summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2020-07-16Update copyright yearRichard Levitte
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12463)
2020-07-16Revert "kdf: make function naming consistent."Matt Caswell
The commit claimed to make things more consistent. In fact it makes it less so. Revert back to the previous namig convention. This reverts commit 765d04c9460a304c8119f57941341a149498b9db. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12186)
2020-07-16Revert "The EVP_MAC functions have been renamed for consistency. The ↵Matt Caswell
EVP_MAC_CTX_*" The commit claimed to make things more consistent. In fact it makes it less so. Revert back to the previous namig convention. This reverts commit d9c2fd51e2e278bc3f7793a104ff7b4879f6d63a. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12186)
2020-07-16deprecate engine testsPauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12226)
2020-07-16Add SSL_get[01]_peer_certificate()Todd Short
Deprecate SSL_get_peer_certificte() and replace with SSL_get1_peer_certificate(). Add SSL_get0_peer_certificate. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8730)
2020-07-15Make -provider_name and -section_name optionalRich Salz
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12311)
2020-07-15Add AES_CBC_CTS ciphers to providersShane Lontis
Added Algorithm names AES-128-CBC-CTS, AES-192-CBC-CTS and AES-256-CBC-CTS. CS1, CS2 and CS3 variants are supported. Only single shot updates are supported. The cipher returns the mode EVP_CIPH_CBC_MODE (Internally it shares the aes_cbc cipher code). This would allow existing code that uses AES_CBC to switch to the CTS variant without breaking code that tests for this mode. Because it shares the aes_cbc code the cts128.c functions could not be used directly. The cipher returns the flag EVP_CIPH_FLAG_CTS. EVP_CIPH_FLAG_FIPS & EVP_CIPH_FLAG_NON_FIPS_ALLOW have been deprecated. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12094)
2020-07-14DRBG: rename the DRBG taxonomy.Pauli
The existing wording didn't capture the reality of the default setup, this new nomenclature attempts to improve the situation. Reviewed-by: Mark J. Cox <mark@awe.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12366)
2020-07-12[test] ectest: check custom generatorsBilly Brumley
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12096)
2020-07-11Add and use internal header that implements endianness checkRichard Levitte
This moves test/ossl_test_endian.h to include/internal/endian.h and thereby makes the macros in there our standard way to check endianness in run-time. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/12390)
2020-07-09Fix wrong fipsinstall key used in testShane Lontis
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12402)
2020-07-09Add multiple fixes for ffc key generation using invalid p,q,g parameters.Shane Lontis
Fixes #11864 - The dsa keygen assumed valid p, q, g values were being passed. If this is not correct then it is possible that dsa keygen can either hang or segfault. The fix was to do a partial validation of p, q, and g inside the keygen. - Fixed a potential double free in the dsa keypair test in the case when in failed (It should never fail!). It freed internal object members without setting them to NULL. - Changed the FFC key validation to accept 1024 bit keys in non fips mode. - Added tests that use both the default provider & fips provider to test these cases. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12176)
2020-07-08Fix CID 1465213: Integer handling issues (evp_extra_test.c)Shane Lontis
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12379)
2020-07-08Fix CID 1465215 : Explicit null dereferenced (in test)Shane Lontis
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12379)
2020-07-08Add a test to check having a provider loaded without a groups still worksMatt Caswell
As long as we have at least one provider loaded which offers some groups, it doesn't matter if we have others loaded that don't. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12292)
2020-07-07Add support to zeroize plaintext in S3 record layerMartin Elshuber
Some applications want even all plaintext copies beeing zeroized. However, currently plaintext residuals are kept in rbuf within the s3 record layer. This patch add the option SSL_OP_CLEANSE_PLAINTEXT to its friends to optionally enable cleansing of decrypted plaintext data. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12251)
2020-07-06[test][15-test_genec] Improve EC tests with genpkeyNicola Tuveri
Test separately EC parameters and EC key generation. Some curves only support explicit params encoding. For some curves we have had cases in which generating the parameters under certain conditions failed, while generating and serializing a key under the same conditions did not. See <https://github.com/openssl/openssl/issues/12306> for more details. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12307)
