summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2020-11-24TEST: Make our test data binaryRichard Levitte
Our test data (test/data.txt and test/data2.txt) are text files, but declaring them binary means that there will be no line ending transformation done on them. This is necessary for testing on non-Unix platforms, where certain tests could otherwise give results that don't match expected results. Fixes #13474 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13477)
2020-11-23Add a test for the dhparam CLI applicationMatt Caswell
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13231)
2020-11-20Fix crash in genpkey app when -pkeyopt digest:name is used for DH or DSA.Shane Lontis
By the time the keygen is called the references to strings inside the gen ctx are floating pointers. A strdup solves this problem. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13432)
2020-11-20test RNG: set state to uninitialised as part of uninstantiate call.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13226)
2020-11-20test: changes resulting from moving the entropy source out of the FIPS providerPauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13226)
2020-11-19Add a test for setting, popping and clearing error marksMatt Caswell
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13335)
2020-11-19apps/pkcs12: Retain test output filesDavid von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/4930)
2020-11-18Deprecate RSA harderRichard Levitte
This deprecates all functions that deal with the types RSA and RSA_METHOD Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13096)
2020-11-18Swap to FIPS186-2 DSA generation outside of the FIPS moduleMatt Caswell
Inside the FIPS module we continue to use FIPS186-4. We prefer FIPS186-2 in the default provider for backwards compatibility reasons. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13228)
2020-11-18Adapt ssltest_old to not use deprecated DH APIsMatt Caswell
There are non-deprecated replacements so we should use those instead. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Extend the auto DH testing to check DH sizesMatt Caswell
Check that the size of the DH parameters we select changes according to the size of the certificate key or symmetric cipher (if no certificate). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Add some additional test certificates/keysMatt Caswell
Add certs with 1024, 3072, 4096 and 8192 bit RSA keys Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-18Add a test for the various ways of setting temporary DH paramsMatt Caswell
We support a number of different ways of setting temporary DH params. We should test that they all work correctly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-16Fix dsa securitycheck for fips.Shane Lontis
Fixes #12627 Changed security check for DSA verification to match SP800-131Ar2 when the security strength is < 112. Fixed compilation error when using config opt 'no-fips-securitychecks' Removed TODO's from 20-test_cli_fips.t - there is no longer an TODO error. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13387)
2020-11-15test/endecoder_legacy_test.c: new test for legacy comparisonRichard Levitte
It checks that all of these functions have a corresponding OSSL_ENCODER implementation, and that the output is the same: - i2d_{TYPE}PrivateKey - i2d_{TYPE}PublicKey - i2d_{TYPE}params - i2d_{TYPE}_PUBKEY - PEM_write_bio_{TYPE}PrivateKey - PEM_write_bio_{TYPE}PublicKey - PEM_write_bio_{TYPE}Parameters - PEM_write_bio_{TYPE}_PUBKEY It also checks that all of these functions have a corresponding OSSL_DECODER implementation, and that the decoding result matches: - d2i_{TYPE}PrivateKey() - d2i_{TYPE}PublicKey(), - d2i_{TYPE}params(), - d2i_{TYPE}_PUBKEY(), - PEM_read_bio_{TYPE}PrivateKey() - PEM_read_bio_{TYPE}PublicKey() - PEM_read_bio_{TYPE}params() - PEM_read_bio_{TYPE}_PUBKEY() Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13262)
2020-11-13Convert all {NAME}err() in crypto/ to their corresponding ERR_raise() callRichard Levitte
This includes error reporting for libcrypto sub-libraries in surprising places. This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
2020-11-12[test/recipes] Split test_fuzz into separate recipesNicola Tuveri
When using `HARNESS_JOBS` to run the tests in parallel, no matter the level of parallelism that can be used, the monolithic `test_fuzz` takes a long time to run, conditioning the duration of the whole build. This commit splits the single `test_fuzz` recipe into separate recipes for each fuzzer. The previous mechanism to select individual fuzz tests using the `FUZZ_TESTS` environment variable is also dropped (and documentation updated). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13307)
