summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2023-02-07Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-02-03Add testcase for missing return check of BIO_set_md() callsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
2023-02-03CVE-2023-0286: Fix GENERAL_NAME_cmp for x400Address (3.0)Hugo Landau
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-03Add test for DSA pubkey without param import and checkTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2023-02-03Fix NULL deference when validating FFC public key.slontis
Fixes CVE-2023-0217 When attempting to do a BN_Copy of params->p there was no NULL check. Since BN_copy does not check for NULL this is a NULL reference. As an aside BN_cmp() does do a NULL check, so there are other checks that fail because a NULL is passed. A more general check for NULL params has been added for both FFC public and private key validation instead. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-03Add test for d2i_PKCS7 NULL dereferenceTomas Mraz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org>
2023-02-03Check CMS failure during BIO setup with -stream is handled correctlyMatt Caswell
Test for the issue fixed in the previous commit Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-03Add a test for CVE-2022-4450Matt Caswell
Call PEM_read_bio_ex() and expect a failure. There should be no dangling ptrs and therefore there should be no double free if we free the ptrs on error. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org>
2023-02-02Add testcase for nc_match_single type confusionTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org>
2023-01-30ChaCha20-Poly1305 no longer supports truncated IV's.slontis
Fixes #20084 In the 3.0 provider implementation the generic code that handles IV's only allows a 12 byte IV. Older code intentionally added the ability for the IV to be truncated. As this truncation is unsafe, the documentation has been updated to state that this in no longer allowed. The code has been updated to produce an error when the iv length is set to any value other than 12. NOTE: It appears that this additional padding may have originated from the code which uses a 12 byte IV, that is then passed to CHACHA which zero pads it to 16 bytes. Note that legacy behaviour in e_chacha20_poly1305.c has not been updated. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20151) (cherry picked from commit a01152370676e7e11fb461cff8628eb50fa41b81)
2023-01-30coverity 1520506: error handlingPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20132) (cherry picked from commit a4347a9a57dcb985283bba03dd3b16294b55945b)
2023-01-30coverity 1520505: error handlingPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20132) (cherry picked from commit 00407fbf0b25d65f5e6d99defdb081432e810449)
2023-01-24Add DTLS support to the large app data testMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20086) (cherry picked from commit d36a9d66dc72fb2262f6e7491f658fb1da8242d7)
2023-01-24Add a test for large app dataMatt Caswell
Test that sending large app data records works correctly. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20086) (cherry picked from commit 5e73bf03d78da6a635a0a48e1e584f5b9ead45e2)
2023-01-23cmp_client_test.c: add tests for end_time being initialized for RR/GENMDr. David von Oheimb
To this end, tweak the internal handling of ctx->total_timeout. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19391) (cherry picked from commit b908ec0f217da0a23f9d81442f81d44c94c98f23)
2023-01-20Add negative test for unquoted property stringPauli
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20023) (cherry picked from commit 543ac2f0191f10d8a3774727fa691543de8b15bb)
2023-01-14Limit size of modulus for bn_mul_mont and BN_mod_exp_mont_consttimeBernd Edlinger
Otherwise the alloca can cause an exception. Issue reported by Jiayi Lin. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20005) (cherry picked from commit 30667f5c306dbc11ac0e6fddc7d26fd984d546ab)
2023-01-14Revert "Limit size of modulus for BN_mod_exp_mont_consttime()"Bernd Edlinger
This reverts commit 4378e3cd2a4d73a97a2349efaa143059d8ed05e8. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20005) (cherry picked from commit 92d306b32b63dd502531a89fb96c4172be0ddb49)
2023-01-12SSKDF with KMAC should return SIZE_MAX when EVP_KDF_CTX_get_kdf_size()slontis
is used. Fixes #19934 The existing code was looking for the digest size, and then returned zero. The example code in EVP_KDF-SS.pod has been corrected to not use a digest. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19935) (cherry picked from commit e8add4d379075a6daef2591edd830297d469b9f4)
2023-01-11test/param_build_test.c: test zero BIGNUMRichard Levitte
We also add tests where the zero bignum is the only parameter, to test what that does with the allocated blocks that the OSSL_PARAM_BLD functionality handles. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20013) (cherry picked from commit b49cf273883c8d3f47542941fe5cc6cb51aec9c9) (cherry picked from commit 2b7b7eebf9b7d01f8abab88b9ae0685f33c74b54)
2023-01-11Add testcase for OSSL_trace_set_callback()Tomas Mraz
