summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2021-04-22Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14986)
2021-04-22Fix typosMichaM
CLA: trivial Signed-off-by: MichaM <contact-micha+github@posteo.de> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14879)
2021-04-21TEST: Adapt the EVP testRichard Levitte
The EVP test didn't recognise ERR_R_UNSUPPORTED, now does Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14834)
2021-04-21test: fix double free problems.Pauli
In function test_EVP_PKEY_ffc_priv_pub, params is freed via OSSL_PARAM_free() at line 577. If the condition at line 581 is true, the execution will goto err, and params will be freed again at line 630. The same problem also happens at line 593 and line 609, which causes two double free bugs. Bugs reported by @Yunlongs Fixes 14916 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14921)
2021-04-20Improve ossl_cmp_build_cert_chain(); publish it as X509_build_chain()Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14128)
2021-04-19Update krb5 module to latest releaseTomas Mraz
Fixes #14902 Also add workaround of `sudo hostname localhost` for the intermittent test failures seen in CI. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/14872)
2021-04-19Add a test for OSSL_LIB_CTX_set0_defaultMatt Caswell
Also includes testing for OSSL_LIB_CTX_get0_global_default(). Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14890)
2021-04-19Fix some TODO(3.0) occurrences in ssl/t1_lib.cMatt Caswell
One was related to probing for the combination of signature and hash algorithm together. This is currently not easily possible. The TODO(3.0) is converted to a normal comment and I've raised the problem as issue number #14885 as something to resolve post 3.0. The other TODO was a hard coded limit on the number of groups that could be registered. This has been amended so that there is no limit. Fixes #14333 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14886)
2021-04-19Avoid more MSVC-specific C runtime library functionsTanzinul Islam
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13540)
2021-04-19Add test for the IV handling of DES based ciphersTomas Mraz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14882)
2021-04-18TEST: Use OSSL_MAX_NAME_SIZE instead of arbitrary number of mdnameRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14498)
2021-04-18TEST: Modify how the retrieved digest name for SM2 digestsign is checkedRichard Levitte
Because of aliases, retrieved names won't always match one specific string. A safer way to check is to fetch the digest from the retrieved name and check it's the expected one with the help of EVP_MD_is_a(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14498)
2021-04-18TEST: Modify testutil's run_tests to display NOSUBTEST cases individuallyRichard Levitte
When test cases were added with ADD_ALL_TESTS_NOSUBTEST(), all those iteration verdicts were summarized as if it was one single case. This modification gets each iteration verdict displayed separately instead. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14498)
2021-04-18TEST: Modify test/evp_fetch_prov_test.c to also fetch by OIDRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14498)
2021-04-18Add "origin" field to EVP_CIPHER, EVP_MDRich Salz
Add a "where did this EVP_{CIPHER,MD} come from" flag: global, via fetch, or via EVP_{CIPHER,MD}_meth_new. Update EVP_{CIPHER,MD}_free to handle all three origins. The flag is deliberately right before some function pointers, so that compile-time failures (int/pointer) will occur, as opposed to taking a bit in the existing "flags" field. The "global variable" flag is non-zero, so the default case of using OPENSSL_zalloc (for provider ciphers), will do the right thing. Ref-counting is a no-op for Make up_ref no-op for global MD and CIPHER objects Deprecate EVP_MD_CTX_md(). Added EVP_MD_CTX_get0_md() (same semantics as the deprecated function) and EVP_MD_CTX_get1_md(). Likewise, deprecate EVP_CIPHER_CTX_cipher() in favor of EVP_CIPHER_CTX_get0_cipher(), and add EVP_CIPHER_CTX_get1_CIPHER(). Refactor EVP_MD_free() and EVP_MD_meth_free() to call new common evp_md_free_int() function. Refactor EVP_CIPHER_free() and EVP_CIPHER_meth_free() to call new common evp_cipher_free_int() function. Also change some flags tests to explicit test == or != zero. E.g., if (flags & x) --> if ((flags & x) != 0) if (!(flags & x)) --> if ((flags & x) == 0) Only done for those lines where "get0_cipher" calls were made. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14193)
2021-04-17Fix naming for EVP_RAND_CTX_gettable functions.Pauli
