aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* Make DSA_SIG and ECDSA_SIG getters const.Emilia Kasper2016-06-201-12/+27
| | | | | | | | | | Reorder arguments to follow convention. Also allow r/s to be NULL in DSA_SIG_get0, similarly to ECDSA_SIG_get0. This complements GH1193 which adds non-const setters. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Tests should check validation status directlyRob Percival2016-06-201-45/+47
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Test SCT listsRob Percival2016-06-201-23/+30
| | | | | | | This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Useless includesFdaSilvaYY2016-06-182-6/+0
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1168)
* Fix GCC build; make update; fix number re-useRich Salz2016-06-161-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Skip the TLSProxy tests if environmental problems are an issueMatt Caswell2016-06-168-91/+16
| | | | | | | | | | | | | | | | On some platforms we can't startup the TLSProxy due to environmental problems (e.g. network set up on the build machine). These aren't OpenSSL problems so we shouldn't treat them as test failures. Just visibly indicate that we are skipping the test. We only skip the first time we attempt to start up the proxy. If that works then everything else should do...if not we should probably investigate and so report as a failure. This also removes test_networking...there is a danger that this turns into a test of user's environmental set up rather than OpenSSL. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix the build and tests following constification of DH, DSA, RSAMatt Caswell2016-06-162-12/+10
| | | | | | | Misc fixes following the constification of the DH, DSA and RSA getters. Reviewed-by: Stephen Henson <steve@openssl.org>
* modes/asm/ghashp8-ppc.pl: improve performance by 2.7x.Andy Polyakov2016-06-141-0/+9
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* test/evptests.txt: add more XTS tests.Andy Polyakov2016-06-141-0/+85
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Shorten some symbol namesRichard Levitte2016-06-141-17/+17
| | | | | | | | | | VMS C doesn't allow symbols longer than 31 characters. We do the automatic shortening with the library files, but not otherwise (to make sure to work the VMS C magic). For consistency, I shortened other similar symbols in the same manner. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update sslapitest to use the test frameworkMatt Caswell2016-06-132-23/+11
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add some session API testsMatt Caswell2016-06-137-184/+411
| | | | | | | | | | This commit adds some session API tests, and in particular tests the modified behaviour of SSL_set_session() introduced in the last commit. To do this I have factored out some common code from the asynciotest into a new ssltestlib.c file. I've also renamed getsettest to sslapitest as this more closely matches what it now is! Reviewed-by: Rich Salz <rsalz@openssl.org>
* SSL test: only write out server2 when testing SNIEmilia Kasper2016-06-1311-4831/+25
| | | | | | | | | | The SNI tests introduced a redundant "server2" section into every test configuration. Copy this automatically from "server" unless testing SNI, to reduce noise in the generated confs. Also remove duplicate SSL_TEST_CTX_create (merge conflict error). Reviewed-by: Rich Salz <rsalz@openssl.org>
* Handle inability to create AFALG socketMatt Caswell2016-06-131-2/+7
| | | | | | | | | | | | | Some Linux platforms have a suitably recent kernel to support AFALG, but apparently you still can't actually create an afalg socket. This extends the afalg_chk_platform() function to additionally check whether we can create an AFALG socket. We also amend the afalgtest to not report a failure to load the engine as a test failure. A failure to load is almost certainly due to platform environmental issues, and not an OpenSSL problem. RT 4434 Reviewed-by: Andy Polyakov <appro@openssl.org>
* Port DTLS version negotiation testsEmilia Kasper2016-06-1312-171/+2756
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Clean up following new SNI testsEmilia Kasper2016-06-137-63/+69
| | | | | | | | | | | - Only send SNI in SNI tests. This allows us to test handshakes without the SNI extension as well. - Move all handshake-specific machinery to handshake_helper.c - Use enum types to represent the enum everywhere (Resorting to plain ints can end in sign mismatch when the enum is represented by an unsigned type.) Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT3809: basicConstraints is criticalRich Salz2016-06-132-3/+3
| | | | | | | This is really a security bugfix, not enhancement any more. Everyone knows critical extensions. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Fix no-dtls* buildsMatt Caswell2016-06-101-1/+1
| | | | | | | Most of the no-dtls* builds were failing due to one test which had an incorrect "skip" condition. Reviewed-by: Andy Polyakov <appro@openssl.org>
* RT 4242: reject invalid EC point coordinatesEmilia Kasper2016-06-091-6/+90
| | | | | | | | | | | | | | | We already test in EC_POINT_oct2point that points are on the curve. To be on the safe side, move this check to EC_POINT_set_affine_coordinates_* so as to also check point coordinates received through some other method. We do not check projective coordinates, though, as - it's unlikely that applications would be receiving this primarily internal representation from untrusted sources, and - it's possible that the projective setters are used in a setting where performance matters. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix session ticket and SNITodd Short2016-06-0919-9/+4362