Also test the OSSL_TRACE_CATEGORY_TRACE tracing - this fails on address sanitizer runs without the fix for #19915 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (cherry picked from commit e64a169fc678b5e57db28d06c25020d69bc61e4c) Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19958)
2023-01-11test/trace_api_test.c: fix gcc error on -Werror=strict-prototypesDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (cherry picked from commit 1fcd84c7017416a3c9461914d7a943591ad87a82) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19958)
2023-01-11Add tests for trace_api.Daniel Fiala
Fixes openssl#17422 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit fcff5bd43c85418cc4aa8052e3dc3dba344d763e) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19958)
2023-01-0480-test_cms.t: Fix rsapssSaltlen check on MinGWTomas Mraz
Fixes #19907 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19957) (cherry picked from commit 55e2dd8c3162d7313d9408cb20fca8a4fe6e6f5a)
2022-12-22Change HKDF to alloc the info buffer.slontis
Fixes #19909 I have enforced a maximum bound still but it is much higher. Note also that TLS13 still uses the 2048 buffer size. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19923) (cherry picked from commit e8115bd1654d5cd7718109679b2047ca573083a8)
2022-12-22Add a CMS test for a bad encryption algorithmMatt Caswell
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19919) (cherry picked from commit 0c5fe6e4e740e7150ecb9f0a1954ef085f1fcf10)
2022-12-22Fix SMIME_crlf_copy() to properly report an errorMatt Caswell
If the BIO unexpectedly fails to flush then SMIME_crlf_copy() was not correctly reporting the error. We modify it to properly propagate the error condition. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19919) (cherry picked from commit 6259cf34eab1abdcfde12b7b3892b4780844091b)
2022-12-22Honor OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT as set and default to ↵Nicola Tuveri
UNCOMPRESSED Originally the code to im/export the EC pubkey was meant to be consumed only by the im/export functions when crossing the provider boundary. Having our providers exporting to a COMPRESSED format octet string made sense to avoid memory waste, as it wasn't exposed outside the provider API, and providers had all tools available to convert across the three formats. Later on, with #13139 deprecating the `EC_KEY_*` functions, more state was added among the params imported/exported on an EC provider-native key (including `OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT`, although it did not affect the format used to export `OSSL_PKEY_PARAM_PUB_KEY`). Finally, in #14800, `EVP_PKEY_todata()` was introduced and prominently exposed directly to users outside the provider API, and the choice of COMPRESSED over UNCOMPRESSED as the default became less sensible in light of usability, given the latter is more often needed by applications and protocols. This commit fixes it, by using `EC_KEY_get_conv_form()` to get the point format from the internal state (an `EC_KEY` under the hood) of the provider-side object, and using it on `EVP_PKEY_export()`/`EVP_PKEY_todata()` to format `OSSL_PKEY_PARAM_PUB_KEY`. The default for an `EC_KEY` was already UNCOMPRESSED, and it is altered if the user sets `OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT` via `EVP_PKEY_fromdata()`, `EVP_PKEY_set_params()`, or one of the more specialized methods. For symmetry, this commit also alters `ec_pkey_export_to()` in `crypto/ec/ec_ameth.c`, part of the `EVP_PKEY_ASN1_METHOD` for legacy EC keys: it exclusively used COMPRESSED format, and now it honors the conversion format specified in the EC_KEY object being exported to a provider when this function is called. Expand documentation about `OSSL_PKEY_PARAM_PUB_KEY` and mention the change in behavior for our providers. Fixes #16595 (cherry picked from commit 926db476bc669fdcc4c4d2f1cb547060bdbfa153) Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19901)
2022-12-21Fix a logic flaw in test_mod_exp_zeroBernd Edlinger
Due to the logic flaw, possible test failures in this test case might be ignored. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19929) (cherry picked from commit 42061268ee8f9ae0555d522870740fc91b744f4f)
2022-12-20Raise the KMAC limits for key and custom size to 512 bytesTomas Mraz
This is necessary to pass new ACVP tests and to fix the CI failure in FIPS provider compat CI Partial cherry pick of 211c47ca1b1ac129dcee59d383cae44e36532bb9 Original-author: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19937)
2022-12-16Fix FIPS Provider compat CI of 3.0 libcrypto with 3.2 FIPS providerTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19904)
2022-12-09Obtain PSS salt length from providerClemens Lang
