aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
...
* Secure memory fixesTodd Short2016-05-021-6/+67
| | | | | | | | | | | | | | | Fix some of the variables to be (s)size_t, so that more than 1GB of secure memory can be allocated. The arena has to be a power of 2, and 2GB fails because it ends up being a negative 32-bit signed number. The |too_late| flag is not strictly necessary; it is easy to figure out if something is secure memory by looking at the arena. As before, secure memory allocations will not fail, but now they can be freed correctly. Once initialized, secure memory can still be used, even if allocations occured before initialization. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Misc tweaks for EBCDIC based on feedback receivedMatt Caswell2016-04-293-7/+3
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* Fix the tests to work with EBCDICMatt Caswell2016-04-294-40/+34
| | | | | | | Most of the tests already pass with EBCIDC but a few were trying to write into read only memory. Reviewed-by: Andy Polyakov <appro@openssl.org>
* various spelling fixesFdaSilvaYY2016-04-281-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/952)
* add test for CVE-2016-2109Dr. Stephen Henson2016-04-232-1/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* In d2i_test return error for malloc failure.Dr. Stephen Henson2016-04-231-0/+3
| | | | | | | Bad ASN.1 data should never be able to trigger a malloc failure so return an error in d2i_test if a malloc failure occurs. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Extensions to d2i_test.Dr. Stephen Henson2016-04-222-17/+103
| | | | | | | | | Using ASN1_ITEM tables in d2i_test: this then uses consistent names and makes it easier to extend. Add bio, reencode and compare tests. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Unified copyright for test recipesRich Salz2016-04-2275-533/+580
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a best effort test to check shared library consistencyRichard Levitte2016-04-221-0/+115
| | | | | | | | | | | | | | | | | | | | | Our main development platforms are of the Unix family, which doesn't have the same strictness regarding a shared library being consistent with the contents of the ld script (.map file, on Linux and Solaris) as Windows is with the contents of the .def file or VMS is with the linker symb_vector option. To eliminate surprises, we therefore need to make sure to check that the contents of the .map file is matched with the shared library, at least to check that the shared library isn't missing any symbols that should be present. This test isn't absolutely perfect, as it will only check the symbols that would be present on Linux / Solaris and will therefore miss those that would only appear on Windows or VMS. On the other hand, those platform specific are few and far apart in time, so it's not likely they will pose a problem. Reviewed-by: Matt Caswell <matt@openssl.org>
* Copyright consolidation; .pm and ConfigureRich Salz2016-04-204-1/+28
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove --classic build entirelyRichard Levitte2016-04-201-410/+0
| | | | | | | | The Unix build was the last to retain the classic build scheme. The new unified scheme has matured enough, even though some details may need polishing. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Copyright consolidation: perl filesRich Salz2016-04-206-104/+36
| | | | | | | | | Add copyright to most .pl files This does NOT cover any .pl file that has other copyright in it. Most of those are Andy's but some are public domain. Fix typo's in some existing files. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make string_to_hex/hex_to_string publicRich Salz2016-04-181-1/+1
| | | | | | Give the API new names, document it. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Rename some lowercase API'sRich Salz2016-04-181-15/+15
| | | | | | | | | Make OBJ_name_cmp internal Rename idea_xxx to IDEA_xxx Rename get_rfc_xxx to BN_get_rfc_xxx Rename v3_addr and v3_asid functions to X509v3_... Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make many X509_xxx types opaque.Rich Salz2016-04-151-11/+17
| | | | | | | | | Make X509_OBJECT, X509_STORE_CTX, X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD opaque. Remove unused X509_CERT_FILE_CTX Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Fix no-stdio and no-autoalginitMatt Caswell2016-04-141-206/+208
