summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2021-06-10Optimize session cache flushingTodd Short
Sort SSL_SESSION structures by timeout in the linked list. Iterate over the linked list for timeout, stopping when no more session can be flushed. Do SSL_SESSION_free() outside of SSL_CTX lock Update timeout upon use Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8687)
2021-06-10err: clear flags better when clearing errors.Pauli
An attempt to clear an error with malloced data didn't clear the flags. Now it clears all flags except the malloced flag. Fixes #12530 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15667)
2021-06-09Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8Richard Levitte
This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-06-0925-test_verify.t: Add test case: accept trusted self-signed EE cert with key ↵Dr. David von Oheimb
usage keyCertSign also when strict Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15656)
2021-06-09test/certs/mkcert.sh: Correct description of geneealt parametersDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15656)
2021-06-0925-test_verify.t: Prevent expiration of test case 'Name constraints bad ↵Dr. David von Oheimb
othername name constraint' Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15656)
2021-06-0980-test_cmp_http.t: Improve the way the test server is launched and killedDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15642)
2021-06-0980-test_cmp_http.t: Simplify and prevent hangs on server not ↵Dr. David von Oheimb
launching/behaving correctly Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15642)
2021-06-08Correctly detect decode errors when checking if a key is supportedMatt Caswell
If we have an unsupported key type we may get a decode error and therefore we should detect that. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Use the fips-and-base.cnf config file in CMP testsMatt Caswell
Two CMP tests were using the fips.cnf config file. However to ensure that decoders are available the fips-and-base.cnf config file needs to be used instead. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Mark some priv/public key paris as only available in the default providerMatt Caswell
Now that we actually load public keys from providers we need to mark some key paris in the evp tests as only available there. Otherwise we get test failures when only the FIPS Provider is loaded. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Just look for "Unable to load Public Key" if no SM2Matt Caswell
The X509 test was looking for some specific errors when printing an SM2 X509 certificate when SM2 is disabled. In fact these errors appear in the middle of the certificate printing which is quite odd. There is also a separate error "Unable to load Public Key" which is more cleanly printed. With the recent change to using provided keys in certs the old errors are no longer output. However printing them in the middle of the cert is probably not right anyway. So we just rely on the "Unable to load Public Key" message. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08Fix the expected output of printing certificatesMatt Caswell
Now that we are using provided keys when loading a certificate the pretty printing formatting is cosmetically different. We need to adjust expected test output accordingly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15504)
2021-06-08EVP_PKEY_new_raw_private_key: Allow zero length keysTomas Mraz
Allocate at least one byte to distinguish a zero length key from an unset key. Fixes #15632 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15643)
2021-06-08Add a gettable for provider ciphers to return the EVP_CIPH_RAND_KEY flagShane Lontis
Fixes #15531 DES and TDES set this flag which could possibly be used by applications. The gettable cipher param OSSL_CIPHER_PARAM_HAS_RAND_KEY has been added. Note that EVP_CIPHER_CTX_rand_key() uses this flag. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15606)
2021-06-08Test EVP_CipherInit sequences and resetsJuergen Christ
Various EVP_CipherInit sequences including partial inits and initializations with different "enc" flags caused problems on s390x. Similarly, cipher reinitialization and especially GCM reinitialization with different tag length led to wrong results. Add some unit tests to cover these rather exotic use cases. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15521)
2021-06-07Fix generate_ssl_tests.plMatt Caswell
Fix the generate_ssl_tests.pl script so that it can be run standalone from the command line according to the instructions in test/README.ssltest.md Fixes #11430 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15617)
2021-06-06test/recipes/80-test_cmp_http.t: Don't trust $server_port in start_mock_server()Richard Levitte
Even if $server_port isn't touched, it's still a number coming from configuration. It's therefore not trustable as an indicator that the ACCEPT line delivered a port number or an error indication. $accept_msg is used instead to capture the port if there is one, and be a better indicator of error. Fixes #15557 Fixes #15571 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15580)
2021-06-06test/recipes/80-test_cmp_http.t: Simplify test_cmp_http()Richard Levitte
test_cmp_http() made some assumptions about what values that exit_checker could get that aren't quite right. Furthermore, the expected result isn't about exit codes, but about true or false. This is better served by getting the value from OpenSSL::Test::run(), and checking that value against $expected_result with Test::More::is(). Fixes #15557 Fixes #15571 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15580)
2021-06-05Ensure libctx/propq is propagated when handling X509_REQMatt Caswell
When we create via d2i or dup an X509_REQ we should ensure that the libctx is properly propagated. We also ensure we create X509_REQ objects with the proper libctx assigned in the CMP tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Use the new ASN.1 libctx aware capabilities in CMPMatt Caswell
Make sure we pass the libctx/propq around everywhere that we need it to ensure we get provider keys when needed. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-05Fix evp_extra_test to use libctx in an X509_PUBKEYMatt Caswell
