aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* Add support for unusal 'othername' subjectAltNamesDirk-Willem van Gulik2020-04-252-1/+53
| | | | | | | | | | Increasingly certificates seem to have special things in the subjectAltName that have arbitrary strings in them. E.g. some (now) common in EU export certificates and, for a few years now, certificates issued to medical doctors (in for example the netherlands, the full spec is https://www.uziregister.nl/Media/Default/PDF/20200325%20CA%20model%20pasmodel%20certificaatprofielen%20v10_0.pdf, section 4.8, page 16 for an example of one country). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11599)
* params: change OSSL_PARAM_set_unmodified() to operate on a params arrayPauli2020-04-251-1/+33
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11601)
* Add function load_csr(file,format,desc) to apps/lib/apps.cDavid von Oheimb2020-04-241-4/+4
| | | | | | | | | | | Make use of new load_csr() in 'ca', 'req', and 'x509' app Add '-inform' and '-certform' option to 'ca' app Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c Allow 'desc' parameter to be NULL (gives option to suppress error output) Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940)
* In OpenSSL builds, declare STACK for datatypes ...Rich Salz2020-04-2428-0/+70
| | | | | | | | | | | | | | | | | | | | | | ... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669)
* Rename fipsinstall.cnf->fipsmodule.cnfRich Salz2020-04-244-4/+4
| | | | | | | | Introduced by rebasing Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11177)
* Update some nits around the FIPS moduleRich Salz2020-04-244-4/+4
| | | | | | | | | | | | - Changed the generated FIPS signature file to be "fipsmodule.conf" since it contains information about the FIPS module/file. - Add -q option to fipsinstall command, to stop chatty verbose status messages. - Document env var OPENSSL_CONF_INCLUDE Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11177)
* Update copyright yearMatt Caswell2020-04-23161-161/+161
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
* Skip a no-dsa test in the fipsinstall testMatt Caswell2020-04-221-7/+11
| | | | | | | | In a similar way to the previous commit we also skip a fipsinstall test if DSA has been disabled. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11582)
* Skip a test in a no-dh buildMatt Caswell2020-04-221-7/+12
| | | | | | | | | One of the sub-tests in the fipsinstall test corrupts a DH test to confirm that fipsinstall fails. However that is never noticed in a no-dh build - so we just skip that test in a no-dh build. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11582)
* Fix no-ecMatt Caswell2020-04-221-2/+2
| | | | | | | | | | This was missed by Travis because, although it has a no-ec build, the test that failed only runs in a debug build. The Travis job with no-ec is not a debug build and so the test was skipped. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11581)
* evptest: set the DESX provider to be the legacy provider.Pauli2020-04-221-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11573)
* params: add functionality to test if an OSSL_PARAM has been set.Pauli2020-04-222-4/+7
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11588)
* [crypto/ec] deprecate Jprojective_coordinates_GFp functionsBilly Brumley2020-04-222-79/+74
| | | | | | Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11527)
* Fix no-deprecated tests where the GOST engine is presentMatt Caswell2020-04-211-0/+3
| | | | | | | | | | The GOST test only runs if it detects that the GOST engine is present. This is the case for the run-checker environment. The GOST engine uses some deprecated functions, so we disable that test in a no-deprecated build. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11583)
* Fix no-desMatt Caswell2020-04-211-2/+2
| | | | | | | Disable a recently added CMS test in the case of no-des. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11578)
* Fix an ssl_test_old test failureMatt Caswell2020-04-211-0/+3
| | | | | | | | | | In builds where SSLv3 is enabled ssl_test_old was failing. We need to make sure we disable SSLv3 related tests when using the FIPS provider. [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11586)
* Revert "TEST: make and use a fipsinstall script"Richard Levitte2020-04-214-56/+19
| | | | | | | | | | | | | Unfortunately, this won't work on MacOS because of system integrity measures on that platform, which clears DYLD_LIBRARY_PATH before starting a sub-process executable. Ref: https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/RuntimeProtections/RuntimeProtections.html This reverts commit ae6b654b669638882a6ddce012ff55adc7cf6a82. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11592)
* Add test for CVE-2020-1967Benjamin Kaduk2020-04-211-2/+64
