summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2021-02-18Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14235)
2021-02-18dsa_check: Perform simple parameter check if seed is not availableTomas Mraz
Added primality check on p and q in the ossl_ffc_params_simple_validate(). Checking for p and q sizes in the default provider is made more lenient. Added two testcases for invalid parameters. Fixes #13950 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14148)
2021-02-18DSA parameter check using pkeyparamDmitry Belyavskiy
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14148)
2021-02-17Rename OSSL_ENCODER_CTX_new_by_EVP_PKEY and OSSL_DECODER_CTX_new_by_EVP_PKEYTomas Mraz
Additional renames done in encoder and decoder implementation to follow the style. Fixes #13622 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14155)
2021-02-17test: DRBG test with long seed.Pauli
Fixes: #14101 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14162)
2021-02-16TEST: Add missing initializationRichard Levitte
Compiler complained. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14204)
2021-02-16Fix rsa_test to properly test RSA_SSLV23_PADDINGMatt Caswell
We test all three cases: - An SSLv2 only client talking to a TLS capable server - A TLS capable client talking to an SSLv2 only server - A TLS capable client talking to a TLS capable server (should fail due to detecting a rollback attack) Reviewed-by: Paul Dale <pauli@openssl.org>
2021-02-16Refactor rsa_testMatt Caswell
Reduce code copying by factoring out common code into a separate function. Reviewed-by: Paul Dale <pauli@openssl.org>
2021-02-15Fix the dhparam_check testMatt Caswell
genpkey can sometimes create files that fail "openssl dhparam -check". See issue #14145. We had some instances of such invalid files in the dhparam_check test. Now that "openssl dhparam -check" has been fixed to work the same way as it did in 1.1.1 these tests were failing. We move the invalid files inot the "invalid" directory. A future PR will have to fix genpkey to not generate invalid files. We also remove a "SKIP" block that was skipping tests in a no deprecated build unnecessarily. Nothing being tested is deprecated. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14146)
2021-02-12ssl_test: Add testcases for disallowing non-TLS1.3 curves with TLS1.3Tomas Mraz
Also correctly mark max protocol version for some curves. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14154)
2021-02-12Deprecate the libssl level SRP APIsMatt Caswell
The low level SRP implementation has been deprecated with no replacement. Therefore the libssl level APIs need to be similarly deprecated. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
2021-02-12Deprecate the low level SRP APIsMatt Caswell
The OTC decided that all low level APIs should be deprecated. This extends to SRP, even though at the current time there is no "EVP" interface to it. This could be added in a future release. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
2021-02-12test: add import and export key management hooks for the TLS provider.Pauli
Without these hooks, if the TLS provider isn't matched in the fetch cache, a test failure will occur in the TLS API tests. Without allowing import and export, an existing key can not move to a new key manager even if it is really the same. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14126)
2021-02-12test: filter provider honours the no_cache setting.Pauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14126)
2021-02-12test: fix no-cache problem with the quality comparison for KDFs.Pauli
In a caching world, it's fine to compare the pointers directly. In a non-caching world, the names and providers need to be compared. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14126)
2021-02-12test: add an option to output timing information from tests.Pauli
Fixes #14141 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14149)
2021-02-11X509_STORE_CTX_cleanup(): Use internally so no need to call explicitlyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14088)
2021-02-11test: turn off parallel tests in verbose mode.Pauli
The existing code prints a warning saying that verbose mode is ignored with parallel jobs. This seems backward, more useful is disabling parallel jobs when verbose is enabled. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14137)
2021-02-10Change the ASN1 variant of x942kdf so that it can test acvp data.Shane Lontis
This 'special' way of specifying the data should only be used for testing purposes. It should not be used in production environments. ACVP passes a blob of DER encoded data for some of the fields rather than passing them as separate fields that need to be DER encoded. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14077)
2021-02-09Deprecate BN_pseudo_rand() and BN_pseudo_rand_range()Tomas Mraz
The functions are obsolete aliases for BN_rand() and BN_rand_range() since 1.1.0. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14080)
2021-02-09Enhanced integer parsing in OSSL_PARAM_allocate_from_textPetr Gotthard
