aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* [test] ECC: check the bounds for auto computing cofactorBilly Brumley2019-09-091-0/+91
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/9821)
* Revise EVP_PKEY param handlingMatt Caswell2019-09-091-0/+114
| | | | | | | | | | | | We add new functions for getting parameters and discovering the gettable and settable parameters. We also make EVP_PKEY_CTX_get_signature_md() a function and implement it in terms of the new functions. This enables applications to discover the set of parameters that are supported for a given algorithm implementation. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9753)
* Check the DH modulus bit lengthBernd Edlinger2019-09-091-3/+13
| | | | | | | | | The check was missing in DH_check and DH_check_params. [extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9796)
* Uniform TEST_*() check usage in test/ectest.cNicola Tuveri2019-09-091-13/+13
| | | | | | | | | | | | - Replace a `TEST_true()` with `!TEST_false()` to avoid reporting confusing errors - We tend to use `if (!TEST_foo() || !TEST_bar())` and it's a bit confusing to switch to `if(!(TEST_foo() && TEST_bar()))`: replace it with the more common style Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9813)
* Fix spacing nit in test/ectest.cNicola Tuveri2019-09-091-1/+1
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9813)
* [ec] Match built-in curves on EC_GROUP_new_from_ecparametersNicola Tuveri2019-09-091-0/+267
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Description ----------- Upon `EC_GROUP_new_from_ecparameters()` check if the parameters match any of the built-in curves. If that is the case, return a new `EC_GROUP_new_by_curve_name()` object instead of the explicit parameters `EC_GROUP`. This affects all users of `EC_GROUP_new_from_ecparameters()`: - direct calls to `EC_GROUP_new_from_ecparameters()` - direct calls to `EC_GROUP_new_from_ecpkparameters()` with an explicit parameters argument - ASN.1 parsing of explicit parameters keys (as it eventually ends up calling `EC_GROUP_new_from_ecpkparameters()`) A parsed explicit parameter key will still be marked with the `OPENSSL_EC_EXPLICIT_CURVE` ASN.1 flag on load, so, unless programmatically forced otherwise, if the key is eventually serialized the output will still be encoded with explicit parameters, even if internally it is treated as a named curve `EC_GROUP`. Before this change, creating any `EC_GROUP` object using `EC_GROUP_new_from_ecparameters()`, yielded an object associated with the default generic `EC_METHOD`, but this was never guaranteed in the documentation. After this commit, users of the library that intentionally want to create an `EC_GROUP` object using a specific `EC_METHOD` can still explicitly call `EC_GROUP_new(foo_method)` and then manually set the curve parameters using `EC_GROUP_set_*()`. Motivation ---------- This has obvious performance benefits for the built-in curves with specialized `EC_METHOD`s and subtle but important security benefits: - the specialized methods have better security hardening than the generic implementations - optional fields in the parameter encoding, like the `cofactor`, cannot be leveraged by an attacker to force execution of the less secure code-paths for single point scalar multiplication - in general, this leads to reducing the attack surface Check the manuscript at https://arxiv.org/abs/1909.01785 for an in depth analysis of the issues related to this commit. It should be noted that `libssl` does not allow to negotiate explicit parameters (as per RFC 8422), so it is not directly affected by the consequences of using explicit parameters that this commit fixes. On the other hand, we detected external applications and users in the wild that use explicit parameters by default (and sometimes using 0 as the cofactor value, which is technically not a valid value per the specification, but is tolerated by parsers for wider compatibility given that the field is optional). These external users of `libcrypto` are exposed to these vulnerabilities and their security will benefit from this commit. Related commits --------------- While this commit is beneficial for users using built-in curves and explicit parameters encoding for serialized keys, commit b783beeadf6b80bc431e6f3230b5d5585c87ef87 (and its equivalents for the 1.0.2, 1.1.0 and 1.1.1 stable branches) fixes the consequences of the invalid cofactor values more in general also for other curves (CVE-2019-1547). The following list covers commits in `master` that are related to the vulnerabilities presented in the manuscript motivating this commit: - d2baf88c43 [crypto/rsa] Set the constant-time flag in multi-prime RSA too - 311e903d84 [crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation. - b783beeadf [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it - 724339ff44 Fix SCA vulnerability when using PVK and MSBLOB key formats Note that the PRs that contributed the listed commits also include other commits providing related testing and documentation, in addition to links to PRs and commits backporting the fixes to the 1.0.2, 1.1.0 and 1.1.1 branches. Responsible Disclosure ---------------------- This and the other issues presented in https://arxiv.org/abs/1909.01785 were reported by Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya and Billy Bob Brumley from the NISEC group at Tampere University, FINLAND. The OpenSSL Security Team evaluated the security risk for this vulnerability as low, and encouraged to propose fixes using public Pull Requests. _______________________________________________________________________________ Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9808)
* [test] computing ECC cofactors: regression testBilly Brumley2019-09-071-5/+5
| | | | | | | | | | | | | | | | | | | | | | | This is a forward port from https://github.com/openssl/openssl/pull/9781 for the test logic introduced by https://github.com/openssl/openssl/pull/9727 As @mattcaswell commented (https://github.com/openssl/openssl/pull/9781#discussion_r321621541): > These `TEST_true` calls should be `!TEST_false` because we are > *expecting* a failure. > The difference is that the test framework will print error details if > the test doesn't give the expected answer. > So by using `TEST_true` instead of `!TEST_false` we'll get error > details printed, but the test will succeed anyway. (cherry picked from commit e8aafc891d9bd7fa1cce0401d858ef842f09b49e) Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9797)
* Lowercase command line 'N' argument since params have lower case namesPauli2019-09-061-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
* More KDF cleanupRichard Levitte2019-09-061-12/+31
| | | | | | | | | | | | The EVP_KDF_ definitions are no longer needed, and neither is EVP_get_kdfbyname() test/evp_kdf_test.c tried to use a EVP_get_kdfbyname() that was rewritten to use EVP_KDF_fetch() without ever freeing the resulting KDF method. It's better to refactor the test to use EVP_KDF_fetch directly. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9662)
* Update EVP test data for KDFs and PRFs.Pauli2019-09-061-13/+13
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
* Test updates in light of the KDF switchoverPauli2019-09-062-148/+224
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
* Teach TLSProxy how to parse CertificateRequest messagesMatt Caswell2019-09-063-19/+131
| | | | | | | | We also use this in test_tls13messages to check that the extensions we expect to see in a CertificateRequest are there. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9780)
* [test] computing ECC cofactors: regression testBilly Brumley2019-09-051-3/+86
| | | | | | Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9827)
* Change provider params from int to size_tShane Lontis2019-09-051-3/+4
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9699)
* Move libapps.a source to apps/libRichard Levitte2019-09-041-7/+8
| | | | | | | | This makes it clearer what's what. The 'openssl' application and its sub-commands remain in apps/ Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9723)
* OSSL_PARAM_construct_utf8_string computes the string length.Pauli2019-09-041-4/+2
| | | | | | | | If the passed string length is zero, the function computes the string length from the passed string. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9760)
* New function EVP_CIPHER_free()Richard Levitte2019-09-041-5/+5
| | | | | | | | | | | | | | | This function re-implements EVP_CIPHER_meth_free(), but has a name that isn't encumbered by legacy EVP_CIPHER construction functionality. We also refactor most of EVP_CIPHER_meth_new() into an internal evp_cipher_new() that's used when creating fetched methods. EVP_CIPHER_meth_new() and EVP_CIPHER_meth_free() are rewritten in terms of evp_cipher_new() and EVP_CIPHER_free(). This means that at any time, we can deprecate all the EVP_CIPHER_meth_ functions with no harmful consequence. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9758)
* New function EVP_MD_free()Richard Levitte2019-09-041-5/+5
| | | | | | | | | | | | | | | This function re-implements EVP_MD_meth_free(), but has a name that isn't encumbered by legacy EVP_MD construction functionality. We also refactor most of EVP_MD_meth_new() into an internal evp_md_new() that's used when creating fetched methods. EVP_MD_meth_new() and EVP_MD_meth_free() are rewritten in terms of evp_md_new() and EVP_MD_free(). This means that at any time, we can deprecate all the EVP_MD_meth_ functions with no harmful consequence. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9758)
