aboutsummaryrefslogtreecommitdiffstats
path: root/test/recipes
Commit message (Collapse)AuthorAgeFilesLines
* Add random serial# support.Rich Salz2017-08-221-1/+1
| | | | | | | | | | Add -rand_serial to CA command and "serial_rand" config option. Up RAND_BITS to 159, and comment why: now confirms to CABForum guidelines (Ballot 164) as well as IETF RFC 5280 (PKIX). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4185)
* This has been added to avoid the situation where some host ctype.h functionsPauli2017-08-221-0/+20
| | | | | | | | | | | | | | | | | | return true for characters > 127. I.e. they are allowing extended ASCII characters through which then cause problems. E.g. marking superscript '2' as a number then causes the common (ch - '0') conversion to number to fail miserably. Likewise letters with diacritical marks can also cause problems. If a non-ASCII character set is being used (currently only EBCDIC), it is adjusted for. The implementation uses a single table with a bit for each of the defined classes. These functions accept an int argument and fail for values out of range or for characters outside of the ASCII set. They will work for both signed and unsigned character inputs. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4102)
* Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULLDavid von Oheimb2017-08-161-56/+62
| | | | | | | | | | | Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
* File::Glob option ':bsd_glob' doesn't work everywhere, replace w/ a wrapperRichard Levitte2017-08-154-5/+4
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4069)
* Consolidate the locations where we have our internal perl modulesRichard Levitte2017-08-152-2/+1
| | | | | | | | Instead of having perl modules under test/testlib, util and util/perl, consolidate them all to be inside util/perl. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4069)
* Wire SHAKE to EVP.Andy Polyakov2017-08-121-0/+57
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4137)
* no-ec2m fixesDr. Stephen Henson2017-08-101-2/+2
| | | | | | | | Fix warning and don't use binary field certificate for ECDH CMS key only test. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4134)
* Add test for ECDH CMS key onlyDr. Stephen Henson2017-08-081-0/+9
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4115)
* Add PKEY_METHOD macro testsJohannes Bauer2017-08-081-0/+12
| | | | | | | | | Added the pkey_meth_kdf_test tests which test the PKEY_METHOD macros (at the moment, of HKDF and scrypt). Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Stephen Henson <steve@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4026)
* Add interface to the scrypt KDF by means of PKEY_METHODJohannes Bauer2017-08-081-0/+50
| | | | | | | | | Add an interface that allows accessing the scrypt KDF as a PKEY_METHOD. This fixes #4021 (at least for the scrypt portion of the issue). Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Stephen Henson <steve@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4026)
* Consolidate to a single asn1_time_from_tm() functionTodd Short2017-08-041-0/+12
| | | | | | | | | | | | | | | | Add missing ASN1_TIME functions Do some cleanup of the ASN1_TIME code. Add ASN1_TIME_normalize() to normalize ASN1_TIME structures. Add ASN1_TIME_compare() to compare two ASN1_TIME structures. Add ASN1_TIME_cmp_time_t() to compare an ASN1_TIME to time_t (generic version of ASN1_UTCTIME_cmp_time_t()). Replace '0' .. '9' compares with isdigit() Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2753)
* recipes/80-test_ca.t: make it work with spaces in pathnames.Andy Polyakov2017-08-031-1/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Switch from ossl_rand to DRBG randRich Salz2017-08-031-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If RAND_add wraps around, XOR with existing. Add test to drbgtest that does the wrap-around. Re-order seeding and stop after first success. Add RAND_poll_ex() Use the DF and therefore lower RANDOMNESS_NEEDED. Also, for child DRBG's, mix in the address as the personalization bits. Centralize the entropy callbacks, from drbg_lib to rand_lib. (Conceptually, entropy is part of the enclosing application.) Thanks to Dr. Matthias St Pierre for the suggestion. Various code cleanups: -Make state an enum; inline RANDerr calls. -Add RAND_POLL_RETRIES (thanks Pauli for the idea) -Remove most RAND_seed calls from rest of library -Rename DRBG_CTX to RAND_DRBG, etc. -Move some code from drbg_lib to drbg_rand; drbg_lib is now only the implementation of NIST DRBG. -Remove blocklength Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4019)