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When session tickets are used, it's possible that SNI might swtich the SSL_CTX on an SSL. Normally, this is not a problem, because the initial_ctx/session_ctx are used for all session ticket/id processes. However, when the SNI callback occurs, it's possible that the callback may update the options in the SSL from the SSL_CTX, and this could cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things can happen: 1. The session ticket TLSEXT may not be written when the ticket expected flag is set. The state machine transistions to writing the ticket, and the client responds with an error as its not expecting a ticket. 2. When creating the session ticket, if the ticket key cb returns 0 the crypto/hmac contexts are not initialized, and the code crashes when trying to encrypt the session ticket. To fix 1, if the ticket TLSEXT is not written out, clear the expected ticket flag. To fix 2, consider a return of 0 from the ticket key cb a recoverable error, and write a 0 length ticket and continue. The client-side code can explicitly handle this case. Fix these two cases, and add unit test code to validate ticket behavior. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1098)
* Fixes to get -ansi workingJeffrey Walton2016-06-081-2/+6
| | | | | | | | | | | | Various fixes to get the following to compile: ./config no-asm -ansi -D_DEFAULT_SOURCE RT4479 RT4480 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Add some accessor API'sRich Salz2016-06-084-2/+74
| | | | | | | | | GH1098: Add X509_get_pathlen() (and a test) GH1097: Add SSL_is_dtls() function. Documented. Reviewed-by: Matt Caswell <matt@openssl.org>
* Add empty record testsMatt Caswell2016-06-071-0/+81
| | | | | | | | | | | The previous commit changed how we handle out-of-context empty records. This commit adds some tests for the various scenarios. There are three tests: 1: Check that if we inject an out-of-context empty record then we fail 2: Check that if we inject an in-context empty record then we succeed 3: Check that if we inject too many in-context empty records then we fail. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Add a BN_mod_word test()Matt Caswell2016-06-071-1/+7
| | | | | | | The previous commit fixed a bug with BN_mod_word() which would have been caught if we had a test for it. This commit adds one. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Add an SSL get/set testMatt Caswell2016-06-073-1/+115
| | | | | | | We just do the getters/setter for tlsext_status_type. This could be extended for others in the future. Reviewed-by: Rich Salz <rsalz@openssl.org>
* tests: fix the shutting up of the shellRichard Levitte2016-06-061-4/+6
| | | | | | | | If we're going to redirect STDERR and STDOUT, it's better to do it by the book. This fix is a straight copy of examples in the perlfunc manual. Reviewed-by: Matt Caswell <matt@openssl.org>
* Deprecate the flags that switch off constant timeMatt Caswell2016-06-063-15/+2
| | | | | | | | | The flags RSA_FLAG_NO_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME and DH_FLAG_NO_EXP_CONSTTIME which previously provided the ability to switch off the constant time implementation for RSA, DSA and DH have been made no-ops and deprecated. Reviewed-by: Richard Levitte <levitte@openssl.org>
* tests: Shut the shell up unless verboseRichard Levitte2016-06-062-1/+17
| | | | | | | In rare cases, the shell we run test programs in may have complaints. Shut those up unless testing verbosely. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Silence misleading test_abort stderr outputViktor Dukhovni2016-06-051-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make 25-test_gen.t and 25-test_req.t into oneRichard Levitte2016-06-042-55/+30
| | | | | | | | | | Since one generates files that the other depends on, there's no real reason to keep them separate. Since they were both different aspects of 'openssl req', the merge ends up in 25-test_req.t. This also makes cleanup easier. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Have some more test recipes clean up after themselvesRichard Levitte2016-06-043-3/+43
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Generate simple build test filesRichard Levitte2016-06-042-1/+54
| | | | | | | | | | Generate small test programs to check that external programs can be built with our stuff at a very basic level. For now, they check that each of our header files can be included individually without compile failure. Reviewed-by: Rich Salz <rsalz@openssl.org>
* tests: clean up temporary SSL session files.Richard Levitte2016-06-032-8/+16
| | | | | | RT#4557 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update client authentication testsEmilia Kasper2016-06-035-61/+778
| | | | | | | | Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Testing symbol presence: also take note of small objectsRichard Levitte2016-06-021-1/+1
| | | | | | | | The S symbol class wasn't checked. Notified by Sebastian Andrzej Siewior Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove/rename some old files.Rich Salz2016-06-014-315/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add final(?) set of copyrights.Rich Salz2016-06-017-0/+53
