aboutsummaryrefslogtreecommitdiffstats
path: root/test/recipes
Commit message (Collapse)AuthorAgeFilesLines
* Update copyright yearMatt Caswell2021-05-203-3/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15381)
* 80-test_cms.t: Disable new tests for binary input in WindowsDr. David von Oheimb2021-05-191-0/+1
| | | | | | | This is a quick workaround for #15347. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15351)
* apps/cms.c: Make -sign and -verify handle binary inputDr. David von Oheimb2021-05-191-3/+44
| | | | | | | Fixes #8940 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12959)
* Add SSL_OP_ALLOW_CLIENT_RENEGOTIATIONRich Salz2021-05-172-2/+34
| | | | | | | | | | | | | | | | | | | Add -client_renegotiation flag support. The -client_renegotiation flag is equivalent to SSL_OP_ALLOW_CLIENT_RENEGOTIATION. Add support to the app, the config code, and the documentation. Add SSL_OP_ALLOW_CLIENT_RENEGOTIATION to the SSL tests. We don't need to always enable it, but there are so many tests so this is the easiest thing to do. Add a test where client tries to renegotiate and it fails as expected. Add a test where server tries to renegotiate and it succeeds. The second test is supported by a new flag, -immediate_renegotiation, which is ignored on the client. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15184)
* Adapt 80-test_cmp_http.t and its data for random accept portsRichard Levitte2021-05-164-25/+32
| | | | | | | Fixes #14694 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/15281)
* HTTP: Implement persistent connections (keep-alive)Dr. David von Oheimb2021-05-141-43/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both at API and at CLI level (for the CMP app only, so far) there is a new parameter/option: keep_alive. * 0 means HTTP connections are not kept open after receiving a response, which is the default behavior for HTTP 1.0. * 1 means that persistent connections are requested. * 2 means that persistent connections are required, i.e., in case the server does not grant them an error occurs. For the CMP app the default value is 1, which means preferring to keep the connection open. For all other internal uses of the HTTP client (fetching an OCSP response, a cert, or a CRL) it does not matter because these operations just take one round trip. If the client application requested or required a persistent connection and this was granted by the server, it can keep the OSSL_HTTP_REQ_CTX * as long as it wants to send further requests and OSSL_HTTP_is_alive() returns nonzero, else it should call OSSL_HTTP_REQ_CTX_free() or OSSL_HTTP_close(). In case the client application keeps the OSSL_HTTP_REQ_CTX * but the connection then dies for any reason at the server side, it will notice this obtaining an I/O error when trying to send the next request. This requires extending the HTTP header parsing and rearranging the high-level HTTP client API. In particular: * Split the monolithic OSSL_HTTP_transfer() into OSSL_HTTP_open(), OSSL_HTTP_set_request(), a lean OSSL_HTTP_transfer(), and OSSL_HTTP_close(). * Split the timeout functionality accordingly and improve default behavior. * Extract part of OSSL_HTTP_REQ_CTX_new() to OSSL_HTTP_REQ_CTX_set_expected(). * Extend struct ossl_http_req_ctx_st accordingly. Use the new feature for the CMP client, which requires extending related transaction management of CMP client and test server. Update the documentation and extend the tests accordingly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
* test: fix thread test config file problemPauli2021-05-131-4/+6
| | | | | | | | | | Force the thread test to use the configuration file via a command line arg. Use the test library support for libctx creation. Fixes #15243 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15256)
* Update expected results for tls13kexmodes testsBenjamin Kaduk2021-05-121-7/+5
| | | | | | | | | | | One of the scenarios constructed in these tests was erroneously producing successful handshakes until the previous commits, but should have been failing. Update our expected behavior to match the specification requirements, and adjust the commentary slightly for a test case relevant for the other preceding commit. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14749)
* Allow arbitrary digests with ECDSA and DSATomas Mraz2021-05-121-5/+7
| | | | | | | | | | Unless the FIPS security check is enabled we allow arbitrary digests with ECDSA and DSA. Fixes #14696 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15220)
* property: add test case for setting default user properties before fetchingMatt Caswell2021-05-121-4/+13
