summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2022-06-21Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2022-06-16Have set_dateopt() return 1 on success to make -dateopt workHartmut Holzgraefe
Fixes #18553 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18554)
2022-06-16test/recipes/*.t: setup() doesn't play well with spaces in the argumentRichard Levitte
The argument translates into a directory name, and there are platforms that don't allow spaces (at least not easily), which makes the test fail. This modifies it to conform a bit better to the usual form for that arg. Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18531) (cherry picked from commit e3ba938b584275839dda404d846abdb06a88693f)
2022-06-16Add an extra reduction step to RSAZ mod_exp implementationsTomas Mraz
Inspired by BoringSSL fix by David Benjamin. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18510) (cherry picked from commit 6d702cebfce3ffd9d8c0cb2af80a987d3288e7a3)
2022-06-16Always end BN_mod_exp_mont_consttime with normal Montgomery reduction.Tomas Mraz
This partially fixes a bug where, on x86_64, BN_mod_exp_mont_consttime would sometimes return m, the modulus, when it should have returned zero. Thanks to Guido Vranken for reporting it. It is only a partial fix because the same bug also exists in the "rsaz" codepath. The bug only affects zero outputs (with non-zero inputs), so we believe it has no security impact on our cryptographic functions. The fx is to delete lowercase bn_from_montgomery altogether, and have the mont5 path use the same BN_from_montgomery ending as the non-mont5 path. This only impacts the final step of the whole exponentiation and has no measurable perf impact. See the original BoringSSL commit https://boringssl.googlesource.com/boringssl/+/13c9d5c69d04485a7a8840c12185c832026c8315 for further analysis. Original-author: David Benjamin <davidben@google.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18510) (cherry picked from commit 0ae365e1f80648f4c52aa3ac9bbc279b6192b23e)
2022-06-16test/ssl_old_test.c: Add check for OPENSSL_mallocJiasheng Jiang
As the potential failure of the OPENSSL_malloc(), it should be better to add the check and return error if fails. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18555) (cherry picked from commit b2feb9f0e394da6570346598837f1b01eb58c028)
2022-06-15test/ssl_old_test.c: Add check for OPENSSL_zallocJiasheng Jiang
As the potential failure of the OPENSSL_zalloc(), it should be better to add the check and return error if fails. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18552) (cherry picked from commit 4f4942a133bd57c4940fb1bc6ed7c8b67da4d8f0)
2022-06-15Fix a mem leak in evp_pkey_export_to_providerK1
If keymgmt is NULL, tmp_keymgmt is allocated and will not be freed. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18499) (cherry picked from commit 115eb945acd9a27bf81c6c8923f43768f9e487a8)
2022-06-15Fix a crash in X509v3_asid_subset()Matt Caswell
If the asnum or rdi fields are NULL and the ASIdentifiers are otherwise subsets then this will result in a crash. Of note is that rdi will usually be NULL. Reported by Theo Buehler (@botovq) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18514) (cherry picked from commit 01fc9b6bce82f0534d6673659a0e59a71f57ee82)
2022-06-15test/evp_test.c: Check too big output buffer sizes in PKEYKDF testsRichard Levitte
EVP_PKEY_derive() should be able to cope with a too big buffer for fixed size outputs. However, we don't test that. This change modifies the PKEYKDF tests to ask EVP_PKEY_derive() what the desired output buffer size is, and as long as the returned value isn't absurd (indicating that anything goes), the output buffer is made to be twice as big as what is expected. Tests #18517 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18533)
2022-06-15test_pkey_check: Positive testcase for private key with unknown parametersTomas Mraz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18099) (cherry picked from commit 08e0aad293f1c283dccf7e9065ec28af5e143304)
2022-06-15Testcase for regression by PPC64 fixed length montgomery multiplicationTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18512) (cherry picked from commit 14f95126c098358c434d59835834f9f0be7ea498)
2022-06-05Update further expiring certificates that affect testsTomas Mraz
Namely the smime certificates used in test_cms and the SM2 certificates will expire soon and affect tests. Fixes #15179 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18467) (cherry picked from commit 5d219937d067a761fb871483369a6020c60a3cb8)
2022-06-03Change the SCT issuer key to RSA 2048Bernd Edlinger