Change: EVP_RAND_gettable_ctx_params -> EVP_RAND_CTX_gettable_params EVP_RAND_settable_ctx_params -> EVP_RAND_CTX_settable_params Which brings them in line with the other similar functions for other algorithm types. Fixes #14880 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14893)
2021-04-16SipHash: Fix CTRL API for the digest size.Pauli
Adds a mapping from "digestsize" to "size" for setting a param. Fixes #14370 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14850)
2021-04-15Add EVP_PKEY_todata() and EVP_PKEY_export() functions.Shane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14800)
2021-04-15Rename EVP_PKEY_get0_first_alg_name to EVP_PKEY_get0_type_nameTomas Mraz
We use type elsewhere and documenting the 'first' in the name of the call is a little bit superfluous making the name too mouthful. Also rename EVP_PKEY_typenames_do_all to EVP_PKEY_type_names_do_all to keep the words separated by underscore. Fixes #14701 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14868)
2021-04-15Remove keymgmt_copy function from the provider APITomas Mraz
It is superceded by the keymgmt_dup. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14793)
2021-04-1480-test_cmp_http.t: Extend diagnostics of mock server launchDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14839)
2021-04-1480-test_cmp_http.t: Silence check for availability of 'kill' and 'lsof' commandsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14839)
2021-04-1480-test_cmp_http.t: Fix resumption when skipping after mock server launch failedDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14839)
2021-04-14APPS and TEST: Make sure prog name is set for usage outputDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14841)
2021-04-14Add domain parameter match check for DH and ECDH key exchange.Shane Lontis
Fixes #14808 Validation checks were moved into EVP_PKEY_derive_set_peer() which broke an external negative test. Originally the old code was semi working by checking the peers public key was in the range of other parties p. It was not actually ever checking that the domain parameters were consistent between the 2 parties. It now checks the parameters match as well as validating the peers public key. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14823)
2021-04-13Handle set_alpn_protos inputs better.Todd Short
It's possible to set an invalid protocol list that will be sent in a ClientHello. This validates the inputs to make sure this does not happen. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14815)
2021-04-13Add FIPS Self test for AES_ECB decryptShane Lontis
Fixes #14807 Compliance with IG 9.4 requires that an inverse cipher function be tested if one is implemented. Just running AES_GCM encrypt/decrypt does not meet this requirement (Since only ECB, CBC, XTS, KW, KWP support the inverse function during decryption mode). Added a mode to the cipher test so that the AES_GCM only does an encrypt and AES_ECB only does a decrypt. TDES still does both. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14825)
2021-04-12Remove the function EVP_PKEY_set_alias_typeMatt Caswell
OTC recently voted that EVP_PKEY types will be immutable in 3.0. This means that EVP_PKEY_set_alias_type can no longer work and should be removed entirely (applications will need to be rewritten not to use it). It was primarily used for SM2 which no longer needs this call. Applications should generate SM2 keys directly (without going via an EC key first), or otherwise when loading keys they should automatically be detected as SM2 keys. Fixes #14379 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14803)
2021-04-12Only enable KTLS if it is explicitly configuredMatt Caswell
It has always been the case that KTLS is not compiled by default. However if it is compiled then it was automatically used unless specifically configured not to. This is problematic because it avoids any crypto implementations from providers. A user who configures all crypto to use the FIPS provider may unexpectedly find that TLS related crypto is actually being performed outside of the FIPS boundary. Instead we change KTLS so that it is disabled by default. We also swap to using a single "option" (i.e. SSL_OP_ENABLE_KTLS) rather than two separate "modes", (i.e. SSL_MODE_NO_KTLS_RX and SSL_MODE_NO_KTLS_TX). Fixes #13794 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14799)
2021-04-12Always reset IV for CBC, OFB, and CFB mode on cipher context reinitTomas Mraz
This is necessary to keep compatibility with 1.1.1 implementation of the CBC, OFB, and CFB mode ciphers. Fixes #14704 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14811)
2021-04-12Replace OSSL_PARAM_BLD_free_params() with OSSL_PARAM_free().Shane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
