cert checks and error reporting in v3_{purp,crld}.c and ↵Dr. David von Oheimb
x509_{set,vfy}.c add various checks for malformedness to static check_chain_extensions() in x509_vfc.c improve error reporting of X509v3_cache_extensions() in v3_purp.c add error reporting to x509_init_sig_info() in x509_set.c improve static setup_dp() and related functions in v3_purp.c and v3_crld.c add test case for non-conforming cert from https://tools.ietf.org/html/rfc8410#section-10.2 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12478)
2020-09-10apps_ui.c: Improve error handling and return value of setup_ui_method()Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
2020-09-10Diverse build.info: Adjust pathsRichard Levitte
Fixes #12815 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12816)
2020-09-10test/cmp_{client,msg}_test.c: minor code cleanupDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12655)
2020-09-10test/recipes/81-test_cmp_cli_data/Mock/server.cnf: minor cleanupDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12655)
2020-09-1081-test_cmp_cli: Make test output files all different according to #11080Dr. David von Oheimb
Also some minor improvements mostly of test cases regarding PKCS#10 CSR input Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12655)
2020-09-1081-test_cmp_cli.t: Stop unlinking test output files according to #11080Dr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12655)
2020-09-09Support writing RSA keys using the traditional format againKurt Roeckx
Fixes: #6855 Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #8743
2020-09-08TEST: modify test/endecode_test.c to not use legacy keysRichard Levitte
Now that PEM_write_bio_PrivateKey_traditional() can handle provider-native EVP_PKEYs, we don't need to use explicitly legacy ones. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12738)
2020-09-08Add CMS AuthEnvelopedData with AES-GCM supportJakub Zelenka
Add the AuthEnvelopedData as defined in RFC 5083 with AES-GCM parameter as defined in RFC 5084. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8024)
2020-09-08apps/cmp.c: Allow default HTTP path (aka CMP alias) given with -server optionDr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12786)
2020-09-08OSSL_HTTP_parse_url(): add optional port number return parameter and ↵Dr. David von Oheimb
strengthen documentation Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12786)
2020-09-08EVP: Expand the use of EVP_PKEY_CTX_md()Richard Levitte
Setting a hash function was reserved for signature operations. However, it turns out that SM2 uses a hash function for encryption and decryption as well. Therefore, EVP_PKEY_CTX_md() must be called with an expanded operation type combination that includes EVP_PKEY_OP_TYPE_CRYPT when used in a generic way. For SM2, test/recipes/30-test_evp_data/evppkey_sm2.txt is expanded to test decryption both with an implicit and an explicit digest. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12789)
2020-09-08Fix test/evp_extra_test.cRichard Levitte
Because EVP_PKEY_CTX_new_from_name() could return a non-NULL context with no value in it, the lack of legacy implementation when OpenSSL was configured with 'no-ec' went through undetected. This adds the necessary guards to skip a test of SM2 in that case. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/12785)
2020-09-08Use return code for 'which command' checksJon Spillett
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12775)
2020-09-05OSSL_CMP_CTX: rename field and its getter/setter from 'untrusted_certs' to ↵Dr. David von Oheimb
'untrusted Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12788)
2020-09-05Strengthen chain building for CMPDr. David von Oheimb
* Add -own_trusted option to CMP app * Add OSSL_CMP_CTX_build_cert_chain() * Add optional trust store arg to ossl_cmp_build_cert_chain() * Extend the tests in cmp_protect_test.c and the documentation accordingly Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12791)
2020-09-05Add OSSL_CMP_CTX_get1_newChain() and related CLI option -chainoutDr. David von Oheimb
Also simplify certificate saving in apps/cmp.c Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12790)
2020-09-05test/drbgtest: improve the reseed after fork testDr. Matthias St. Pierre