Fixes #14041 and additional bugs discovered by the newly created tests. This patch: - Introduces support for 0x prefixed integers - Fixes parsing of negative integers (negative numbers were shifted by -2) - Fixes ability to parse maximal unsigned numbers ("too small buffer" error used to be reported incorrectly) - Fixes a memory leak when OSSL_PARAM_allocate_from_text fails leaving a temporary BN allocated Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14093)
2021-02-08Enable fipsload test on NonStop x86.Randall S. Becker
CLA: Trivial Fixes: #14005 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14006)
2021-02-08Simplify the EVP_PKEY_XXX_fromdata_XX methods.Shane Lontis
The existing names such as EVP_PKEY_param_fromdata_settable were a bit confusing since the 'param' referred to key params not OSSL_PARAM. To simplify the interface a 'selection' parameter will be passed instead. The changes are: (1) EVP_PKEY_fromdata_init() replaces both EVP_PKEY_key_fromdata_init() and EVP_PKEY_param_fromdata_init(). (2) EVP_PKEY_fromdata() has an additional selection parameter. (3) EVP_PKEY_fromdata_settable() replaces EVP_PKEY_key_fromdata_settable() and EVP_PKEY_param_fromdata_settable(). EVP_PKEY_fromdata_settable() also uses a selection parameter. Fixes #12989 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14076)
2021-02-06Add X509_STORE_CTX_verify(), which takes the first untrusted cert as default ↵Dr. David von Oheimb
target Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14021)
2021-02-05Fix the cipher_overhead_testMatt Caswell
Now that libssl no longer has any OPENSSL_NO_ALG guards the internal cipher_overhead_test wasn't quite handling disabled ciphers correctly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05Stop disabling TLSv1.3 if ec and dh are disabledMatt Caswell
Even if EC and DH are disabled then we may still be able to use TLSv1.3 if we have groups that have been plugged in by an external provider. Fixes #13767 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-05TEST: Add an algorithm ID tester for libcrypto vs providerRichard Levitte
Providers produce algorithm IDs of their own, and we need to compare them against the same thing produced by libcrypto's ASN.1 code and with legacy keys. This tester can compare algorithm IDs for signatures and for keys, given certificates that hold such data. To verify key algorithm IDs, only one certificate is necessary, and its public key is used. To verify certificate algorithm IDs, we need to launch the signature operation that would verify a certificate against the public key of its signing CA, so that test needs two files. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14049)
2021-02-05RSA: properly generate algorithm identifier for RSA-PSS signaturesTomas Mraz
Fixes #13969 - properly handle the mandatory RSA-PSS key parameters - improve parameter checking when setting the parameters - compute the algorithm id at the time it is requested so it reflects the actual parameters set - when generating keys do not override previously set parameters with defaults - tests added to the test_req recipe that should cover the PSS signature handling Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13988)
2021-02-05apps/openssl: add -propquery command line optionPetr Gotthard
Fixes #13656. Right now all openssl commands use a NULL propq. This patch adds a possibility to specify a custom propq. The implementation follows the example of set_nameopt/get_nameopt. Various tools had to be modified to call app_get0_propq after it has been populated. Otherwise the -propquery has no effect. The tests then verify the -propquery affects the tool behaviour by requesting a non-existing property. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13707)
2021-02-04DH/DHX parameter check using pkeyparamDmitry Belyavskiy
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13930)
2021-02-04Allow NULL arg to OPENSSL_sk_{dup,deep_copy} returning empty stackDr. David von Oheimb
This simplifies many usages Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14040)
2021-02-04run_tests.pl: Improve diagnostics on the use of HARNESS_JOBSDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13551)
2021-02-04test/recipes: split 81_test_cmp_cli.t, add test using -engine loader_atticDr. David von Oheimb
The HTTP-based tests are now in 80_test_cmp_http.t, to start a little earlier. This should decrease total test run time due to better parallelization. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13551)
2021-02-02Add a multi-thread test for shared EVP_PKEYsMatt Caswell
EVP_PKEYs may be shared across mutliple threads. For example this is common for users of libssl who provide a single EVP_PKEY private key for an SSL_CTX, which is then shared between multiple threads for each SSL object. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
2021-02-01Test that EC keys without a public key in them work as expectedMatt Caswell
We create EC keys via both the "fromdata" and legacy key routes to make sure that they can be used without a public key. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13922)