2021-04-12Add OSSL_PARAM_dup() and OSSL_PARAM_merge().Shane Lontis
These functions are prerequisites for implementing EVP_PKEY_todata(). OSSL_PARAM_dup() is required to make a deep copy of the exported params (since the provider export() uses a OSSL_PARAM_BLD which throws away the data after the call), and then use OSSL_PARAM_merge() to add some additional params that can be passed to the EVP_PKEY_todata(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
2021-04-12kmac: add long customisation string examplePauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14810)
2021-04-09apps: fix warning about size_t / int conversionArmin Fuerst
Windows builds show the following warning: (..\apps\ca.c(2643): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data) Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14453)
2021-04-09Inherit hostflags verify params even without hostsChristian Heimes
X509_VERIFY_PARAM_inherit() now copies hostflags independently of hosts. Previously hostflags were only copied when at least one host was set. Typically applications don't configure hosts on SSL_CTX. The change enables applications to configure hostflags on SSL_CTX and have OpenSSL copy the flags from SSL_CTX to SSL. Fixes: https://github.com/openssl/openssl/issues/14579 Signed-off-by: Christian Heimes <christian@python.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14743)
2021-04-08PEM_X509_INFO_read_bio_ex(): Generalize to allow parsing any type of private keyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
2021-04-08d2i_PrivateKey{,_ex}() and PEM_X509_INFO_read_bio_ex(): Fix handling of ↵Dr. David von Oheimb
RSA/DSA/EC private key This is needed to correct d2i_PrivateKey() after it was changed by commit 576892d78f80cf9a. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
2021-04-08Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
2021-04-08test: add extra secure memory test case.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14782)
2021-04-08test: fix problem with threads test using default library context.Pauli
Also add a new test that deliberately tests the default library context. Fixes #14720 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14773)
2021-04-08test: fix coverity 1473234 & 1473239: argument cannot be negativePauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14620)
2021-04-07test/recipes/02-test_errstr.t: Do not test negative system error codesRichard Levitte
It's been deemed unlikely that these will end up in OpenSSL error records, so we simply don't test them if they happen to be among the error codes that perl has support for. Fixes #14763 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14779)
2021-04-07test: fix coverity 1475940: negative returnPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14769)
2021-04-07test: fix coverity 1475941: resource leakPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14769)
2021-04-07Fix potential double free in sslapitest.cNan Xiao
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14758)
2021-04-01Add a range check (from SP800-56Ar3) to DH key derivation.Shane Lontis
Fixes #14401 Note that this moves the public key check out of DH compute_key() since key validation does not belong inside this primitive.. The check has been moved to the EVP_PKEY_derive_set_peer() function so that it generally applies to all exchange operations.. Use EVP_PKEY_derive_set_peer_ex() to disable this behaviour. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14717)
2021-03-31OSSL_parse_url(): Improve handling of IPv6 addressesDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14630)
2021-03-3180-test_cmp_http.t: Add diagnostic info on starting/stopping mock serverDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14630)
2021-03-30Fix change in behaviour of EVP_PKEY_CTRL_RSA_KEYGEN_BITSMatt Caswell
In 1.1.1 the ctrl EVP_PKEY_CTRL_RSA_KEYGEN_BITS would fail immediately if the number of bits was too small. In 3.0 it always succeeds, and only fails later during the key generation stage. We fix that so that it fails early like it used to in 1.1.1. Note that in 1.1.1 it fails with a -2 return code. That is not the case in 3.0 and has not been addressed here (see #14442) Fixes #14443 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14702)
2021-03-30Merge OFB encrypt and decrypt test vectors.David Benjamin
There's no point in specifying them separately, since they're the same. Also the OFB-AES192.Decrypt vectors specified the wrong operation, so we were running some encryption tests twice and missing some decryption tests. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14625)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 09:00:30 +0000