| | | | | | | | | | | | | | no-stdio does not work with the apps. Since the tests also need the apps it doesn't support that either. Therefore we disable building of both. no-autoalginit is not compatible with the apps because it requires explicit loading of the algorithms, and the apps don't do that. Therefore we disable building the apps for this option. Similarly the tests depend on the apps so we also disable the tests. Finally the whole point about no-autoalginit is to avoid excessive executable sizes when doing static linking. Therefore we disable "shared" if this option is selected. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix AFALG kernel and headers mismatch problemMatt Caswell2016-04-141-0/+16
| | | | | | | | | | | | During Configure we attempt to check the kernel version of this platform to see whether we can compile the AFALG engine. If the kernel version looks recent enough then we enable AFALG. However when we compile e_afalg.c we check the version of the linux headers. If there is a mismatch between the linux headers and the currently running kernel then we don't compile the AFLAG engine and continue. This was causing a link error. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Don't use deprecated CONF_modules_free() in testsViktor Dukhovni2016-04-141-1/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix no-tls1_1 and no-tls1_2Matt Caswell2016-04-131-1/+1
| | | | | | The above config options were failing in test_ssl_old. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix the no-tls optionMatt Caswell2016-04-111-15/+18
| | | | | | The no-tls option was failing in the tests. This fixes it. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix the no-nextprotoneg optionMatt Caswell2016-04-112-0/+6
| | | | | | Misc fixes to get no-nextprotoneg config option working again. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix warnings exposed by clang-3.8Emilia Kasper2016-04-101-2/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Don't check the generated ssl-tests configs on VMSRichard Levitte2016-04-091-1/+2
| | | | | | | The simple reason is that the pre-generated files are mainly for Unix. The VMS variants look slightly different, so comparing will always fail. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* VMS doesn't have directory separators in the same sense as UnixRichard Levitte2016-04-091-3/+5
| | | | | | | Don't add / in file specs on VMS. The directory "separator" is part of the directory spec. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Make DH opaqueMatt Caswell2016-04-092-32/+62
| | | | | | | Move the dh_st structure into an internal header file and provide relevant accessors for the internal fields. Reviewed-by: Richard Levitte <levitte@openssl.org>
* test/[dane|evp_]test.c: BIO-fy file I/O.Andy Polyakov2016-04-072-19/+19
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Suppress CT callback as appropriateViktor Dukhovni2016-04-073-32/+31
| | | | | | | | | | | | | | | | | | | | | | Suppress CT callbacks with aNULL or PSK ciphersuites that involve no certificates. Ditto when the certificate chain is validated via DANE-TA(2) or DANE-EE(3) TLSA records. Also skip SCT processing when the chain is fails verification. Move and consolidate CT callbacks from libcrypto to libssl. We also simplify the interface to SSL_{,CTX_}_enable_ct() which can specify either a permissive mode that just collects information or a strict mode that requires at least one valid SCT or else asks to abort the connection. Simplified SCT processing and options in s_client(1) which now has just a simple pair of "-noct" vs. "-ct" options, the latter enables the permissive callback so that we can complete the handshake and report all relevant information. When printing SCTs, print the validation status if set and not valid. Signed-off-by: Rob Percival <robpercival@google.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* OpenSSL::Test: when moving directory, affect env as wellRichard Levitte2016-04-071-0/+22
| | | | | | | | | The environment variables TOP, SRCTOP, BLDTOP, ... are used to affect the testing framework. However, subprocesses may want to use them as well, and therefore need their values corrected when we move to a different directory. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Allow generate_ssl_tests.pl to find testlibEmilia Kasper2016-04-071-0/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Better use BIO_snprintf() than snprintf(), in case the later isn't availableRichard Levitte2016-04-071-2/+2
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Make the RSA structure opaqueRichard Levitte2016-04-061-11/+14
| | | | | | | | Move rsa_st away from public headers. Add accessor/writer functions for the public RSA data. Adapt all other source to use the accessors and writers. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix no-ocspMatt Caswell2016-04-062-0/+7