| | | | | | | | | Add copyright to missing assembler files. Add copyrights to missing test/* files. Add copyrights Various source and misc files. Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT4337: Crash in DESRich Salz2016-06-011-4/+17
| | | | | | | Salt must be two ASCII characters. Add tests to check for that, and a test to test the checks. Reviewed-by: Matt Caswell <matt@openssl.org>
* perl: use the 'if' module to conditionally load File::GlobRichard Levitte2016-05-303-9/+3
| | | | | | | Trying to use normal perl conditions to conditionally 'use' a perl module didn't quite work. Using the 'if' module to do so does work. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Configure,test/recipes: "pin" glob to File::Glob::glob.Andy Polyakov2016-05-293-6/+15
| | | | | | | | | | | | | | As it turns out default glob's behaviour for quoted argument varies from version to version, making it impossible to Configure or run tests in some cases. The reason for quoting globs was to accommodate source path with spaces in its name, which was treated by default glob as multiple paths. File::Glob::glob on the other hand doesn't consider spaces as delimiters and therefore works with unquoted patterns. [Unfortunaltely File::Glob::glob, being too csh-ly, doesn't work on VMS, hence the "pinning" is conditional.] Reviewed-by: Richard Levitte <levitte@openssl.org>
* make sure to put quotes around -config argument, in case of spacesRichard Levitte2016-05-271-3/+3
| | | | | | RT#4486 Reviewed-by: Matt Caswell <matt@openssl.org>
* perl glob: make sure to put quotes around the pattern, in case of spacesRichard Levitte2016-05-272-3/+3
| | | | | | RT#4486 Reviewed-by: Matt Caswell <matt@openssl.org>
* Avoid msys name manglingMatt Caswell2016-05-271-4/+10
| | | | | | | | | | | | | | | | | | If using the msys console then msys attempts to "fix" command line arguments to convert them from Unix style to Windows style. One of the things it does is to look for arguments seperated by colons. This it assumes is a list of file paths, so it replaces the colon with a semi-colon. This was causing one of our tests to fail when calling the "req" command line app. We were attempting to create a new DSA key and passing the argument "dsa:../apps/dsa1024.pem". This is exactly what we intended but Msys mangles it to "dsa;../apps/dsa1024.pem" and the command fails. There doesn't seem to be a way to suppress Msys name mangling. Fortunately we can work around this issue by generating the DSA key in a separate step by calling "gendsa". RT#4255 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Silence some "may be uninitialized when used" warningMatt Caswell2016-05-271-3/+3
| | | | | | | | Clang was complaining about some variables possibly being uninitialized when used. The warnings are bogus, but clang can't figure that out. This silences the warnings. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a test for printing floating point format specifiersMatt Caswell2016-05-273-1/+243
| | | | | | | Previous commits fixed the implementation of the %e and %g format specifiers as well as other issues. This commit adds a test. Reviewed-by: Richard Levitte <levitte@openssl.org>
* build.info files: add quotes around any spec that may contain spacesRichard Levitte2016-05-251-59/+59
| | | | | | RT#4492 Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add checks on CRYPTO_set_ex_data return valueFdaSilvaYY2016-05-231-3/+5
| | | | | | | Fix possible leak in danetest.c Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Add OpenSSL copyright to .pl filesRich Salz2016-05-211-2/+7
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add an async io testMatt Caswell2016-05-203-1/+407
| | | | | | | | | This adds an async IO test. There are two test runs. The first one does a normal handshake with lots of async IO events. The second one does the same but this time breaks up all the written records into multiple records of one byte in length. We do this all the way up until the CCS. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Simplify SSL BIO buffering logicMatt Caswell2016-05-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The write BIO for handshake messages is bufferred so that we only write out to the network when we have a complete flight. There was some complexity in the buffering logic so that we switched buffering on and off at various points through out the handshake. The only real reason to do this was historically it complicated the state machine when you wanted to flush because you had to traverse through the "flush" state (in order to cope with NBIO). Where we knew up front that there was only going to be one message in the flight we switched off buffering to avoid that. In the new state machine there is no longer a need for a flush state so it is simpler just to have buffering on for the whole handshake. This also gives us the added benefit that we can simply call flush after every flight even if it only has one message in it. This means that BIO authors can implement their own buffering strategies and not have to be aware of the state of the SSL object (previously they would have to switch off their own buffering during the handshake because they could not rely on a flush being received when they really needed to write data out). This last point addresses GitHub Issue #322. Reviewed-by: Andy Polyakov <appro@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-27 03:53:43 +0000