| | | | | | | | | | Shamelessly culled from #15218. Co-authored-by: Dr Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15222)
* 80-test_cmp_http.t: Improve fuzzing exclusion pattern - fixup!Dr. David von Oheimb2021-05-111-1/+1
| | | | | | | | This now correctly fixes #14966. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15217)
* Add a test for OSSL_LIB_CTX_new_child()Matt Caswell2021-05-111-2/+5
| | | | | | | | Check that we can create such a libctx and usable providers are loaded into it. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
* Tests for creating req from PKCS8 keys with extra attrsDmitry Belyavskiy2021-05-111-1/+24
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15142)
* 80-test_cmp_http.t: Improve fuzzing exclusion patternDr. David von Oheimb2021-05-081-1/+1
| | | | | | | Fixes #14966 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15158)
* apps/mac: Add digest and cipher command line optionsPauli2021-05-081-3/+23
| | | | | | | | Add -cipher and -digest as short forms of -macopt cipher: and -macopt digest: respectively. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15189)
* apps: remove initial newline from mac outputPauli2021-05-081-2/+2
| | | | | | | Fixes #13247 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15189)
* apps: add mac, cipher and digest arguments to the kdf applet.Pauli2021-05-081-2/+36
| | | | | | | | This adds -digest, -mac and -cipher which correspond to -kdfopt digest: and -kdfopt mac: and -kdfopt cipher: respectively. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15190)
* Update copyright yearMatt Caswell2021-05-0615-15/+15
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15181)
* Add some tests for -inform/keyform enforcementTomas Mraz2021-05-064-8/+40
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15100)
* adapt tests to SSL_OP_LEGACY_SERVER_CONNECT changeBenjamin Kaduk2021-05-051-1/+1
| | | | | | | | | | | | The "bad DTLS" tests run into trouble due to the special behavior for that "bad" version, and the SSL record tests need to set the -legacy_server_connect flag to allow an SSLv2 ClientHello to work against any TLS server (since SSLv2 ClientHello messages cannot carry extensions as would be needed in order to negotiate the use of the renegitiation_info extension). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15127)
* mac: allow XOF MACs to be specified either via control or via the dedicated ↵Pauli2021-05-051-1/+56
| | | | | | | function Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15061)
* Add .includedir pragmaRich Salz2021-05-052-1/+8
| | | | | | | | Also add a negative test, and fix typo's. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15090)
* cleanup where purpose is not needed in 25-test_verify.tDr. David von Oheimb2021-05-051-67/+67
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14413)
* Fetch cipher-wrap after loading providers.Rich Salz2021-05-051-1/+10
| | | | | | | | Use official (first) names for wrapping algorithms. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14182)
* Fix KMAC bounds checks.Shane Lontis2021-05-051-0/+8
| | | | | | | | | | | | | | | | | Setting an output length higher than 8191 was causing a buffer overflow. This was reported by Acumen (FIPS lab). The max output size has increased to ~2M and it now checks this during set_parameters. The encoder related functions now pass in the maximum size of the output buffer so they can correctly check their size. kmac_bytepad_encode_key() calls bytepad twice in order to calculate and check the length before encoding. Note that right_encode() is currently only used in one place but this may change if other algorithms are supported (such as TupleHash). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15106)
* Add a test for the public core bio APIMatt Caswell2021-05-041-0/+12
| | | | | | | | Check that reading/writing to a core bio via BIO_new_from_core_bio() works as expected. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15072)
* test: fix failure with FIPS and no-des configured.Pauli2021-05-041-2/+2
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15105)
* Fix no-fips-securitychecks test failureShane Lontis2021-05-011-0/+1
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15091)
* SM2 signatures work correctly only with SM3 digestsTomas Mraz2021-04-301-0/+1
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15074)
* acvp: fix the no-acvp_test buildPauli2021-04-301-1/+1
| | | | | | | | A pair of the disabled string checks were incorrect. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15082)