2020-07-06Ensure the sslcorrupttest checks all errors on the queueMatt Caswell
sslcorrupttest was looking for a "decryption failed or bad record mac" error in the queue. However if there were multiple errors on the queue then it would fail to find it. We modify the test to check all errors. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12288)
2020-07-06Move MAC removal responsibility to the various protocol "enc" functionsMatt Caswell
For CBC ciphersuites using Mac-then-encrypt we have to be careful about removing the MAC from the record in constant time. Currently that happens immediately before MAC verification. Instead we move this responsibility to the various protocol "enc" functions so that MAC removal is handled at the same time as padding removal. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12288)
2020-07-05TEST: update 02-test_errstr.t to have better testsRichard Levitte
We now check that if libcrypto hasn't loaded the string for some particular system error, it gives us "reason(nnn)" instead, where 'nnn' is the system error number in decimal. We go through all possible error macros that perl serves us, not only the POSIX ones. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/12343)
2020-07-05TEST: fix test/errtest.cRichard Levitte
test/errtest.c used the system error code 1 for EPERM. However, EPERM may be coded differently on different systems, so we switch to using EPERM instead. However, because we know that the ERR sub-system truncates system error codes that occupy more than 24 bits, we check that the reason code in the recorded error matches our EPERM, and skip the test if not. To be safe (even though the error string for that code is well defined in POSIX), we also use strerror() to retrieve the string for that error code instead of using a hard coded value. Fixes #12276 Fixes #12217 Fixes #12354 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/12343)
2020-07-05Fix many MarkDown issues in {NOTES*,README*,HACKING,LICENSE}.md filesDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12109)
2020-07-05Rename NOTES*, README*, VERSION, HACKING, LICENSE to .md or .txtDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12109)
2020-07-03Don't run the cmp_cli tests if using FUZZING_BUILD_MODEMatt Caswell
[extended tests] Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12275)
2020-07-0381-test_cmp_cli.t: Correct subroutine quote_spc_empty and its useDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12280)
2020-07-0381-test_cmp_cli.t: Streamline {start,stop}_mock_server and improve port settingDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12280)
2020-07-03test/run_tests.pl: Add alias REPORT_FAILURES{,_PROGRESS} for VF and VFPDr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12279)
2020-07-03test/run_tests.pl: Add visual separator after failed test case for VFP and ↵Dr. David von Oheimb
VFP modes Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12279)
2020-07-03test/run_tests.pl: Enhance the semantics of HARNESS_VERBOSE_FAILURES (VF)Dr. David von Oheimb
Make the improved semantics of VFO replace the previous VF and remove VFO Add warnings about overriding use of HARNESS_VERBOSE* variables Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12279)
2020-07-02[test/README.md] minor fix of examples missing the test targetNicola Tuveri
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/12326)
2020-07-02Run tests in parallelNicola Tuveri
The environment variable `HARNESS_JOBS` can be used to control how many jobs to run in parallel. The default is still to run jobs sequentially. This commit does not define custom `rules`, and different versions of `TAP::Harness` come with different strategies regarding the default `rules` that define which test recipes can be run in parallel. In recent versions of Perl, unless specified otherwise any task can be run in parallel. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/12326)
2020-07-01Add X509_self_signed(), extending and improving documenation and testsDr. David von Oheimb
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Fix issue 1418 by moving check of KU_KEY_CERT_SIGN and weakening check_issued()Dr. David von Oheimb
Move check that cert signing is allowed from x509v3_cache_extensions() to where it belongs: internal_verify(), generalize it for proxy cert signing. Correct and simplify check_issued(), now checking self-issued (not: self-signed). Add test case to 25-test_verify.t that demonstrates successful fix Fixes #1418 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Add four more verify test cases on the self-signed Ed25519 and self-issed ↵Dr. David von Oheimb