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15591)
2021-06-04Test a bad SmtpUTF8Mailbox name constraintMatt Caswell
We add a verify test with a cert with a SAN and a bad SmtpUTF8Mailbox entry, with an intermediate certificate with email name constraints. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15611)
2021-06-0480-test_http.t: Rename to 79-test_http.t, add basic HTTP server ACCEPT testDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15592)
2021-06-0480-test_cmp_http.t: Improve comparison on server_port variableDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15592)
2021-06-0380-test_cmp_http.t: Re-enable CMP tests for AIX, removing some inessential ↵Jon Spillett
test cases Remove negative test cases which simulate an attempt to write file contents to a directory using a path ending in '/' as this is not compatible with fopen on all platforms, e.g., AIX. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15575)
2021-06-03rsa: make the maximum key strength check FIPS only.Pauli
To be reverted once key generation checks are added everywhere and a way to disable them implemented. Fixes #15502 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15560)
2021-06-02ed25519 and ed448: fix incorrect OSSL_PKEY_PARAM_MAX_SIZETomas Mraz
Fixes #15552 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15566)
2021-06-0280-test_cms.t: Replace use of ee-self-signed.pem by more suitable smrsa1.pemDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15499)
2021-06-02ee-self-signed.pem: Restore original version, adding -attime to 25-test_verify.tDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15499)
2021-06-02test: remove TODOsPauli
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15539)
2021-06-02Add NCONF_get_section_names()Tomas Mraz
And a few additional fixups to make the no-deprecated configuration to build. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15466)
2021-06-01Make the 00-prep_*.t recipe truly mandatoryTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15550)
2021-06-01Rename also the OSSL_PROVIDER_name() functionTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15405)
2021-06-01Rename all getters to use get/get0 in nameTomas Mraz
For functions that exist in 1.1.1 provide a simple aliases via #define. Fixes #15236 Functions with OSSL_DECODER_, OSSL_ENCODER_, OSSL_STORE_LOADER_, EVP_KEYEXCH_, EVP_KEM_, EVP_ASYM_CIPHER_, EVP_SIGNATURE_, EVP_KEYMGMT_, EVP_RAND_, EVP_MAC_, EVP_KDF_, EVP_PKEY_, EVP_MD_, and EVP_CIPHER_ prefixes are renamed. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15405)
2021-06-01Enhance the encoder/decoder tests to allow testing with a non-default ↵Jon Spillett
library context and configurable providers Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14587)
2021-06-01Fix aes cfb1 so that it can operate in bit mode.Shane Lontis
The code to handle the cipher operation was already in the provider. It just needed a OSSL_PARAM in order to set this into the algorithm. EVP_CIPHER_CTX_set_flags() has been modified to pass the OSSL_PARAM. Issue reported by Mark Powers from Acumen. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15496)
2021-05-31Fix PKCS7_verify to not have an error stack if it succeeds.Shane Lontis
Revert a change in behavior to BIO_write(). If a NULL BIO is passed, no error is raised and the return value is 0. There are many places where the return code from the write was not checked, resulting in an error stack with no error status being returned. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15493)
2021-05-29test: add zero strenght arguments to BN and RAND RNG callsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-29apps/lib/s_socket.c and 80-test_cmp_http.t: Make ACCEPT port reporting more ↵Dr. David von Oheimb
robust Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15417)
2021-05-29Fix intermittent CI failure in evp_kdf_test for non_caching build.Shane Lontis
Fixes #15515 Another case of the order that tests run in causes a failure. A new test was loading "legacy" into the default lib ctx. If it ran first then everything fails. The test now has its own lib ctx. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15516)
2021-05-28Fix PKCS12_create() so that a fetch error is not added to the error stack.Shane Lontis
Fixes #15392 PBE algorithms such as NID_pbe_WithSHA1And3_Key_TripleDES_CBC will currently always fail to the EVP_CIPHER_fetch() call, so the fallback to a legacy algorithm always happens. In this case the error stack should ignore the fetch error. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15473)
2021-05-27TEST: Prefer using precomputed RSA and DH keys for more efficient testsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13715)
2021-05-27test: test MP genrsa in deprecated buildsPauli
These multi-prime tests were omitted when genrsa was deprecated but not returned when it was restored. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15472)
2021-05-27test: add test for key generation strength > RNG strengthPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15472)
2021-05-27test: test genrsa in deprecated buildsPauli
These tests were omitted when genrsa was deprecated but not returned when it was restored. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15472)
2021-05-27Use "" for include internal/xxxRich Salz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15468)
2021-05-27Use <> for #include openssl/xxxRich Salz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15468)
2021-05-26Deprecate old style BIO callback callsTomas Mraz
New style BIO_debug_callback_ex() function added to provide replacement for BIO_debug_callback(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15440)
2021-05-26TEST: Add test specific fipsmodule.cnf, and use itRichard Levitte
We add the concept of preparation recipes, which are performed unconditionally. They are all expected to match the pattern test/recipes/00-prep_*.t. We add one such preparation recipe, test/recipes/00-prep_fipsmodule_cnf.t, which helps us generate a test specific fipsmodule.cnf, to be used by all other tests. Fixes #15166 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15436)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-09 05:40:30 +0000