2020-11-12Optimize AES-XTS mode in OpenSSL for aarch64XiaokangQian
Aes-xts mode can be optimized by interleaving cipher operation on several blocks and loop unrolling. Interleaving needs one ideal unrolling factor, here we adopt the same factor with aes-cbc, which is described as below: If blocks number > 5, select 5 blocks as one iteration,every loop, decrease the blocks number by 5. If left blocks < 5, treat them as tail blocks. Detailed implementation has a little adjustment for squeezing code space. With this way, for small size such as 16 bytes, the performance is similar as before, but for big size such as 16k bytes, the performance improves a lot, even reaches to 2x uplift, for some arches such as A57, the improvement even reaches more than 2x uplift. We collect many performance datas on different micro-archs such as thunderx2, ampere-emag, a72, a75, a57, a53 and N1, all of which reach 0.5-2x uplift. The following table lists the encryption performance data on aarch64, take a72, a75, a57, a53 and N1 as examples. Performance value takes the unit of cycles per byte, takes the format as comparision of values. List them as below: A72: Before optimization After optimization Improve evp-aes-128-xts@16 8.899913518 5.949087263 49.60% evp-aes-128-xts@64 4.525512668 3.389141845 33.53% evp-aes-128-xts@256 3.502906908 1.633573479 114.43% evp-aes-128-xts@1024 3.174210419 1.155952639 174.60% evp-aes-128-xts@8192 3.053019303 1.028134888 196.95% evp-aes-128-xts@16384 3.025292462 1.02021169 196.54% evp-aes-256-xts@16 9.971105023 6.754233758 47.63% evp-aes-256-xts@64 4.931479093 3.786527393 30.24% evp-aes-256-xts@256 3.746788153 1.943975947 92.74% evp-aes-256-xts@1024 3.401743802 1.477394648 130.25% evp-aes-256-xts@8192 3.278769327 1.32950421 146.62% evp-aes-256-xts@16384 3.27093296 1.325276257 146.81% A75: Before optimization After optimization Improve evp-aes-128-xts@16 8.397965173 5.126839098 63.80% evp-aes-128-xts@64 4.176860631 2.59817764 60.76% evp-aes-128-xts@256 3.069126585 1.284561028 138.92% evp-aes-128-xts@1024 2.805962699 0.932754655 200.83% evp-aes-128-xts@8192 2.725820131 0.829820397 228.48% evp-aes-128-xts@16384 2.71521905 0.823251591 229.82% evp-aes-256-xts@16 11.24790935 7.383914448 52.33% evp-aes-256-xts@64 5.294128847 3.048641998 73.66% evp-aes-256-xts@256 3.861649617 1.570359905 145.91% evp-aes-256-xts@1024 3.537646797 1.200493533 194.68% evp-aes-256-xts@8192 3.435353012 1.085345319 216.52% evp-aes-256-xts@16384 3.437952563 1.097963822 213.12% A57: Before optimization After optimization Improve evp-aes-128-xts@16 10.57455446 7.165438012 47.58% evp-aes-128-xts@64 5.418185447 3.721241202 45.60% evp-aes-128-xts@256 3.855184592 1.747145379 120.66% evp-aes-128-xts@1024 3.477199757 1.253049735 177.50% evp-aes-128-xts@8192 3.36768104 1.091943159 208.41% evp-aes-128-xts@16384 3.360373443 1.088942789 208.59% evp-aes-256-xts@16 12.54559459 8.745489036 43.45% evp-aes-256-xts@64 6.542808937 4.326387568 51.23% evp-aes-256-xts@256 4.62668822 2.119908754 118.25% evp-aes-256-xts@1024 4.161716505 1.557335554 167.23% evp-aes-256-xts@8192 4.032462227 1.377749511 192.68% evp-aes-256-xts@16384 4.023293877 1.371558933 193.34% A53: Before optimization After optimization Improve evp-aes-128-xts@16 18.07842135 13.96980808 29.40% evp-aes-128-xts@64 7.933818397 6.07159276 30.70% evp-aes-128-xts@256 5.264604704 2.611155744 101.60% evp-aes-128-xts@1024 4.606660117 1.722713454 167.40% evp-aes-128-xts@8192 4.405160115 1.454379201 202.90% evp-aes-128-xts@16384 4.401592028 1.442279392 205.20% evp-aes-256-xts@16 20.07084054 16.00803726 25.40% evp-aes-256-xts@64 9.192647294 6.883876732 33.50% evp-aes-256-xts@256 6.336143161 3.108140452 103.90% evp-aes-256-xts@1024 5.62502952 2.097960651 168.10% evp-aes-256-xts@8192 5.412085608 1.807294191 199.50% evp-aes-256-xts@16384 5.403062591 1.790135764 201.80% N1: Before optimization After optimization Improve evp-aes-128-xts@16 6.48147613 4.209415473 53.98% evp-aes-128-xts@64 2.847744115 1.950757468 45.98% evp-aes-128-xts@256 2.085711968 1.061903238 96.41% evp-aes-128-xts@1024 1.842014669 0.798486302 130.69% evp-aes-128-xts@8192 1.760449052 0.713853939 146.61% evp-aes-128-xts@16384 1.760763546 0.707702009 148.80% evp-aes-256-xts@16 7.264142817 5.265970454 37.94% evp-aes-256-xts@64 3.251356212 2.41176323 34.81% evp-aes-256-xts@256 2.380488469 1.342095742 77.37% evp-aes-256-xts@1024 2.08853022 1.041718215 100.49% evp-aes-256-xts@8192 2.027432668 0.944571334 114.64% evp-aes-256-xts@16384 2.00740782 0.941991415 113.10% Add more XTS test cases to cover the cipher stealing mode and cases of different number of blocks. CustomizedGitHooks: yes Change-Id: I93ee31b2575e1413764e27b599af62994deb4c96 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11399)