X25519 certs Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Make x509 -force_pubkey test case with self-issued cert more realisticDr. David von Oheimb
by adding CA basic constraints, CA key usage, and key IDs to the cert and by add -partial_chain to the verify call that trusts this cert Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-07-01Improve documentation, layout, and code comments regarding self-issued certs ↵Dr. David von Oheimb
etc. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-06-29Add --fips-key configuration parameter to fipsinstall application.Rich Salz
Change default FIPS HMAC KEY from all-zero's Use default FIPSKEY if not given on command line. Make all -macopt in fipsinstall optional Make all tests, except fipsinstall, use the default -macopt and -mac_name flags. Define and use FIPSDIR variable on VMS/MMS. Also use SRCDIR/BLDDIR in SRCTOP/BLDTOP. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12235)
2020-06-28Move test-related info from INSTALL.md to new test/README.md, updating ↵Dr. David von Oheimb
references Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12232)
2020-06-28Add a test to make sure ASYNC aware code gets the right default libctxMatt Caswell
Even if a fibre changes the default libctx - or the main application code changes it, the "current" default libctx should remain consistent. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12228)
2020-06-28TEST: Add test to exercise OPENSSL_CTX_set0_default()Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12228)
2020-06-27Reduce the security bits for MD5 and SHA1 based signatures in TLSKurt Roeckx
This has as effect that SHA1 and MD5+SHA1 are no longer supported at security level 1, and that TLS < 1.2 is no longer supported at the default security level of 1, and that you need to set the security level to 0 to use TLS < 1.2. Reviewed-by: Tim Hudson <tjh@openssl.org> GH: #10787
2020-06-27Fix syntax of cipher stringKurt Roeckx
Reviewed-by: Tim Hudson <tjh@openssl.org> GH: #10787
2020-06-26TEST: Add TODO segments in test/recipes/15-test_genec.tRichard Levitte
There currently do not support 'ec_param_enc:explicit' with provider side key generation. Reflect that by encoding the expected failure with a Test::More TODO section for those particular tests. Because the tests in this recipe are data driven, we implement this mechanism with two functions, one for stuff that's supported and one for stuff that isn't. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12080)
2020-06-26Test genpkey app for EC keygen with various argsNicola Tuveri
This commit adds a new recipe to test EC key generation with the `genpkey` CLI app. For each built-in curve, it tests key generation with text output, in PEM and in DER format, using `explicit` and `named_curve` for parameters encoding. The list of built-in curves is static at the moment, as this allows to differentiate between prime curves and binary curves to avoid failing when ec2m is disabled. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12080)
2020-06-25Update copyright yearMatt Caswell
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12273)
2020-06-24Make the naming scheme for dispatched functions more consistentDr. Matthias St. Pierre
The new naming scheme consistently usese the `OSSL_FUNC_` prefix for all functions which are dispatched between the core and providers. This change includes in particular all up- and downcalls, i.e., the dispatched functions passed from core to provider and vice versa. - OSSL_core_ -> OSSL_FUNC_core_ - OSSL_provider_ -> OSSL_FUNC_core_ For operations and their function dispatch tables, the following convention is used: Type | Name (evp_generic_fetch(3)) | ---------------------|-----------------------------------| operation | OSSL_OP_FOO | function id | OSSL_FUNC_FOO_FUNCTION_NAME | function "name" | OSSL_FUNC_foo_function_name | function typedef | OSSL_FUNC_foo_function_name_fn | function ptr getter | OSSL_FUNC_foo_function_name | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12222)
2020-06-24Rename <openssl/core_numbers.h> -> <openssl/core_dispatch.h>Dr. Matthias St. Pierre
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12222)
2020-06-24test: add test for generation of random data in chunks.Pauli
THe EVP_RAND wrapper works with the underlying RNG to produce the amount of random data requested even if it is larger than the largest single generation the source allows. This test verified that this works. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24test: update EVP tests to include DRBG testingPauli
[extended tests] Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
2020-06-24NIST DRBG set dataPauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11682)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-28 00:55:59 +0000