* test/errtest.c: more conditions for checking __FILE__ and __LINE__Richard Levitte2019-09-031-5/+9
| | | | | | | | | When at least one of OPENSSL_NO_ERR or OPENSSL_NO_FILENAMES is defined, __FILE__ and __LINE__ are not saved with the error record. This test only checked OPENSSL_NO_FILENAMES. Now fixed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9755)
* Remove extern declarations of OPENSSL_ia32cap_PBernd Edlinger2019-09-011-5/+1
| | | | | | | | | | | Use the header file internal/cryptlib.h instead. Remove checks for OPENSSL_NO_ASM and I386_ONLY in cryptlib.c, to match the checks in other places where OPENSSL_ia32cap_P is used and assumed to be initialized. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/9688)
* Fix no-ecMatt Caswell2019-08-291-2/+2
| | | | | | | | | A test in sslapitest.c was failing in a no-ec build because we were using an EC based ciphersuite. That particular test doesn't require EC specifically, so we swap to a non EC based ciphersuite. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9716)
* openssl provider: New sub-command, for provider discoveryRichard Levitte2019-08-281-0/+47
| | | | | | | | This command is somewhat similar to 'openssl engine', but displays what it can about the given providers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9697)
* Coverty fixes for MACsRichard Levitte2019-08-271-3/+5
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9700)
* testing: set OPENSSL_MODULES to the providers directory by defaultRichard Levitte2019-08-275-9/+0
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9618)
* Cleanup ciphers and Add 3des ciphers.Shane Lontis2019-08-261-0/+10
| | | | | | | | Moved the relevant ciphers into default and restructed headers to allow the move. This removed most of the cases of #ifdef NO_XXX (which are now specified in build.info) Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9482)
* Get rid of the diversity of names for MAC parametersRichard Levitte2019-08-242-21/+39
| | | | | | | | | | | | | | | The EVP_PKEY MAC implementations had a diversity of controls that were really the same thing. We did reproduce that for the provider based MACs, but are changing our minds on this. Instead of that, we now use one parameter name for passing the name of the underlying ciphers or digests to a MAC implementation, "cipher" and "digest", and one parameter name for passing the output size of the MAC, "size". Then we leave it to the EVP_PKEY->EVP_MAC bridge to translate "md" to "digest", and "digestsize" to "size". Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9667)
* Add app for fips installationShane Lontis2019-08-241-0/+73
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9634)
* test/evp_test.c: distinguish parsing errors from processing errorsRichard Levitte2019-08-231-7/+7
| | | | | | | | | | | | | | | | | | | | | Parsing functions are at liberty to return: 1: when parsing on processing of the parsed value succeeded 0: when the parsed keyword is unknown -1: when the parsed value processing failed Some parsing functions didn't do this quite right, they returned 0 when they should have returned -1, causing a message like this: Line 123: unknown keyword PeerKey When this message (which is displayed when the parsing function returns -1) would have been more appropriate: Line 123: error processing keyword PeerKey = ffdhe2048-2-pub Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9682)
* Support parsing of SM2 ID in hexdecimalPaul Yang2019-08-221-2/+13
| | | | | | | | | | | | | The current EVP_PEKY_ctrl for SM2 has no capability of parsing an ID input in hexdecimal. The newly added ctrl string is called: sm2_hex_id Test cases and documentation are updated. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9584)
* Add basic aria and camellia ciphers modes to default providerShane Lontis2019-08-221-0/+108
| | | | | | | | | | | The aes code has been refactored into generic and algorithn specific parts, so that most of the code can be shared. The cipher related files have been broken up into smaller parts. Add chunked variant of mode ciphers - aria uses this (many other ciphers will use this new code instead of the generic code used by aes). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9451)
* Modify ossl_method_store_add() to accept an OSSL_PROVIDER and check for itRichard Levitte2019-08-221-5/+8