| | | | | | | | | | | | | | Add to test_sslsigalgs a TLSProxy test that injects a "signature_algorithms_cert" extension that contains an unallocated codepoint. The test currently fails, since s_server segfaults instead of ignoring the unrecognized value. Since "signature_algorithms" and "signature_algorithms_cert" are very similar, also add the analogous test for "signature_algorithms". Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix test_cmp_vfy failures with FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTIONDr. David von Oheimb2020-04-211-0/+16
| | | | | | | | [extended tests] Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11585)
* Teach ssl_test_old to use the FIPS provider for its testsMatt Caswell2020-04-202-13/+48
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11534)
* Teach ssl_test_old how to run tests in a non-default library contextMatt Caswell2020-04-201-3/+29
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11534)
* Teach ssl_test_new how to test the FIPS moduleMatt Caswell2020-04-2017-936/+1088
| | | | | | | | We load the FIPS module and make sure it is configured before running the ssl_test_new tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11511)
* Teach ssl_test_new to have different tests for different loaded providersMatt Caswell2020-04-205-498/+516
| | | | | | | | | | | | We now run the tests twice: Once with no specific providers loaded and just using the default libctx, and a second time with a non-default libctx and the default provider. In the second run we disable tests which use a PSS cert/key because we don't yet have support for that. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11511)
* Run ssl_test_new with a non-default library contextMatt Caswell2020-04-202-11/+39
| | | | | | | | We also prepare the way for a future commit to run ssl_test_new with just the FIPS provider loaded. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11511)
* Fix DH_get_nid() so that it does not cache values.Shane Lontis2020-04-203-8/+25
| | | | | | | | | | | | | | | | | | DH_set0_pqg() is now responsible for caching the nid, q and length. DH with or without named safe prime groups now default to using the maximum private key length (BN_num_bits(q) - 1) when generating a DH private key. The code is now shared between fips and non fips mode for DH key generation. The OSSL_PKEY_PARAM_DH_PRIV_LEN parameter can be used during keygen to override the maximum private key length to be in the range (2 * strength ... bits(q) - 1). Where the strength depends on the length of p. Added q = (p - 1) / 2 safe prime BIGNUMS so that the code is data driven (To simplify adding new names). The BIGNUMS were code generated. Fix error in documented return value for DH_get_nid Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11562)
* TEST: make and use a fipsinstall scriptRichard Levitte2020-04-194-19/+56
| | | | | | | | We have copies of the exact same fipsinstall call in several test recipes. This refactors those calls into a single simple script. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11565)
* Re-enable FIPS testing in sslapitest.cMatt Caswell2020-04-192-23/+58
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11508)
* Use a non-default libctx in sslapitestMatt Caswell2020-04-1914-114/+189
| | | | | | | | We also don't load the default provider into the default libctx to make sure there is no accidental "leakage". Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11508)
* tests: reinstate tests for deprecated but non-removed functionalityPauli2020-04-193-30/+13
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225)
* Add CMP fuzzing to fuzz/cmp.c, including a couple of helpers in crypto/cmp/Dr. David von Oheimb2020-04-181-0/+3
| | | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
* Rename CMP_PROTECTEDPART to OSSL_CMP_PROTECTEDPART for consistencyDr. David von Oheimb2020-04-181-2/+3
| | | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11386)
* TEST: Add a test of keygen with an empty template in test/evp_extra_test.cRichard Levitte2020-04-171-0/+42
| | | | | | | | | | We do it with RSA, which may seem strange. However, an RSA "template" is generally ignored, so this is safe. This is modelled after the test code given in github issue #11549. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11550)
* Add DH keygen to providersShane Lontis2020-04-168-48/+395
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11332)
* Add DSA keygen to providerShane Lontis2020-04-159-44/+690
| | | | | | | | | Moved some shared FFC code into the FFC files. Added extra paramgen parameters for seed, gindex. Fixed bug in ossl_prov util to print bignums. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11303)
* Fix EVP_DigestSign interface when used with DES CMACPatrick Steuer2020-04-111-0/+5
| | | | | | | | | | DES implementations were missing the dup/copy ctx routines required by CMAC implementation. A regression test is added. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11498)
