summaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)Author
2020-06-10Silence gcc false positive warning on refdatalen in test/tls13encryptiontest.cDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12042)
2020-06-10Silence gcc false positive warning on alpn_protos_len in test/handshake_helper.cDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12042)
2020-06-10Update RSA keygen to use sp800-56b by defaultShane Lontis
Fixes #11742 Fixes #11764 The newer RSA sp800-56b algorithm is being used for the normal case of a non multiprime key of at least length 2048. Insecure key lengths and mutltiprime RSA will use the old method. Bad public exponents are no longer allowed (i.e values less than 65537 or even). Values such as 2 that would cause a infinite loop now result in an error. The value of 3 has been marked as deprecated but is still allowed for legacy purposes. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11765)
2020-06-09Add a test for renegotiation with EXTMS droppedTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12045)
2020-06-08test: TLS1.3 and new ciphers for kTLSVadim Fedorenko
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11589)
2020-06-08Fix 90-test_store.t for latest config, limits, providers, and disabled algosDr. David von Oheimb
Also make sure that the test do not 'pass' if their initialization fails. Leave out the expensive parts of DSA key gen and RSA keygen for efficiency. Fix use of the new CA configuration file test/ca-and-certs.cnf. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11733)
2020-06-08Add chain to PKCS#12 test file generation in 90-test_store.tDr. David von Oheimb
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11733)
2020-06-06TEST: Adjust test/bioprinttest.c to behave like the testutil routinesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12057)
2020-06-06TESTUTIL: Adjust the rest of testutilRichard Levitte
Fixes #12054 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12057)
2020-06-06TESTUTIL: Separate TAP output and other output by BIO filterRichard Levitte
Output that's supposed to be understood by a TAP parser gets its own BIOs (|tap_out| and |tap_err|), and is only used internally within testutils. |bio_out| and |bio_err| is now only used for output that shouldn't be parsed by the TAP parser, and all output written to those BIOs are therefore always made to look like comments (it gets prefixed with "# "). Indentation and prefixing with "# " is reworked to use BIO_f_prefix(), which allows us to throw away the internal BIO_f_tap(). The indentation level is now adjusted via a special function. Fixes #12054 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12057)
2020-06-05When asked if an ECX key has parameters we should answer "true"Matt Caswell
An ECX key doesn't have any parameters associated with it. Therefore it always has all the parameters it needs, and the "has" function should return 1 if asked about parameters. Without this EVP_PKEY_missing_parameters() fails for ECX keys. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11898)
2020-06-05Fix error path in int create_ssl_ctx_pair()Matt Caswell
If we hit the error path and create_ssl_ctx_pair has been passed a pre-created SSL_CTX then we could end up with a double free. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11834)
2020-06-05Implement a test for sigalgs not being presentMatt Caswell
If sigalgs are not present we should not offer or accept them. We should test that we handle this correctly. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11834)
2020-06-05Implement a Filtering ProviderMatt Caswell
The filtering provider can be used to place a filter in front of the default provider. Initially to filter out certain algorithms from being available for test purposes. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11834)
2020-06-05fips: add additional algorithms to the FIPS provider.Pauli
Discussions are ongoing but the OMC has approved the in-principle addition of these algorithms to the upcoming FIPS validation. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12020)
2020-06-04TEST: Add provider_fallback_test, to test aspects of fallback providersRichard Levitte
There are cases where the fallback providers aren't treated right. For example, the following calls, in that order, will end up with a failed EVP_KEYMGMT_fetch(), even thought the default provider does supply an implementation of the "RSA" keytype. EVP_KEYMGMT *rsameth = NULL; OSSL_PROVIDER_available(NULL, "default"); rsameth = EVP_KEYMGMT_fetch(NULL, "RSA", NULL); For good measure, this also tests that explicit loading of the default provider won't fail. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11926)