This avoids the need to use SECLEVEL=1 in 12-ct.cnf.in. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18450) (cherry picked from commit 479b9adb88b9050186c1e9fc94879906f378b14b)
2022-06-02Fix the checks of UI_add_input_stringPeiwei Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18424) (cherry picked from commit 5755c11fd6e50028946e6e17c835afcd56995699)
2022-06-02Fix the checks of EVP_PKEY_private_checkPeiwei Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18424) (cherry picked from commit babc818c3f669214fa192229003953e3dead1926)
2022-06-02Fix the checks of EVP_PKEY_public_checkPeiwei Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18424) (cherry picked from commit bba14c6e28e9519b2d40fc5c551893996f2db246)
2022-06-02Fix the checks of EVP_PKEY_pairwise_checkPeiwei Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18424) (cherry picked from commit d016758706d0a7a104ff09db94448aeec1b38193)
2022-06-02Fix the checks of EVP_PKEY_checkPeiwei Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18424) (cherry picked from commit 92d0d7ea9be40909ee79fb8861641a61eead2431)
2022-06-02Fix the checks of RAND_bytesPeiwei Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18424) (cherry picked from commit c2f7614fb7b93fe3792068077ff01384f42f39bc)
2022-06-02threadstest: Add missing framework for multithread testsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18451)
2022-06-02Fix the checks of EVP_PKEY_CTX_set/get_* functionsPeiwei Hu
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18399) (cherry picked from commit 2cba2e160d5b028e4a777e8038744a8bc4280629)
2022-06-02Fix the checks of EVP_PKEY_CTX_get/set_rsa_pss_saltlenPeiwei Hu
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18399) (cherry picked from commit 7263a7fc3d0c0c17616c2e5309e0fd52ed654ecc)
2022-06-02Fix the erroneous checks of EVP_PKEY_CTX_set_group_namePeiwei Hu
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18399) (cherry picked from commit 56876ae952b96b4a83266f6b2ec1393f599015d6)
2022-06-01Update expired SCT issuer certificateTomas Mraz
Fixes #15179 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/18444) (cherry picked from commit 770aea88c3888cc5cb3ebc94ffcef706c68bc1d2)
2022-06-01Make OSSL_LIB_CTX_load_config thread safeHugo Landau
Fixes #18226. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18331) (cherry picked from commit ef7a9b44f04ef18b652cb47cd9eb3826301cca9e)
2022-05-27Check that UnsafeLegacyServerConnect option existsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/18296) (cherry picked from commit abe90105ba0908d5a2f500997f2bf2fceb263acd)
2022-05-27Fix the incorrect checks of EVP_CIPHER_CTX_rand_keyPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18397) (cherry picked from commit f15e3f3aa95df743f0da793da952f87370efb4ff)
2022-05-27Fix the incorrect checks of EVP_CIPHER_CTX_set_key_lengthPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18397) (cherry picked from commit 8d9fec1781751d2106d899c6076eeb3da6930bfe)
2022-05-24Fix check of EVP_CIPHER_CTX_ctrlPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18368) (cherry picked from commit d649c51a5388912277dffb56d921eb720db54be1)
2022-05-23Test the default key length of the Blowfish ciphersTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18362) (cherry picked from commit 091e60c42c5d2a194936da7f4de3ce82527b27a3)
2022-05-17Fix KTLS with BIO_new_connectBernd Edlinger
When a socket connection is done using BIO_new_connect, the ktls_enable is done too early, and fails with ENOTCONN. Therefore the KLTS ioctl will fail later with ENOPROTOOPT. Fix that by doing the ktls_enable after the connection succeeded, not when the socket is created as that will always fail. One example where this happens is doit_localhost in test/ssl_old_test.c, and therefore, contrary to the expectation the -client_ktls option did never enable the client KTLS connection, but this was not noticed, because there was no diagnostic output, and it was only visible with strace output. Also enhanced the ssl_old_test -client_ktls/-server_ktls options together with -v option to print a summary line if and how KTLS was negotiated in server and client. While I am already there adjusted the usage info of the -s_cert, -s_key commands, and allow -time to print the timings of ktls connections. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18318) (cherry picked from commit 598bd7741568a1aae678e5472f18aae1ab991e8d)
2022-05-13Include the e_os.h before string.hTomas Mraz
Fixes #18244 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18293)
2022-05-13Fix build on OPENSSL_SYS_TANDEM and older POSIXesTomas Mraz
It also allows for passing -DOPENSSL_NO_LOCALE as a workaround to ./Configure command. Fixes #18233 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18293)