* Fix krb5 external testBenjamin Kaduk2020-04-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | Since commit c3845ceba84aab9ddeb43f043549238fd10de63b ("Build file templates: don't set OPENSSL_{ENGINES,MODULES}") the krb5 external test has been failing. This is because it relied on OPENSSL_MODULES already being set -- even though it did assign to OPENSSL_MODULES itself (and thus got skipped by the cleanup pass in that commit), it was doing so only to canonicalize the existing value to an absolute path, not as a de novo assignment. Catch up to the rest of the tree and just set it directly as the "providers" path from the build top (but still canonicalized to an absolute path). [extended tests] Fixes: 11492 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11499)
* Add a null provider which implements no algorithms.Pauli2020-04-091-1/+16
| | | | | | | | | By loading the null provider into the default context, it is possible to verify that it is not accidentally being used. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11488)
* Move legacy ciphers into the legacy providerShane Lontis2020-04-093-11/+20
| | | | | | | | | | | DES, idea, seed, rc2, rc4, rc5, cast and blowfish have been moved out of the default provider. Code shared between desx and tdes has been moved into a seperate file (cipher_tdes_common.c). 3 test recipes failed due to using app/openssl calls that used legacy ciphers. These calls have been updated to supply both the default and legacy providers. Fixed openssl app '-provider' memory leak Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11419)
* Add test cases for the non CA certificate with pathlen:0Tomas Mraz2020-04-063-2/+25
| | | | | | | | Accept verification without -x509_strict and reject it with it. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11463)
* Add a WPACKET test for the new DER capabilityMatt Caswell2020-04-041-0/+67
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11462)
* Add data driven SELF TEST code for signatures and key agreementShane Lontis2020-04-031-1/+19
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11036)
* HTTP client: make server/proxy and port params more consistent; minor other ↵Dr. David von Oheimb2020-04-022-7/+10
| | | | | | | | improvements Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
* Chunk 10 of CMP contribution to OpenSSL: CMP http client and related testsDr. David von Oheimb2020-04-023-21/+21
| | | | | | | | | | | | | Also improve the generic HTTP client w.r.t. proxy and no_proxy options. Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712). Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI. Adds extensive documentation and tests. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
* TLS Cipher Suite 0xC102 SupportNikolay Morozov2020-04-022-3/+11
| | | | | | | | | | | | | For GOST2012-GOST8912-GOST8912 was used 0xFF85 identifier, but new identifier 0xc102 was assigned. Because of old software we will support both numbers. https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-2 https://datatracker.ietf.org/doc/draft-smyshlyaev-tls12-gost-suites/ Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11403)
* Extend the sslprovider_test to be able to additionally test FIPSMatt Caswell2020-04-012-21/+83
| | | | | | | | Previously we could test an empty default ctx, with the default provider loaded into another ctx. Now we do the same with the FIPS provider. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11401)
* Make sure we always use the correct libctx in sslprovidertest.cMatt Caswell2020-04-011-21/+12
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11401)
* [test] Make sm2_internal_test less fragile to changes in the ec moduleBilly Brumley2020-04-011-10/+9
| | | | | | | | | Since these are KATs, the trailing randomness consumed by the ec module does not really matter. So make the fake random buffer circular. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11435)
* Add EVP_PKEY_gettable_params support for accessing EVP_PKEY key data fieldsShane Lontis2020-04-012-45/+164
| | | | | | | | | | | | | | | | | | | Currently only RSA, EC and ECX are supported (DH and DSA need to be added to the keygen PR's seperately because the fields supported have changed significantly). The API's require the keys to be provider based. Made the keymanagement export and get_params functions share the same code by supplying support functions that work for both a OSSL_PARAM_BLD as well as a OSSL_PARAM[]. This approach means that complex code is not required to build an empty OSSL_PARAM[] with the correct sized fields before then doing a second pass to populate the array. The RSA factor arrays have been changed to use unique key names to simplify the interface needed by the user. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11365)
* Add test for providers exposing OSSL_FUNC_PROVIDER_GET_REASON_STRINGSNicola Tuveri2020-03-301-0/+13
| | | | | | | | | This test currently fails, next commit has the description of the bug and the fix. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11427)
* Describe the "want" parameter in int create_bare_ssl_connection()Matt Caswell2020-03-301-1/+4
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11406)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 10:31:59 +0000