2020-11-12apps/passwd: remove the -crypt option.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13313)
2020-11-12rsa_test: add return value checkPauli
Fixes #13361 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13362)
2020-11-11test/recipes/30-test_evp_libctx.t: use fips-and-base.cnfRichard Levitte
The FIPS provider module doesn't have any encoders, the base provider is needed for that. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11test/evp_libctx_test.c: use OSSL_ENCODER instead of i2d_PublicKey()Richard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11test/endecode_test.c: Update to specify output structuresRichard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11SSL: refactor all SSLfatal() callsRichard Levitte
Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-11TEST: Adapt test/endecoder_test.cRichard Levitte
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-1125-test_x509.t: Re-add and improve a test on non-existence of ASN.1 parse errorsDr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13353)
2020-11-11Add support for making all of KBKDF FixedInput fields optional.Shane Lontis
Added settable integer parameters OSSL_KDF_PARAM_KBKDF_USE_L, OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR. This is required for CAVS tests that only use a combined blob of inputdata. A test showing this use case has been added. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13258)
2020-11-09Remove test that breaks on AIX.Shane Lontis
The offending test checks that fopen("anydir/") fails. This looks fairly platform specific. For the test involved this creates a file called "anydir" on an AIX test machine. This change was introduced on (Sept 24) https://github.com/openssl/openssl/commit/29844ea5b3d2b7240d99b043a0d82cb177f0762d Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13309)
2020-11-07test/evp_extra_test.c: Modify to reflect provider support in test_EVP_PKEY_checkRichard Levitte
With our providers, RSA now supports public key check and key parameter check. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13334)
2020-11-07Fix test/recipes/80-test_ca.t to skip_all properly in a subtestRichard Levitte
It's perfectlt ok to 'plan skip_all' in a subtest, but in that case, it must really be inside the subtest. Fixes #13330 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13331)
2020-11-05Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13324)
2020-11-02Add more diagnostics to ossl_shimBenjamin Kaduk
We had several cases where the connection failed but we did not have an error message to differentiate which failure condition had been triggered. Add some more messages to help clarify what is going wrong. [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13251)
2020-11-02Add AES KW inverse ciphers to the EVP layerShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13272)
2020-11-01test/recipes/90-test_shlibload.t: Skip when address sanitizer enabledRichard Levitte
Because this test loads the shared libraries dynamically, there are cases where that results in errors because the ASAN library wasn't loaded first. That makes this test unsuitable in an ASAN build. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13281)
2020-10-30test/recipes/15-test_gendh.t: don't try DER paramsRichard Levitte
There is no option to output DH params in DER form. -outform doesn't apply to -genparam with 'openssl genpkey', and it shouldn't. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13266)
2020-10-22Constify OSSL_FUNC_keymgmt_has()Nicola Tuveri
The keydata argument of OSSL_FUNC_keymgmt_has() should be read-only. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13200)
2020-10-21Unexport internal MSBLOB and PVK functionsRichard Levitte
The following internal functions are affected: ossl_do_blob_header ossl_do_PVK_header ossl_b2i ossl_b2i_bio This is reflected by moving include/internal/pem.h to include/crypto/pem.h engines/e_loader_attic gets the source code added to it to have continued access to those functions. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13195)
2020-10-20Rename EVP_PKEY_set1_tls_encodedpoint to EVP_PKEY_set1_encoded_public_keyMatt Caswell