Issue #12377 demonstrated that it is not sufficient to verify that after a fork a reseeding is triggered in the child. This commit enhances the test by collecting the output of the public and private drbg for the parent and all children and checking for duplicates. In case of duplicates, it prints an error message and displays a sorted output. The analysis of #12377 (see [1]) showed that due to an error in the resetting of the AES-CTR (issue #12405, fixed by #12413), it could happen that only the first n bytes (n=1,...15) of the children's random output were identical. This test is optimized to detect this issue by only comparing the first byte of the sampled data (i.e., the first 'column' of the output). The number of samples is chosen high enough to keep the chance of false positives low. The test is executed sixteen times, each time advancing the internal counter by requesting a single extra byte of random data. Another, more general test splits the entire sampled random data into two-byte chunks and counts their collisions. If a certain threshold is exceeded, it reports an error. [1] https://github.com/openssl/openssl/issues/12377#issuecomment-656207334 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12407)
2020-09-03EC: Remove one error record that shadows anotherRichard Levitte
In EC_GROUP_new_from_params(), ERR_R_EC_LIB was reported if group_new_from_name() returned NULL. However, this shadows a possible EC_R_INVALID_CURVE, making that harder to detect, which happens to be important to do in test/evp_test.c. This also extends key_unsupported() in test/evp_test.c to check for this error alongside the check for EC_R_UNKNOWN_GROUP. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12587)
2020-09-03TEST: Ensure that the base provider i activated when neededRichard Levitte
The fips providers can't be activated alone if encoding, decoding or STORE are going to be used. To enable this, we selectively use test/fips-and-base.cnf instead of test/fips.cnf in our test recipes. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12587)
2020-09-03Revert "TEST: separate out NIST ECC tests from non-NIST"Richard Levitte
This file split turned out to be a mistake as soon as the fetching error reporting got properly sorted. This reverts commit e6ed04a9dcc2ead94e35c4a7400b9c998b5ad9ac. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12587)
2020-09-03TEST: have key_unsupported() in evp_test.c look at the last errorRichard Levitte
key_unsupported() looked at the first error in the queue to see if a key algorithm is supported or not. However, there are situations where the errors it looks for is preceded by others. It's much safer to look at the last recorded error. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12587)
2020-09-03"Downgrade" provider-native keys to legacy where neededRichard Levitte
Some sub-systems and openssl sub-commands do not yet deal cleanly with purely provider-native EVP_PKEYs. We compensate that by "downgrading" keys in select places, or ensure that the 'file:' scheme ENGINE loader is activated. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12587)
2020-09-03TEST: Modify test/recipes/90-test_store.t for use with different 'file:' loadersRichard Levitte
We want to perform the same tests with a provider implementation, and also make sure that an ENGINE implementation works as advertised. OSSL_STORE_open() / OSSL_STORE_open_wirh_libctx() work in such a way that they look for internal / engine implementations first, and only failing that, they will try to fetch a provider implementation. This ensures that when we do specify an engine, it gets exceptional priority. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12587)
2020-09-02Avoid uninitialised variable warning for jobsJon Spillett
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12762)
2020-08-31Use global 'libctx' with RAND_bytes_ex to generate sendfile temp data.John Baldwin
While here, check for failure from RAND_bytes_ex as well. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12111)
2020-08-31Fix two issues with AES-CCM KTLS tests.Vadim Fedorenko
- Apply the cipher list to the server context as well as the client context. The tests still worked for AES-GCM cipher suites as those are in the default list of ciphers. AES-CCM cipher suites are not in the default list and require the cipher list to be set. - Use the correct cipher name for AES-CCM. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12111)
2020-08-31Skip tests using KTLS RX for TLS 1.3.John Baldwin
KTLS RX is not yet supported for TLS 1.3. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12111)
2020-08-31Skip tests using KTLS RX if KTLS RX is not supported.John Baldwin
This skips tests using KTLS RX when run on systems that only support KTLS TX. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12111)
2020-08-31Refactor the KTLS tests to minimize code duplication.John Baldwin
Use the low 4 bits of the test number directly as flags for which of the connection sides should use KTLS or not for each test instead of having 16 nearly identical functions to do the same thing. This makes it easier to skip tests that aren't supported (e.g. KTLS RX on TLS 1.3). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12111)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-21 17:28:10 +0000