2020-06-04Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12043)
2020-06-03ossl_shim: const cast the param arguments to avoid errorsPauli
[extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12022)
2020-06-03Update manpage to fix examples, other minor tweaksRich Salz
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11347)
2020-06-03Cleanup cert config files for testsRich Salz
Merge test/P[12]ss.cnf into one config file Merge CAss.cnf and Uss.cnf into ca-and-certs.cnf Remove Netscape cert extensions, add keyUsage comment from some cnf files Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11347)
2020-06-03ossl_shim: include core_names.h to resolve undeclared symbolsPauli
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/12018)
2020-06-02TEST: Test i2d_PKCS8PrivateKey_bio() and PEM_write_bio_PKCS8PrivateKey()Richard Levitte
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11855)
2020-06-02Move EC_METHOD to internal-onlyBilly Brumley
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11928)
2020-06-01Revert the check for NaN in %f formatBernd Edlinger
Unfortunately -Ofast seems to break that check. Fixes #11994 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12003)
2020-05-29bio printf: Avoid using rounding errors in range checkBernd Edlinger
There is a problem casting ULONG_MAX to double which clang-10 is warning about. ULONG_MAX typically cannot be exactly represented as a double. ULONG_MAX + 1 can be and this fix uses the latter, however since ULONG_MAX cannot be represented exactly as a double number we subtract 65535 from this number, and the result has at most 48 leading one bits, and can therefore be represented as a double integer without rounding error. By adding 65536.0 to this number we achive the correct result, which should avoid the warning. The addresses a symptom of the underlying problem: we print doubles via an unsigned long integer. Doubles have a far greater range and should be printed better. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11955)
2020-05-28test HKDF with empty IKMBenjamin Kaduk
Add an extra EVP test that provides empty input key material. It currently fails, since we lose the information about "key present but zero length" as we deserialize parameters in the provider. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11920)
2020-05-28Add a test for fetching EVP_PKEY style algs without a providerMatt Caswell
Following on from the previous commit, add a test to check that we fail to create an EVP_PKEY_CTX if an algorithm is not available in any provider, *unless* it is an algorithm that has no provider support. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11826)
2020-05-28Fail if we fail to fetch the EVP_KEYMGMTMatt Caswell
If we failed to fetch an EVP_KEYMGMT then we were falling back to legacy. This is because some algorithms (such as MACs and KDFs used via an old style EVP_PKEY) have not been transferred to providers. Unfortunately this means that you cannot stop some algorithms from being used by not loading the provider. For example if you wanted to prevent RSA from being used, you might expect to just not load any providers that make it available. Unfortunately that doesn't work because we simply fall back to legacy if we fail to fetch the EVP_KEYMGMT. Instead we should fail *unless* the key type is one of those legacy key types that we have not transferred. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11826)
2020-05-28Fix errtest for older compilersShane Lontis
Some older compilers use "unknown function" if they dont support __func, so the test using ERR_PUT_error needed to compensate for this when comparing against the expected value. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11967)
2020-05-28ossl_shim: use the correct ticket key call back.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11966)
2020-05-28fips: add AES OFB mode ciphers to FIPS provider.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11908)
2020-05-28fips: add AES CFB mode ciphers to FIPS provider.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11908)
2020-05-27Rename EVP_PKEY_cmp() to EVP_PKEY_eq() and EVP_PKEY_cmp_parameters() to ↵Dr. David von Oheimb
EVP_PKEY_parameters_eq() Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11953)
2020-05-27crypto/cms: add CAdES-BES signed attributes validationFdaSilvaYY
for signing certificate V2 and signing certificate extensions. CAdES: lowercase name for now internal methods. crypto/cms: generated file changes. Add some CHANGES entries. [extended tests] Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8098)
2020-05-26Update core_names.h fields and document most fields.Shane Lontis