| | | | | | | | | | | | If ossl_method_store_add() gets called with a method that already exists (i.e. the store has one with matching provider, nid and properties), that method should not be stored. We do this check inside ossl_method_store_add() because it has all the locking required to do so safely. Fixes #9561 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9650)
* Modify ossl_method_store_add() to handle reference countingRichard Levitte2019-08-221-3/+3
| | | | | | | | | Because this function affects the reference count on failure (the call to impl_free() does this), it may as well handle incrementing it as well to indicate the extra reference in the method store. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9650)
* Add aes_ccm to providerShane Lontis2019-08-201-0/+6
| | | | | | | | Add Cleanups for gcm - based on the changes to ccm. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/9280)
* Use macros internally for algorithm namesRichard Levitte2019-08-191-2/+5
| | | | | | | | | | The macros are defined in include/openssl/core_names.h and follow the naming standard OSSL_{OPNAME}_NAME_{ALGONAME}, where {OPNAME} is the name of the operation (such as MAC) and {ALGONAME} is the name of the algorithm. Example: OSSL_MAC_NAME_HMAC Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9635)
* cipher cleanups.Shane Lontis2019-08-191-0/+166
| | | | | | | | Add test to evp_test_extra for ciphers (that is similiar to the digest_fetch). Move some of the aes and gcm methods that can be shared with other ciphers into ciphers_common.c Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9580)
* Fix --strict-warnings buildPatrick Steuer2019-08-181-1/+1
| | | | | | | | | | Appease -Wstring-plus-int. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9608)
* Test for out-of-bounds write when requesting zero bytes from shakePatrick Steuer2019-08-181-0/+22
| | | | | | | Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9433)
* Adapt the MAC tests, and tests for other things that use EVP_MACRichard Levitte2019-08-153-96/+79
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
* Test SSL_set_ciphersuitesraja-ashok2019-08-152-64/+198
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9079)
* Rename provider and core get_param_types functionsRichard Levitte2019-08-151-6/+6
| | | | | | | | | | | | | | It was argued that names like SOMETHING_set_param_types were confusing, and a rename has been proposed to SOMETHING_settable_params, and by consequence, SOMETHING_get_param_types is renamed SOMETHING_gettable_params. This changes implements this change for the dispatched provider and core functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9591)
* 30-test_evp.t: make the tested configs depend on what's been builtRichard Levitte2019-08-131-2/+9
| | | | | | | | | If the FIPS module hasn't been built, don't use test/fips.cnf, for example. Fixes #9568 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9570)
* Extend tests of SSL_check_chain()Matt Caswell2019-08-095-41/+106
| | | | | | | | | | Actually supply a chain and then test: 1) A successful check of both the ee and chain certs 2) A failure to check the ee cert 3) A failure to check a chain cert Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9442)
* Fix test_key_exchange with no_tlsv1_2Matt Caswell2019-08-091-4/+8
| | | | | | | Make sure we only test TLSv1.2 things if TLSv1.2 is actually available. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9442)
* Fix test_sslextension if TLSv1.2 has been disabledMatt Caswell2019-08-091-1/+1
| | | | | | | A skip rule was skipping the wrong number of tests. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9442)
* Add TLS tests for RSA-PSS Restricted certificatesMatt Caswell2019-08-092-262/+464
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9553)
* Add Restricted PSS certificate and keyMatt Caswell2019-08-094-0/+85
| | | | | | | Create a PSS certificate with parameter restrictions Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9553)
* Fix no-filenamesMatt Caswell2019-08-081-3/+8
| | | | | | | | If built with no-filenames then we shouldn't test this functionality in the test suite. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9544)
* Run evp_test in FIPS modeMatt Caswell2019-08-073-8/+117
| | | | | | | | | We run the cipher and digest evp_test test files in FIPS mode. Some ciphers/digests aren't available in FIPS mode so we mark those as only being available in the default provider. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9531)
* GCM cipher in provider now fails if passed bad keylengthShane Lontis2019-08-071-0/+15
| | | | | | | Fixes #9500 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9512)
* Test SSL_get_negotiated_group() APIraja-ashok2019-08-061-15/+62
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9323)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 06:40:59 +0000