Rather than computing the PSS salt length again in core using ossl_rsa_ctx_to_pss_string, which calls rsa_ctx_to_pss and computes the salt length, obtain it from the provider using the OSSL_SIGNATURE_PARAM_ALGORITHM_ID param to handle the case where the interpretation of the magic constants in the provider differs from that of OpenSSL core. Add tests that verify that the rsa_pss_saltlen:max, rsa_pss_saltlen:<integer> and rsa_pss_saltlen:digest options work and put the computed digest length into the CMS_ContentInfo struct when using CMS. Do not add a test for the salt length generated by a provider when no specific rsa_pss_saltlen option is defined, since that number could change between providers and provider versions, and we want to preserve compatibility with older providers. Signed-off-by: Clemens Lang <cllang@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit 5a3bbe1712435d577bbc5ec046906979e8471d8b) (Merged from https://github.com/openssl/openssl/pull/19863)
2022-12-08Fix `no-ec enable-ktls` buildTodd Short
The KTLS test uses a TLSv1.2 cipher that uses ECDHE Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19841) (cherry picked from commit 2dded44a4911250acb989a535d2bad0bcf0ccc78)
2022-12-08test: add test case for deadlock reported in #19643Pauli
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19652) (cherry picked from commit 61203c2c59df5d0022e316a4fe614e5d18907715)
2022-12-08cmp_vfy_test.c: fix name OSSL_CMP_CTX_set0_trusted{,Store}Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19859)
2022-12-08OSSL_CMP_validate_msg(): make sure to reject protection type mismatchDr. David von Oheimb
Do not accept password-based if expected signature-based and no secret is available and do not accept signature-based if expected password-based and no trust anchors available. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19729) (cherry picked from commit fc93335760686ad7cf3633d457caf18b0ac83ea2)
2022-12-07Replace "a RSA" with "an RSA"Daniel Fiala
Fixes openssl#19771 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19787) (cherry picked from commit a63fa5f711f1f97e623348656b42717d6904ee3e) (cherry picked from commit f3e9308fe1b692c424feaa256fbecce958cef1f4)
2022-12-05Fix the check of EVP_PKEY_decrypt_initPeiwei Hu
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19819) (cherry picked from commit b794476df71441a6d30740ab9fadcc0f6d18d3d6)
2022-11-30cmp_client_test.c: add tests for OSSL_CMP_CTX_get_statusDr. David von Oheimb
This is a follow-up of #19205, adding test cases as requested. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19760) (cherry picked from commit 6ea44d07a7d0acb4af9eab15d9b4a76227f55f4e)
2022-11-29Fix occasional assertion failure when storing propertiesTomas Mraz
Fixes #18631 The store lock does not prevent concurrent access to the property cache, because there are multiple stores. We drop the newly created entry and use the exisiting one if there is one already. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19762) (cherry picked from commit 92a25e24e6ec9735dea9ec645502cb075a5f8d24)
2022-11-28Drop incorrect skipping of some evp_test testcases with no-gostTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19739) (cherry picked from commit d5e1fe9c04c7eb28e21070e3dfe0d2242504a9bc)
2022-11-25Add test for EVP_PKEY_Q_keygenTomas Mraz
Test for #19736 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19761) (cherry picked from commit 667a8501f0b6e5705fd611d5bb3ca24848b07154)
2022-11-25OSSL_CMP_CTX_reinit(): fix missing reset of ctx->genm_ITAVsDr. David von Oheimb
Otherwise, further OSSL_CMP_exec_GENM_ses() calls will go wrong. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19216) (cherry picked from commit 1c04866c671db4a6db0a1784399b351ea061bc16)
2022-11-21Fix coverity issues in X509v3_addrslontis
CID 1516955 : Null pointer deref (REVERSE_INULL) CID 1516954 : Null pointer deref (REVERSE_INULL) CID 1516953 : RESOURCE_LEAK of child Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19700) (cherry picked from commit 26cfa4cd85f6b26dd7a48c2ff06bfa4a2cea4764)
2022-11-18evp_extra_test2: Test DH param checks with non-NULL libctxTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19656) (cherry picked from commit 5e38e0acf4e1681ae32fa1b164adbc08719bd613)
2022-11-16Add test to confirm IPAddressFamily_check_len catches invalid lenGraham Woodward
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19273) (cherry picked from commit 7489ada9f3fd902c5bc3c58cc03a90de2800d0ab)
2022-11-16Drop explicit check for engines in opt_legacy_okaySimo Sorce
The providers indication should always indicate that this is not a legacy request. This makes a check for engines redundant as the default return is that legacy is ok if there are no explicit providers. Fixes #19662 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19671) (cherry picked from commit 2fea56832780248af2aba2e4433ece2d18428515)
2022-11-15Add test for EVP_PKEY_eqSimo Sorce
This tests that the comparison work even if a provider can only return a public key. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19648) (cherry picked from commit e5202fbd461cb6c067874987998e91c6093e5267)
2022-11-15fipsinstall test: skip PCT DSA signature test for new providersPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19665)
2022-11-15test: add two comparision options to fips version test utility codePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19665)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-04 03:46:35 +0000