2022-05-12Add test for query invalidation after new provider addedTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18269) (cherry picked from commit 70dc0b6d27a11a7f64fe914a3f376988ad1b1720)
2022-05-09Add a testcase for OSSL_PROVIDER_unload() being fully effectiveTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18254) (cherry picked from commit 4b4d0ded6df357f76f580b7218abb3fe55f64463)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-05-03Fix the RC4-MD5 cipherMatt Caswell
A copy&paste error meant that the RC4-MD5 cipher (used in TLS) used the TLS AAD data as the MAC key. CVE-2022-1434 Fixes #18112 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-05-03Test ocsp with invalid responses and the "-no_cert_checks" optionMatt Caswell
The "-no_cert_checks" option causes the flag OCSP_NOCHECKS to be set. The bug fixed in the previous commit will cause the ocsp app to respond with a success result in the case when the OCSP response signing certificate fails to verify and -no_cert_checks is used - so we test that it fails in this case. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-05-02Improving locale testDmitry Belyavskiy
Fixes #18205 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18211) (cherry picked from commit 93983e555531a8d9bf70d12e4cfdb5ce2f337e3b)
2022-04-29Fix memleak in test/provider_test.cRichard Levitte
This memory leak is triggered when configuring with 'no-legacy' Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/18179) (cherry picked from commit 49d874e0b7514cb270e817103ff0e13d4689e1f0)
2022-04-27Add SSL_(CTX_)?get0_(verify|chain)_cert_store functionsHugo Landau
Currently we do not have any way to retrieve these values once set. Fixes #18035. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18038) (cherry picked from commit 948cf521798a801cfde47a137343e6f958d71f04)
2022-04-27Test that SipHash_Final() fails on uninited contextTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18142) (cherry picked from commit 4b694f29ea78ab8a94e67c89d4d81df18c5e3bf1)
2022-04-26Testing the EVP_PKEY_CTX_new_from_name without preliminary initDmitry Belyavskiy
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18175)
2022-04-21str[n]casecmp => OPENSSL_strncasecmpDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21Minimal test checking we can get public key in Turkish localeDmitry Belyavskiy
(cherry picked from commit 6ae39acaf0c3578850be6699026a3a5c3f4bdfce) Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21Clear incorrectly reported errors in cms_io.Daniel Fiala
Fixes openssl#17841. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18109) (cherry picked from commit 45a3c592b94b66cab72e5bffbaf9d810c3fb29c0)
2022-04-19evp_test: Try computing MACs twice with reinitialization of EVP_MAC_CTXTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18100) (cherry picked from commit e58ba181de6b0dfad0dc371f8d962c82138a906e)
2022-04-14Fix an assertion in the DTLS server codeBernd Edlinger
This fixes an internal error alert from the server and an unexpected connection failure in the release version, but a failed assertion and a server crash in the debug version. Reproduce this issue with a DTLS server/client like that: ./openssl s_server -dtls -mtu 1500 ./openssl s_client -dtls -maxfraglen 512 In the debug version a crash happens in the Server now: ./openssl s_server -dtls -mtu 1500 Using default temp DH parameters ACCEPT ssl/statem/statem_dtls.c:269: OpenSSL internal error: Assertion failed: len == written Aborted (core dumped) While in the release version the handshake exceeds the negotiated max fragment size, and fails because of this: $ ./openssl s_server -dtls -mtu 1500 Using default temp DH parameters ACCEPT ERROR 4057152ADA7F0000:error:0A0000C2:SSL routines:do_dtls1_write:exceeds max fragment size:ssl/record/rec_layer_d1.c:826: shutting down SSL CONNECTION CLOSED From the client's point of view the connection fails with an Internal Error Alert: $ ./openssl s_client -dtls -maxfraglen 512 Connecting to ::1 CONNECTED(00000003) 40B76343377F0000:error:0A000438:SSL routines:dtls1_read_bytes:tlsv1 alert internal error:ssl/record/rec_layer_d1.c:613:SSL alert number 80 and now the connection attempt fails unexpectedly. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18093) (cherry picked from commit e915c3f5381cd38ebdc1824c3ba9896ea7160103)
2022-04-14endecode_test: Handle expected failures for non-fips ec keysTomas Mraz
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17998) (cherry picked from commit e8a4145968eea576788761f39c5e4cb68b7c4a42)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-09 06:25:25 +0000