summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2016-04-18Make string_to_hex/hex_to_string publicRich Salz
Give the API new names, document it. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-18Rename some lowercase API'sRich Salz
Make OBJ_name_cmp internal Rename idea_xxx to IDEA_xxx Rename get_rfc_xxx to BN_get_rfc_xxx Rename v3_addr and v3_asid functions to X509v3_... Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-15Make many X509_xxx types opaque.Rich Salz
Make X509_OBJECT, X509_STORE_CTX, X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD opaque. Remove unused X509_CERT_FILE_CTX Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-04-14Fix no-stdio and no-autoalginitMatt Caswell
no-stdio does not work with the apps. Since the tests also need the apps it doesn't support that either. Therefore we disable building of both. no-autoalginit is not compatible with the apps because it requires explicit loading of the algorithms, and the apps don't do that. Therefore we disable building the apps for this option. Similarly the tests depend on the apps so we also disable the tests. Finally the whole point about no-autoalginit is to avoid excessive executable sizes when doing static linking. Therefore we disable "shared" if this option is selected. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-14Fix AFALG kernel and headers mismatch problemMatt Caswell
During Configure we attempt to check the kernel version of this platform to see whether we can compile the AFALG engine. If the kernel version looks recent enough then we enable AFALG. However when we compile e_afalg.c we check the version of the linux headers. If there is a mismatch between the linux headers and the currently running kernel then we don't compile the AFLAG engine and continue. This was causing a link error. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-14Don't use deprecated CONF_modules_free() in testsViktor Dukhovni
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-13Fix no-tls1_1 and no-tls1_2Matt Caswell
The above config options were failing in test_ssl_old. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-11Fix the no-tls optionMatt Caswell
The no-tls option was failing in the tests. This fixes it. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-11Fix the no-nextprotoneg optionMatt Caswell
Misc fixes to get no-nextprotoneg config option working again. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-10Fix warnings exposed by clang-3.8Emilia Kasper
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-09Don't check the generated ssl-tests configs on VMSRichard Levitte
The simple reason is that the pre-generated files are mainly for Unix. The VMS variants look slightly different, so comparing will always fail. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-04-09VMS doesn't have directory separators in the same sense as UnixRichard Levitte
Don't add / in file specs on VMS. The directory "separator" is part of the directory spec. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-04-09Make DH opaqueMatt Caswell
Move the dh_st structure into an internal header file and provide relevant accessors for the internal fields. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-07test/[dane|evp_]test.c: BIO-fy file I/O.Andy Polyakov
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-07Suppress CT callback as appropriateViktor Dukhovni
Suppress CT callbacks with aNULL or PSK ciphersuites that involve no certificates. Ditto when the certificate chain is validated via DANE-TA(2) or DANE-EE(3) TLSA records. Also skip SCT processing when the chain is fails verification. Move and consolidate CT callbacks from libcrypto to libssl. We also simplify the interface to SSL_{,CTX_}_enable_ct() which can specify either a permissive mode that just collects information or a strict mode that requires at least one valid SCT or else asks to abort the connection. Simplified SCT processing and options in s_client(1) which now has just a simple pair of "-noct" vs. "-ct" options, the latter enables the permissive callback so that we can complete the handshake and report all relevant information. When printing SCTs, print the validation status if set and not valid. Signed-off-by: Rob Percival <robpercival@google.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-04-07OpenSSL::Test: when moving directory, affect env as wellRichard Levitte
The environment variables TOP, SRCTOP, BLDTOP, ... are used to affect the testing framework. However, subprocesses may want to use them as well, and therefore need their values corrected when we move to a different directory. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-04-07Allow generate_ssl_tests.pl to find testlibEmilia Kasper
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-07Better use BIO_snprintf() than snprintf(), in case the later isn't availableRichard Levitte
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-04-06Make the RSA structure opaqueRichard Levitte
Move rsa_st away from public headers. Add accessor/writer functions for the public RSA data. Adapt all other source to use the accessors and writers. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-04-06Fix no-ocspMatt Caswell
Misc fixes for no-ocsp Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-06Add missing mem leak test activation and checksFdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-05Rename ssltest -> ssltest_oldEmilia Kasper
ssltest_old.c is deprecated. New tests should use ssl_test.c, and the recipes in 80-test_ssl_new.t Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-05testutil: return 1 on successEmilia Kasper
Require that test methods return 1 on success (not 0). This is more customary for OpenSSL. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-05New SSL test frameworkEmilia Kasper
Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-04Revert "various spelling fixes"Rich Salz
This reverts commit 620d540bd47a96fb6905fbbdd8ea5167a8841a3e. It wasn't reviewed. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-04various spelling fixesFdaSilvaYY
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-04Fix memory leaks in ASN.1Emilia Kasper
These leaks affect 1.1.0 dev branch only; introduced around commit f93ad22f6adb00e722c130e792799467f3927b56 Found with LibFuzzer Reviewed-by: Ben Laurie <ben@openssl.org>
2016-04-03Move peer chain security checks into x509_vfy.cViktor Dukhovni
A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-04-03Make DSA_METHOD opaqueMatt Caswell
Move the dsa_method structure out of the public header file, and provide getter and setter functions for creating and modifying custom DSA_METHODs. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-04-03Make the DSA structure opaqueMatt Caswell
Move the dsa_st structure out of the public header file. Add some accessor functions to enable access to the internal fields, and update all internal usage to use the new functions. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-04-02Adapt some test recipes to the newer cmdstr()Richard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-02Enhance OpenSSL::Test::cmdstr to give cmd string variantsRichard Levitte
Within OpenSSL::Test, all commands end up existing in two variants, one that has redirections that are needed internally to work well together with the test harness, and one without those redirections. Depending on what the result is going to be used for, the caller may want one for or the other, so we give them the possibility. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-31crypto/blake2: make lowest-level function handle multiple blocks..Andy Polyakov
This minimizes inter-block overhead. Performance gain naturally varies from case to case, up to 10% was spotted so far. There is one thing to recognize, given same circumstances gain would be higher faster computational part is. Or in other words biggest improvement coefficient would have been observed with assembly. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-31OpenSSL::Test: have cmdstr() return the true command.Richard Levitte
On the other hand, have run() display the display variant. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-31When looking for executables, don't forget the extensionRichard Levitte
Because some operating systems have executable extensions, typically ".exe", we need to append it when looking for files in test() and app() (or rather, their subroutines). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-30When verbosity is requested, OpenSSL::Test::run() displays the commandRichard Levitte
It displays the command's exit code as well. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-30Have OpenSsl..Test::app() and friends look for file in source as wellRichard Levitte
If the command file that app(), test(), perlapp(9 and perltest() are looking for doesn't exist in the build tree, look for it in the source tree as well. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-30Since OpenSSL::Test redirects stderr to /dev/null, don't do so in 80-test_ca.tRichard Levitte
Since OpenSSL::Test only redirects stderr to /dev/null when being run through non-verbose test harness, this change allows the stderr output to be displayed when verbosity is requested. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-30Add the option 'interpreter_args' to perlapps() and perltest()Richard Levitte
The intention with that option is to allow extra flags to the perl interpreter itself. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-29Require intermediate CAs to have basicConstraints CA:true.Viktor Dukhovni
Previously, it was sufficient to have certSign in keyUsage when the basicConstraints extension was missing. That is still accepted in a trust anchor, but is no longer accepted in an intermediate CA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-27Add session reuse tests.Kurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #2452
2016-03-27Math::BigInt does floored divs, BN_div does truncated div, compensateRichard Levitte
According to documentation, perl's Math::BigInt does floored division, i.e. the bdiv function does 1 / -4 = -1. OpenSSL's BN_div, as well as bc, do truncated division, i.e. 1 / -4 = 0. We need to compensate for that difference in test/recipes/bc.pl to make sure to verify the bntest results under its own conditions, by dividing the absolute values of the given numbers and fixup the result's negativity afterwards. Closes RT#4485 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-21Fix no-sockMatt Caswell
Misc fixes for no-sock Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-21Fix no-scryptMatt Caswell
Fix the evp tests when no-scrypt is used. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-21Skip the CMS tests if CMS is disabledMatt Caswell
This fixes the no-cms compile time option. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-21Fix no-dsaMatt Caswell
Misc fixes for no-dsa. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-21Remove the remainder of util/mk1mf.pl and companion scriptsRichard Levitte
This removes all scripts that deal with MINFO as well, since that's only used by mk1mf. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-03-20Fix ALPN - more fixesTodd Short
* Clear proposed, along with selected, before looking at ClientHello * Add test case for above * Clear NPN seen after selecting ALPN on server * Minor documentation updates Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-19Don't perform tsa tests if configured "no-ts"Richard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-18Fix no-desMatt Caswell
Numerous fixes for no-des. Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 07:48:33 +0000