Renamed some values in core_names i.e Some DH specific names were changed to use DH instead of FFC. Added some strings values related to RSA keys. Moved set_params related docs out of EVP_PKEY_CTX_ctrl.pod into its own file. Updated Keyexchange and signature code and docs. Moved some common DSA/DH docs into a shared EVP_PKEY-FFC.pod. Moved Ed25519.pod into EVP_SIGNATURE-ED25519.pod and reworked it. Added some usage examples. As a result of the usage examples the following change was also made: ec allows OSSL_PKEY_PARAM_USE_COFACTOR_ECDH as a settable gen parameter. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11610)
2020-05-26Fix ERR_print_errors so that it matches the documented format in ↵Shane Lontis
doc/man3/ERR_error_string.pod Fixes #11743 The ouput format had 2 issues that caused it not to match the expected documented format: (1) At some point the thread id printing was changed to use the OPENSSL_hex2str method which puts ':' between hex bytes. An internal function that skips the seperator has been added. (2) The error code no longer exists. So this was completely removed from the string. It is now replaced by :: As an example: 00:77:6E:52:14:7F:00:00:error:asn1 encoding routines:asn1_check_tlen:wrong tag:crypto/asn1/tasn_dec.c:1135: Is now: 00776E52147F0000:error::asn1 encoding routines:asn1_check_tlen:wrong tag:crypto/asn1/tasn_dec.c:1135: Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11789)
2020-05-26ossl_shim: add deprecation guards around the -use-ticket-callback option.Pauli
The ticket callback is deprecated in 3.0 and can't be used in a no-deprecated build. [extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11944)
2020-05-23GOST external testsDmitry Belyavskiy
[extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11792)
2020-05-23Fix the parameter types of the CRYPTO_EX_dup function type.Bernd Edlinger
This fixes a strict aliasing issue in ui_dup_method_data. The parameter type of CRYPTO_EX_dup's from_d parameter is in fact void **, since it points to a pointer. This function is rarely used, therefore fix the param type although that may be considered an API breaking change. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2986)
2020-05-19Test for the SSL_OP_IGNORE_UNEXPECTED_EOF optionDmitry Belyavskiy
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11735)
2020-05-19deprecate EC precomputation functionalityBilly Brumley
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11851)
2020-05-18Delete the sslprovider testMatt Caswell
This was added before the changes to the sslap/ssl_new/ssl_old tests which run those tests with a non-default library context. It no longer adds anything that those tests don't already do, so it can be deleted. This also fixes a number of run-checker build failures which were failing in this test if TLSv1.2 was disabled. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11832)
2020-05-16deprecate EC_POINTs_mul functionBilly Brumley
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11807)
2020-05-16Maintain strict type discipline between the core and providersMatt Caswell
A provider could be linked against a different version of libcrypto than the version of libcrypto that loaded the provider. Different versions of libcrypto could define opaque types differently. It must never occur that a type created in one libcrypto is used directly by the other libcrypto. This will cause crashes. We can "cheat" for "built-in" providers that are part of libcrypto itself, because we know that the two libcrypto versions are the same - but not for other providers. To ensure this does not occur we use different types names for the handful of opaque types that are passed between the core and providers. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11758)
2020-05-15Test TLSv1.3 out-of-band PSK with all 5 ciphersuitesraja-ashok
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11785)
2020-05-15Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11839)
2020-05-14test/evp_extra_test.c: Add OPENSSL_NO_CMAC around CMAC testRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11833)
2020-05-14test/recipes/15-test_rsapss.t: Add test with unrestricted signatureRichard Levitte
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14test/ssl-tests/20-cert-select.cnf.in: Re-enable RSA-PSS related testsRichard Levitte
There were a few RSA-PSS related tests that were disabled for non-default library contexts. We now re-enable them. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
2020-05-14test/evp_pkey_provided_test.c: Display first, compare afterRichard Levitte
To make it easier to check the generated key manually, display it before comparing diverse other serializations. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11710)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-10 06:22:52 +0000