We do the same thing for the "get1" version. In reality this has broader use than just TLS (it can also be used in CMS), and "encodedpoint" only makes sense when you are talking about EC based algorithms. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13105)
2020-10-19TEST: fix the DH tests to reproduce the priv_len settingsRichard Levitte
Some DH tests are done against files generated with '-pkeyopt priv_len:224' This parameter must of course be reproduced when creating the key with EVP_PKEY_fromdata(), or there will be a default that's guaranteed to differ from the key parameters on file. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13166)
2020-10-16TEST: modify tconversion.pl for forensicsRichard Levitte
In the interest of finding out what went wrong with a test by looking at its output, tconversion.pl is modified to take arguments in option form, and gets an additional -prefix option that callers can use to ensure output files are uniquely named. Test recipes are modified to use these new options. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13147)
2020-10-15Update copyright yearMatt Caswell
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13144)
2020-10-15Rename OPENSSL_CTX prefix to OSSL_LIB_CTXDr. Matthias St. Pierre
Many of the new types introduced by OpenSSL 3.0 have an OSSL_ prefix, e.g., OSSL_CALLBACK, OSSL_PARAM, OSSL_ALGORITHM, OSSL_SERIALIZER. The OPENSSL_CTX type stands out a little by using a different prefix. For consistency reasons, this type is renamed to OSSL_LIB_CTX. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12621)
2020-10-14[test][tls-provider] Implement KEM algorithmNicola Tuveri
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14Define OSSL_CAPABILITY_TLS_GROUP_IS_KEMNicola Tuveri
Note that with this commit the optional parameter is introduced, but libssl still ignores it. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14[test][tls-provider] Add 2nd pluggable tls group for KEMNicola Tuveri
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14[test][sslapitest] Add test for pluggable KEM groupNicola Tuveri
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-14[test][tls-provider] Group xor_group properties in a structNicola Tuveri
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-10-12Make TAP::Harness and TAP::Parser optional.Rainer Jung
In OpenSSL 1.1.1 the script run_tests.pl has an effectiver workaround to fall back to Test::Harness, if TAP::Harness is not available. That code has substantially changed, but it seems it should still fall back but doesn't. Observed on SuSE Linux Enterprise Server 11 (SLES11). Error messages: Can't locate TAP/Parser.pm in @inc (@inc contains: /path/to/bld/openssl300/test/../util/perl /path/to/local/perl/lib/perl5 /usr/lib/perl5/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/5.10.0 /usr/lib/perl5/site_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.10.0 /usr/lib/perl5/vendor_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.10.0 /usr/lib/perl5/vendor_perl .) at /path/to/local/perl/lib/perl5/parent.pm line 20. BEGIN failed--compilation aborted at /path/to/bld/openssl300/test/run_tests.pl line 131. and Can't locate TAP/Harness.pm in @inc (@inc contains: /path/to/bld/openssl300/test/../util/perl /path/to/local/perl/lib/perl5 /usr/lib/perl5/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/5.10.0 /usr/lib/perl5/site_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.10.0 /usr/lib/perl5/vendor_perl/5.10.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.10.0 /usr/lib/perl5/vendor_perl .) at /path/to/local/perl/lib/perl5/parent.pm line 20. BEGIN failed--compilation aborted at /path/to/bld/openssl300/test/run_tests.pl line 215. Concerning the fix: the docs for parent.pm show, that without the "-norequire" it puts the require statement in a BEGIN block which probably runs before the eval, to the loading is no longer encapsulated by the eval. Without the additional require line, the loading doesn't happen at all, so the availability testing fails. Combining the "-norequire" and an explicit "require" worked for me. Tested on the original problem platform SLES 11, but also on SLES 12 and 15, RHEL 6, 7 and 8 plus Solaris 10 Sparc. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12500)
2020-10-12coverity 1403324 negative array index: check for finding an unknown value ↵Pauli
and error if so (since it shouldn't happen). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13091)
2020-10-12coverity 1414446 out-of-bounds access: allocate \0 terminator byte to be safePauli
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13091)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-04 23:39:24 +0000