* Allow use of long name for KDFsDr. Stephen Henson2017-08-031-0/+9
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4079)
* Add some test coverage for PEM_read_bio_PrivateKeyBernd Edlinger2017-07-291-1/+5
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4047)
* Make SSL_set_tlsext_host_name no effect from server sidePaul Yang2017-07-281-0/+22
| | | | | | | | | Documentation and test cases are also updated Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3783)
* Perl: Use File::Glob::bsd_glob rather than File::Glob::globRichard Levitte2017-07-284-4/+4
| | | | | | | | | | | | | | | | | File::Glob::glob is deprecated, it's use generates this kind of message: File::Glob::glob() will disappear in perl 5.30. Use File::Glob::bsd_glob() instead. at ../master/Configure line 277. So instead, use a construction that makes the caller glob() use File::Glob::bsd_glob(). Note that we're still excluding VMS, as it's directory specs use '[' and ']', which have a different meaning with bsd_glob and would need some extra quoting. This might change, but later. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4040)
* Add test cases and docs for ASN1_STRING_TABLE_* functionsPaul Yang2017-07-261-0/+12
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3998)
* Add support to free/allocate SSL buffersTodd Short2017-07-261-0/+21
| | | | | | | | | | | | | | | | OpenSSL already has the feature of SSL_MODE_RELEASE_BUFFERS that can be set to release the read or write buffers when data has finished reading or writing. OpenSSL will automatically re-allocate the buffers as needed. This can be quite aggressive in terms of memory allocation. This provides a manual mechanism. SSL_free_buffers() will free the data buffers if there's no pending data. SSL_alloc_buffers() will realloc them; but this function is not strictly necessary, as it's still done automatically in the state machine. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2240)
* Wire SHA3 EVPs and add tests.Andy Polyakov2017-07-251-0/+73
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3943)
* test/recipes/80-test_tsa.t: Don't trust 'OPENSSL_CONF'Richard Levitte2017-07-241-8/+12
| | | | | | | | | | | | | | There's a case when the environment variable OPENSSL_CONF is useless... when cross compiling for mingw and your wine environment has an environment variable OPENSSL_CONF. The latter will override anything that's given when starting wine and there make the use of that environment variable useless in our tests. Therefore, we should not trust it, and use explicit '-config' options instead. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3994)
* Support converting cipher name to RFC name and vice versaPaul Yang2017-07-211-0/+27
| | | | | | | | | | | | | | | Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
* Add keygen test dataDr. Stephen Henson2017-07-191-0/+34
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3920)
* Add DRBG random methodRich Salz2017-07-191-2/+7
| | | | | | | | | | | Ported from the last FIPS release, with DUAL_EC and SHA1 and the self-tests removed. Since only AES-CTR is supported, other code simplifications were done. Removed the "entropy blocklen" concept. Moved internal functions to new include/internal/rand.h. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3789)
* test/recipes/90-test_store.t: Add a few cases with files starting with 'file:'Richard Levitte2017-07-151-0/+31
| | | | | | | | These cases are performed on Linux only. They check that files with names starting with 'file:' can be processed as well. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
* test/recipes/90-test_store.t: Test absolute filesRichard Levitte2017-07-151-4/+15
| | | | | | | We haven't tested plain absolute paths without making them URIs... Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
* test/recipes/90-test_store.t: Rename some functionsRichard Levitte2017-07-151-16/+16
| | | | | | | | | | | | to_rel_file_uri really treated all files appropriately, absolute and relative alike, and really just constructs a URI, so gets renamed to to_file_uri to_file_uri, on the other hand, forces the path into an absolute one, so gets renamed to to_abs_file_uri Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
* Add sanity test for certificate tableDr. Stephen Henson2017-07-131-0/+19
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
* Do not allow non-dhe kex_modes by defaultMatt Caswell2017-07-071-3/+4
| | | | | | | Allow that mode to be configured if desired. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3833)
