aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* test/certs/setup.sh: Fix two glitchesDr. David von Oheimb2020-12-041-3/+3
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13606)
* evp_pkey_dparams_test.c: Fix build error on OPENSSL_NO_{DH,DSA,EC}Dr. David von Oheimb2020-12-041-1/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13110)
* endecode_test.c: Fix build errors on OPENSSL_NO_{DH,DSA,EC,EC2M}Dr. David von Oheimb2020-12-041-2/+8
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13110)
* Fix no-dsaMatt Caswell2020-12-041-24/+28
| | | | | | | | | | Skip tests that require DSA to be available. While we're doing this we also remove an OPENSSL_NO_DSA guard in the dhparam app that is no longer necessary (even though DSA may not be present in our own providers it could be available via a third party provider). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13599)
* Fix ecdsa digest setting code to match dsa.Shane Lontis2020-12-041-0/+21
| | | | | | | | | | | | | | Fixes #13422 ecdsa_set_ctx_params() was not setting the digest correctly. The side effect noted was that the check for sha1 when signing was not being done in fips mode. Also fixed the dupctx() so that propq is deep copied. The usage of the variable 'flag_allow_md' was also copied from the dsa code. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13520)
* x509_vfy.c: Restore rejection of expired trusted (root) certificateDr. David von Oheimb2020-12-033-1/+24
| | | | | | | | | | | | | | | | | | | | The certificate path validation procedure specified in RFC 5280 does not include checking the validity period of the trusted (root) certificate. Still it is common good practice to perform this check. Also OpenSSL did this until commit 0e7b1383e, which accidentally killed it. The current commit restores the previous behavior. It also removes the cause of that bug, namely counter-intuitive design of the internal function check_issued(), which was complicated by checks that actually belong to some other internal function, namely find_issuer(). Moreover, this commit adds a regression check and proper documentation of the root cert validity period check feature, which had been missing so far. Fixes #13427 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13590)
* Add test to demonstrate the app's new engine key loadingRichard Levitte2020-12-021-1/+40
| | | | | | | | | | This adds a bit of functionality in ossltest, so it can now be used to load PEM files. It takes the file name as key ID, but just to make sure faults aren't ignored, it requires all file names to be prefixed with 'ot:'. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13570)
* Fix no-dtlsMatt Caswell2020-12-021-1/+2
| | | | | | | | Ensure we correctly detect if DTLS has been disabled in the client auth test_ssl_new tests. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13587)
* openssl dgst: add option to specify output length for XOFDaiki Ueno2020-12-021-2/+16
| | | | | | | | | This adds the -xoflen option to control the output length of the XOF algorithms, such as SHAKE128 and SHAKE256. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13245)
* Adapt everything else to the updated OSSL_ENCODER_CTX_new_by_EVP_PKEY()Richard Levitte2020-12-024-6/+6
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13545)
* Add EVP_KDF-X942 to the fips moduleShane Lontis2020-12-025-14/+63
| | | | | | | | | | | | | | | | | The X942 KDF had been modified so that it supports all optional fields - not just the fields used by CMS. As there are 2 types of KDF for X942 - this has been made a bit clearer by adding an X942KDF-ASN1 alias. X942KDF-CONCAT has also been added as an alias of X963KDF. This work was instigated as a result of the ACVP tests optionally being able to use keybits for the supp_pubinfo field. Setting the parameter OSSL_KDF_PARAM_X942_USE_KEYBITS to 0 allows this to be disabled. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13418)
* Print random seed on test failure.Pauli2020-12-021-6/+9
| | | | | | | | | Tests randomisation wasn't reliably printing the seed used on failure in the CIs. Fixes: #13572 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13573)
* Fix simpledynamic.c - a typo and missed a headerKelvin Lee2020-12-021-1/+2
| | | | | | | | | CLA: trivial Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13584)
* TEST: Add a simple module loader, and test the FIPS module with itRichard Levitte2020-12-013-0/+83
| | | | | | | | | | | | | | | This very simple module loader is only linked with the standard C library, so cannot and should not provide any other symbol to the module it tries to load. It can thereby be used to verify that the module it tries to load doesn't have any surprising dependencies when it's supposed to be self contained. A test recipe is added to verify the FIPS module with this loader. Fixes #11020 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13507)
* TEST: Break out the local dynamic loading code from shlibloadtest.cRichard Levitte2020-12-014-83/+143
| | | | | | | The result is "simpledynamic.c", or "sd" for short. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13507)
* endecode_test.c: Add warning that 512-bit DH key size is for testing onlyDr. David von Oheimb2020-12-011-1/+4
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13568)
* test cleanup: move helper .c and .h files to test/helpers/Dr. David von Oheimb2020-12-0142-89/+79
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13568)
* remove obsolete test/drbg_cavs_data.hDr. David von Oheimb2020-12-011-88/+0
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13568)
* remove obsolete test/drbg_extra_test.hDr. David von Oheimb2020-12-011-188/+0
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13568)
* Fix builds that specify both no-dh and no-ecMatt Caswell2020-11-301-0/+8
| | | | | | | | | | | | Various sections of code assumed that at least one of dh or ec would be available. We also now also need to handle cases where a provider has a key exchange algorithm and TLS-GROUP that we don't know about. Fixes #13536 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13549)
* Fix instances of pointer addition with the NULL pointerMatt Caswell2020-11-302-5/+9
| | | | | | | | | | Addition using the NULL pointer (even when adding 0) is undefined behaviour. Recent versions of ubsan are now complaining about this, so we fix various instances. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13513)
* endecode_test.c: Significant speedup in generating DH and DHX keysDr. David von Oheimb2020-11-296-169/+242
| | | | | | | Fixes #13495 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13552)