| | | | | | Misc fixes for no-ocsp Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add missing mem leak test activation and checksFdaSilvaYY2016-04-063-0/+28
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Rename ssltest -> ssltest_oldEmilia Kasper2016-04-054-26/+26
| | | | | | | ssltest_old.c is deprecated. New tests should use ssl_test.c, and the recipes in 80-test_ssl_new.t Reviewed-by: Richard Levitte <levitte@openssl.org>
* testutil: return 1 on successEmilia Kasper2016-04-056-41/+25
| | | | | | | Require that test methods return 1 on success (not 0). This is more customary for OpenSSL. Reviewed-by: Rich Salz <rsalz@openssl.org>
* New SSL test frameworkEmilia Kasper2016-04-0522-65/+12310
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
* Revert "various spelling fixes"Rich Salz2016-04-041-1/+1
| | | | | | | This reverts commit 620d540bd47a96fb6905fbbdd8ea5167a8841a3e. It wasn't reviewed. Reviewed-by: Rich Salz <rsalz@openssl.org>
* various spelling fixesFdaSilvaYY2016-04-041-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix memory leaks in ASN.1Emilia Kasper2016-04-046-4/+149
| | | | | | | | | These leaks affect 1.1.0 dev branch only; introduced around commit f93ad22f6adb00e722c130e792799467f3927b56 Found with LibFuzzer Reviewed-by: Ben Laurie <ben@openssl.org>
* Move peer chain security checks into x509_vfy.cViktor Dukhovni2016-04-0315-5/+268
| | | | | | | | | | | | | | | | | | | A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Make DSA_METHOD opaqueMatt Caswell2016-04-031-3/+5
| | | | | | | | Move the dsa_method structure out of the public header file, and provide getter and setter functions for creating and modifying custom DSA_METHODs. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Make the DSA structure opaqueMatt Caswell2016-04-031-5/+5
| | | | | | | | | Move the dsa_st structure out of the public header file. Add some accessor functions to enable access to the internal fields, and update all internal usage to use the new functions. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Adapt some test recipes to the newer cmdstr()Richard Levitte2016-04-029-9/+9
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Enhance OpenSSL::Test::cmdstr to give cmd string variantsRichard Levitte2016-04-021-2/+25
| | | | | | | | | | | Within OpenSSL::Test, all commands end up existing in two variants, one that has redirections that are needed internally to work well together with the test harness, and one without those redirections. Depending on what the result is going to be used for, the caller may want one for or the other, so we give them the possibility. Reviewed-by: Rich Salz <rsalz@openssl.org>
* crypto/blake2: make lowest-level function handle multiple blocks..Andy Polyakov2016-03-311-0/+16
| | | | | | | | | | | This minimizes inter-block overhead. Performance gain naturally varies from case to case, up to 10% was spotted so far. There is one thing to recognize, given same circumstances gain would be higher faster computational part is. Or in other words biggest improvement coefficient would have been observed with assembly. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* OpenSSL::Test: have cmdstr() return the true command.Richard Levitte2016-03-311-2/+2
| | | | | | On the other hand, have run() display the display variant. Reviewed-by: Rich Salz <rsalz@openssl.org>
* When looking for executables, don't forget the extensionRichard Levitte2016-03-311-6/+13
| | | | | | | | Because some operating systems have executable extensions, typically ".exe", we need to append it when looking for files in test() and app() (or rather, their subroutines). Reviewed-by: Rich Salz <rsalz@openssl.org>
* When verbosity is requested, OpenSSL::Test::run() displays the commandRichard Levitte2016-03-301-0/+3
| | | | | | It displays the command's exit code as well. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Have OpenSsl..Test::app() and friends look for file in source as wellRichard Levitte2016-03-301-9/+21
| | | | | | | | If the command file that app(), test(), perlapp(9 and perltest() are looking for doesn't exist in the build tree, look for it in the source tree as well. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Since OpenSSL::Test redirects stderr to /dev/null, don't do so in 80-test_ca.tRichard Levitte2016-03-301-4/+4
| | | | | | | | Since OpenSSL::Test only redirects stderr to /dev/null when being run through non-verbose test harness, this change allows the stderr output to be displayed when verbosity is requested. Reviewed-by: Emilia Käsper <emilia@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 19:29:47 +0000