* test/recipes/90-test_shlibload.t: Make sure to handle library renamesRichard Levitte2017-07-071-2/+4
| | | | | | | | VMS renames our libraries to fit VMS conventions. This must be accounted for when we want to load them. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3880)
* STORE test recipe: Remove comment refering to OpenConnectRichard Levitte2017-06-291-1/+0
| | | | | | | | These tests were inspired by OpenConnect and incorporated by permission of David Woodhouse under CLA Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* Test that storeutl with a directory path works as expectedRichard Levitte2017-06-291-2/+8
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* STORE tests: add PKCS#12 testsRichard Levitte2017-06-293-12/+153
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* Add a test that checks the store utilityRichard Levitte2017-06-291-0/+278
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* Use randomness not entropyRich Salz2017-06-272-2/+2
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3773)
* Fix no-dsa build againBenjamin Kaduk2017-06-241-4/+7
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3762)
* Add tests for deprecated sigalgs with TLS 1.3 ClientHellosBenjamin Kaduk2017-06-241-2/+84
| | | | | | | | | Test for each of DSA, SHA1, and SHA224. Use the symbolic names for SignatureScheme comparisons just added. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3326)
* Add ecstress testRich Salz2017-06-211-0/+23
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3720)
* Fix no-ecBenjamin Kaduk2017-06-151-3/+7
| | | | | | | | | Also remove nested OPENSSL_NO_EC conditional; it was properly indented, but a no-op. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Benjamin Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3693)
* Move bn and evp test programs input data to their respective data dirRichard Levitte2017-06-1514-4/+31941
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3472)
* Correct Oracle copyrights & clarify.Pauli2017-06-156-19/+6
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3684)
* TLS 1.3 client sigalgs test no longer needs TLS 1.2Benjamin Kaduk2017-06-121-8/+8
| | | | | | | | | | | | Per the TODO comment, we now have proper certificate selection for TLS 1.3 client certificates, so this test can move into its own block. (It cannot merge with the previous block, as it requires EC.) Verified that the test passes when configured with enable-tls1_3 no-tls1 no-tls1_1 no-tls1_2. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3131)
* Add test cases for X509_check_private_keyPaul Yang2017-06-061-0/+39
| | | | | | | | | | | | To test X509_check_private_key and relatives. Add a CSR and corresponding RSA private key to test X509_REQ_check_private_key function. Signed-off-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3614)
* no-ec fixDr. Stephen Henson2017-05-301-3/+10
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3503)
* Add Ed25519 verify test.Dr. Stephen Henson2017-05-301-1/+5
| | | | | | | Add Ed25519 certificate verify test using certificate from draft-ietf-curdle-pkix-04 and custom generated root certificate. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3503)
* remove duplicate testsDr. Stephen Henson2017-05-193-36/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3451)
* Add a test for a missing sig algs extensionMatt Caswell2017-05-171-3/+23
| | | | | | Check that a missing sig algs extension succeeds if we are resuming. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3478)
* Add tests for unsolicited extensionsMatt Caswell2017-05-171-1/+69
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3418)
* Don't allow fragmented alertsMatt Caswell2017-05-171-4/+4
| | | | | | | | | | | | | | | | | | | An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. The DTLS code for this never worked anyway and it is not supported at a protocol level for DTLS. Similarly fragmented DTLS handshake records only work at a protocol level where at least the handshake message header exists within the record. DTLS code existed for trying to handle fragmented handshake records smaller than this size. This code didn't work either so has also been removed. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3476)
* Use BIO not FILE for test fileRich Salz2017-05-151-3/+9
| | | | | | | Allow multiple file arguments. Split bntests.txt into separate files. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3471)
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-22 10:14:55 +0000