* Fix CRL app so that stdin works.Shane Lontis2021-04-301-1/+16
| | | | | | | | | | Fixes #15031 The maybe_stdin needed to be passed to load_key_certs_crls(). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15058)
* Add library context and property query support into the PKCS12 APIJon Spillett2021-04-301-5/+10
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14434)
* Add test case for openssl crl -noout -hash outputTomas Mraz2021-04-291-1/+4
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15044)
* ESS: Export three core functions, clean up TS and CMS CAdES-BES usageDr. David von Oheimb2021-04-281-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14601)
* Skip test_fipsload when fips is disabled.Tomas Mraz2021-04-281-0/+1
| | | | | Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/15027)
* Add testing for updated cipher IVJon Spillett2021-04-288-1/+203
| | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15041)
* Use "canonical" names when matching the output of the commandsTomas Mraz2021-04-282-3/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15028)
* Skip GOST engine tests in out of tree buildsTomas Mraz2021-04-281-1/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15028)
* re-add pyca/cryptography testingPaul Kehrer2021-04-271-8/+8
| | | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15018)
* Fixes related to separation of DH and DHX typesShane Lontis2021-04-267-40/+191
| | | | | | | | | | | | | | | | | | | | | Fix dh_rfc5114 option in genpkey. Fixes #14145 Fixes #13956 Fixes #13952 Fixes #13871 Fixes #14054 Fixes #14444 Updated documentation for app to indicate what options are available for DH and DHX keys. DH and DHX now have different keymanager gen_set_params() methods. Added CHANGES entry to indicate the breaking change. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14883)
* TEST: correct test/recipes/30-test_evp_data/evppkey_ecdh.txtRichard Levitte2021-04-231-0/+8
| | | | | | | | | | | | | | | Some keys with groups that aren't supported by FIPS were still used for Derive stanzas, even when testing with the FIPS provider. This was due to the flaw in evp_keymgmt_util_try_import() that meant that even though the key was invalid for FIPS, it could still come through, because the imported keydata wasn't cleared on import error. With that flaw corrected, these few Derive stanzas start failing. We mitigate this by making of "offending" Derive stanzas only available with the default provider. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/15008)
* test: separate some DES based tests out to permit a no-des build to workPauli2021-04-235-30/+59
| | | | | | | | | | | One of the KDFs and one of the MACs use DES as an underlying algorithm in some tests. Separate these out into their own files which are conditionally excluded. Fixes #14958 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14975)
* Runchecker: fix TLS curves test failure with no-tls1_3 optionPauli2021-04-231-1/+2
| | | | | | | | | | | | The TLS curves test strong assumes that TLS 1.2 and TLS 1.3 are present. It is only conditioned out if TLS 1.2 isn't. This changes also conditions it out if TLS 1.3 isn't present. Fixes ##14965 Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14978)
* test_sslextension: skip tests that cannot work with no-tls1_2Tomas Mraz2021-04-221-20/+22
| | | | | | | Fixes runchecker failure of no-tls1_2 build. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14955)
* Update copyright yearMatt Caswell2021-04-223-3/+3
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14986)
* TEST: Adapt the EVP testRichard Levitte2021-04-211-1/+1
| | | | | | | The EVP test didn't recognise ERR_R_UNSUPPORTED, now does Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14834)
* Update krb5 module to latest releaseTomas Mraz2021-04-192-2/+2
| | | | | | | | | | Fixes #14902 Also add workaround of `sudo hostname localhost` for the intermittent test failures seen in CI. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/14872)
* SipHash: Fix CTRL API for the digest size.Pauli2021-04-161-1/+7
| | | | | | | | | | Adds a mapping from "digestsize" to "size" for setting a param. Fixes #14370 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14850)
* 80-test_cmp_http.t: Extend diagnostics of mock server launchDr. David von Oheimb2021-04-141-1/+2
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14839)
* 80-test_cmp_http.t: Silence check for availability of 'kill' and 'lsof' commandsDr. David von Oheimb2021-04-141-2/+2
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14839)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 19:26:41 +0000