2021-01-29rsa_kmgmt: Return OSSL_PKEY_PARAM_DEFAULT_DIGEST for unrestricted PSS keysTomas Mraz
Add a testcase to the test_req covering the issue. Fixes #13957 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13967)
2021-01-28EVP: fix keygen for EVP_PKEY_RSA_PSSDaniel Bevenius
This commit attempts to fix the an issue when generating a key of type EVP_PKEY_RSA_PSS. Currently, EVP_PKEY_CTX_set_rsa_keygen_bits will return -1 if the key id is not of type EVP_PKEY_RSA. This commit adds EVP_PKEY_RSA_PSS to also be accepted. The macro EVP_PKEY_CTX_set_rsa_pss_keygen_md si converted into a function and it is now called in legacy_ctrl_to_param. Fixes #12384 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13099)
2021-01-28Fix parameter types in sshkdfJuergen Christ
Handling of parameter OSSL_KDF_PARAM_SSHKDF_TYPE mixed integer and string parameters. This caused endianness problems on big-endian machines. As a result, it is not possible to pass FIPS tests since the parameter was stored with an integer value but read via a cast to char pointer. While this works on little endian machines, big endian s390 read the most significant bits instead of the least significant (as done by, e.g., x86). Change the parameter to char array and fix the usages. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/13781)
2021-01-28check_sig_alg_match(): weaken sig nid comparison to allow RSA{,PSS} key ↵Dr. David von Oheimb
verify RSA-PSS This is an upstream fix for #13931 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13968)
2021-01-28Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
2021-01-27Fix running mingw dhparam test under wineMatt Caswell
The dhparam test was failing to properly handle line endings when running a mingw configured build under wine. Fixes #13557 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13923)
2021-01-26TLS client: allow cert verify callback return -1 for SSL_ERROR_WANT_RETRY_VERIFYDr. David von Oheimb
The client-side cert verification callback function may not only return as usual for success or 0 for failure, but also -1, typically on failure verifying the server certificate. This makes the handshake suspend and return control to the calling application with SSL_ERROR_WANT_RETRY_VERIFY. The app can for instance fetch further certificates or cert status information needed for the verification. Calling SSL_connect() again resumes the connection attempt by retrying the server certificate verification step. This process may even be repeated if need be. The core implementation of the feature is in ssl/statem/statem_clnt.c, splitting tls_process_server_certificate() into a preparation step that just copies the certificates received from the server to s->session->peer_chain (rather than having them in a local variable at first) and returns to the state machine, and a post-processing step in tls_post_process_server_certificate() that can be repeated: Try verifying the current contents of s->session->peer_chain basically as before, but give the verification callback function the chance to pause connecting and make the TLS state machine later call tls_post_process_server_certificate() again. Otherwise processing continues as usual. The documentation of the new feature is added to SSL_CTX_set_cert_verify_callback.pod and SSL_want.pod. This adds two tests: * A generic test in test/helpers/handshake.c on the usability of the new server cert verification retry feature. It is triggered via test/ssl-tests/03-custom_verify.cnf.in (while the bulky auto- generated changes to test/ssl-tests/03-custom_verify.cnf can be basically ignored). * A test in test/sslapitest.c that demonstrates the effectiveness of the approach for augmenting the cert chain provided by the server in between SSL_connect() calls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13906)
2021-01-26Check that the ecparam and pkeyparam do not mangle the parametersTomas Mraz
Just comparison of the original parameter file with the -out output. Some test files have non-canonical encoding, so they are moved to a different directory. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-26ssl_old_test.c: Replace use of deprecated EC functionsTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-26Avoid using OSSL_PKEY_PARAM_GROUP_NAME when the key might be legacyTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-26Disable the test-ec completely when building with no-ecTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-26Deprecate EC_KEY + Update ec apps to use EVP_PKEYShane Lontis
Co-author: Richard Levitte <levitte@openssl.org> Co-author: Tomas Mraz <tmraz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-22Fix no-dh and no-dsaMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13915)
2021-01-21dh_cms_set_shared_info: Use explicit fetch to be able to provide libctxTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13869)
2021-01-21Make the smdh.pem test certificate usable with fips providerTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13869)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-29 14:44:28 +0000