* TEST: Fix path length in test/ossl_store_test.cRichard Levitte2020-11-281-1/+10
| | | | | | | | | | | | | The URI length was set to 80 chars, but the URI being built up may need more space, all depending on the paths used to get to the files that are to be loaded. If the result needs more than 80 chars, the test will fail. Fixed by using PATH_MAX. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13546)
* X509_dup: fix copying of libctx and propq using new ASN1_OP_DUP_POST cb ↵Dr. David von Oheimb2020-11-271-14/+4
| | | | | | | | | operation Fixes #12680 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12687)
* Deprecate more DH functionsMatt Caswell2020-11-271-0/+6
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13138)
* Don't test a deprecated function in a no-deprecated buildMatt Caswell2020-11-271-2/+2
| | | | | | | | EVP_PKEY_set1_DH is deprecated so there is no need to test it in a no-deprecated build. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13138)
* Deprecate the DHparams and DHxparams PEM routinesMatt Caswell2020-11-273-7/+11
| | | | | | | The functions return a DH object and therefore need to be deprecated. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13138)
* TEST: Adapt test/errtest for the 'no-err' configurationRichard Levitte2020-11-271-9/+26
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13510)
* Fix no-deprecated configurationShane Lontis2020-11-271-2/+2
| | | | | | | | | pem_read_depr_test needed to be setup in build info so that it only exists inside an IF[{- !$disabled{'deprecated-3.0'} -}] block. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13543)
* Add test for no reset after DigestFinal_ex and DigestFinalXOFTomas Mraz2020-11-261-0/+46
| | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13402)
* Update copyright yearMatt Caswell2020-11-261-1/+1
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13533)
* Fix no-rc2Matt Caswell2020-11-251-8/+12
| | | | | | | | Skip a test that relies on RC2 being present in a no-rc2 build. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13496)
* re-encrypt 81-test_cmp_cli_data/Mock/signer.p12 with AES-256-CBC (avoiding DES)Dr. David von Oheimb2020-11-251-0/+0
| | | | | | | Fixes #13494 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13497)
* Re-enable testing of ciphersuitesMatt Caswell2020-11-253-80/+107
| | | | | | | | | Commit be9d82bb3 inadvertently disabled ciphersuite testing. This masked some issues. Therefore we fix this testing. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13378)
* Test that OSSL_STORE can load various types of paramsMatt Caswell2020-11-255-2/+123
| | | | | | | | | There have been instances where OSSL_STORE got confused between DSA and DH params (e.g. see issue #13046) due the DER encoding of DH and DSA params looking identical. Therefore we test that we get the types that we expect. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13329)
* Test various deprecated PEM_read_bio_* APIsMatt Caswell2020-11-2510-1/+349
| | | | | | | | Add tests for various deprecated PEM_read_bio_*() functions to ensure they can still read the various files. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13329)
* TEST: Make our test data binaryRichard Levitte2020-11-244-6/+6
| | | | | | | | | | | | | Our test data (test/data.txt and test/data2.txt) are text files, but declaring them binary means that there will be no line ending transformation done on them. This is necessary for testing on non-Unix platforms, where certain tests could otherwise give results that don't match expected results. Fixes #13474 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13477)
* Add a test for the dhparam CLI applicationMatt Caswell2020-11-239-0/+194
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13231)
* Fix crash in genpkey app when -pkeyopt digest:name is used for DH or DSA.Shane Lontis2020-11-202-2/+18
| | | | | | | | By the time the keygen is called the references to strings inside the gen ctx are floating pointers. A strdup solves this problem. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13432)
* test RNG: set state to uninitialised as part of uninstantiate call.Pauli2020-11-201-1/+1
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13226)
* test: changes resulting from moving the entropy source out of the FIPS providerPauli2020-11-201-1/+1
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13226)
* Add a test for setting, popping and clearing error marksMatt Caswell2020-11-191-0/+119
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13335)
* apps/pkcs12: Retain test output filesDavid von Oheimb2020-11-191-9/+9
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/4930)
* Deprecate RSA harderRichard Levitte2020-11-184-35/+57
| | | | | | | This deprecates all functions that deal with the types RSA and RSA_METHOD Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13096)
* Swap to FIPS186-2 DSA generation outside of the FIPS moduleMatt Caswell2020-11-182-0/+2
| | | | | | | | Inside the FIPS module we continue to use FIPS186-4. We prefer FIPS186-2 in the default provider for backwards compatibility reasons. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13228)
* Adapt ssltest_old to not use deprecated DH APIsMatt Caswell2020-11-181-91/+67
| | | | | | | There are non-deprecated replacements so we should use those instead. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
* Extend the auto DH testing to check DH sizesMatt Caswell2020-11-181-0/+157
| | | | | | | | Check that the size of the DH parameters we select changes according to the size of the certificate key or symmetric cipher (if no certificate). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
* Add some additional test certificates/keysMatt Caswell2020-11-189-0/+318
| | | | | | | Add certs with 1024, 3072, 4096 and 8192 bit RSA keys Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
* Add a test for the various ways of setting temporary DH paramsMatt Caswell2020-11-184-6/+206
| | | | | | | | We support a number of different ways of setting temporary DH params. We should test that they all work correctly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
* Fix dsa securitycheck for fips.Shane Lontis2020-11-162-9/+7
| | | | | | | | | | | | Fixes #12627 Changed security check for DSA verification to match SP800-131Ar2 when the security strength is < 112. Fixed compilation error when using config opt 'no-fips-securitychecks' Removed TODO's from 20-test_cli_fips.t - there is no longer an TODO error. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13387)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 11:44:46 +0000