aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* Use the test-unit-ruby-core gem for Test::Unit::CoreAssertionsky/test-use-test-unit-ruby-coreKazuki Yamaguchi2023-08-294-1204/+1
| | | | | test/lib/core_assertions.rb and its dependencies are now packaged in the gem test-unit-ruby-core. Let's use it instead.
* Remove the pending logics by the pend_on_openssl_issue_21493.Jun Aruga2023-08-252-22/+0
| | | | Because we will add a workaround to avoid this issue.
* Merge pull request #640 from ↵Kazuki Yamaguchi2023-08-161-1/+3
|\ | | | | | | | | rhenium/ky/ssl-connect-verify-error-ssl-error-syscall ssl: adjust "certificate verify failed" error on SSL_ERROR_SYSCALL
| * Revert "Relax error message check for OpenSSL 3.1"ky/ssl-connect-verify-error-ssl-error-syscallKazuki Yamaguchi2023-06-071-1/+3
| | | | | | | | | | | | | | | | This reverts commit fc4629d246f2bc92c8c3e9b4352841ae0e95eecc. The test case "test_connect_certificate_verify_failed_exception_message" does want to check the reason behind a certificate verification failure to be included in the exception message.
* | Merge pull request #659 from rhenium/ky/ssl-ca-file-ca-path-raiseKazuki Yamaguchi2023-08-161-0/+34
|\ \ | | | | | | ssl: raise SSLError if loading ca_file or ca_path fails
| * | ssl: raise SSLError if loading ca_file or ca_path failsky/ssl-ca-file-ca-path-raiseKazuki Yamaguchi2023-08-111-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When compiled with OpenSSL <= 1.1.1, OpenSSL::SSL::SSLContext#setup does not raise an exception on an error return from SSL_CTX_load_verify_locations(), but instead only prints a verbose-mode warning. This is not helpful since it very likely indicates an actual error, such as the specified file not being readable. Also, OpenSSL's error queue is not correctly cleared: $ ruby -w -ropenssl -e'OpenSSL.debug=true; ctx=OpenSSL::SSL::SSLContext.new; ctx.ca_file="bad-path"; ctx.setup; pp OpenSSL.errors' -e:1: warning: can't set verify locations ["error:02001002:system library:fopen:No such file or directory", "error:2006D080:BIO routines:BIO_new_file:no such file", "error:0B084002:x509 certificate routines:X509_load_cert_crl_file: system lib"] The behavior is currently different when compiled with OpenSSL >= 3.0: SSLError is raised if SSL_CTX_load_verify_file() or SSL_CTX_load_verify_dir() fails. This inconsistency was unintentionally introduced by commit 5375a55ffc35 ("ssl: use SSL_CTX_load_verify_{file,dir}() if available", 2020-02-22). However, raising SSLError seems more appropriate in this situation. Let's adjust the OpenSSL <= 1.1.1 code so that it behaves the same way as the OpenSSL >= 3.0 code currently does. Fixes: https://github.com/ruby/openssl/issues/649
* | | Merge pull request #648 from rhenium/ky/error-additional-dataKazuki Yamaguchi2023-08-162-8/+16
|\ \ \ | | | | | | | | Include "additional data" message in OpenSSL errors
| * | | Include "additional data" message in OpenSSL errorsky/error-additional-dataKazuki Yamaguchi2023-08-111-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Error entries in the OpenSSL error queue may contain additional contextual information associated with the error, which can be helpful when debugging. This "additional data" is currently only printed to stderr when OpenSSL.debug is enabled. Let's include this in the exception messages raised with ossl_raise(), too. $ ruby -Ilib -ropenssl -e'OpenSSL.debug=true; OpenSSL::SSL::SSLContext.new.ecdh_curves="P-256:not-a-curve"' -e:1: warning: error on stack: error:0A080106:SSL routines:gid_cb:passed invalid argument (group 'not-a-curve' cannot be set) -e:1:in `ecdh_curves=': passed invalid argument (group 'not-a-curve' cannot be set) (OpenSSL::SSL::SSLError) from -e:1:in `<main>'
| * | | config: relax test assertions against error messagesKazuki Yamaguchi2023-08-111-8/+4
| |/ / | | | | | | | | | | | | | | | Test that the error message contains the necessary text instead of the exact match. Exceptions raised by ossl_raise() may carry additional context information in the message.
* | | Merge pull request #664 from junaruga/wip/fips-test-pkey-fix-pending-testsKazuki Yamaguchi2023-08-162-5/+26
|\ \ \ | | | | | | | | test/openssl/test_pkey.rb: Fix pending tests in FIPS case.
| * | | test/openssl/test_pkey.rb: Fix pending tests in FIPS case.Jun Aruga2023-08-152-5/+26
| |/ /
* / / Use openssl? instead of OpenSSL::OPENSSL_VERSION_NUMBER.Jun Aruga2023-08-153-4/+5
|/ / | | | | | | | | | | | | | | | | | | | | | | Update the `openssl?` method by adding status argument. Note the format is below. * OpenSSL 3: 0xMNN00PP0 (major minor 00 patch 0) * OpenSSL 1: 0xMNNFFPPS (major minor fix patch status) See <https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_VERSION_NUMBER.html> for details.
* | Add support for raw private/public keys (#646)Ryo Kajiwara2023-07-121-0/+39
| | | | | | | | | | | | | | | | | | | | | | Add OpenSSL::PKey.new_raw_private_key, #raw_private_key and public equivalents. These methods are useful for importing and exporting keys that support "raw private/public key". Currently, OpenSSL implements X25519/X448 and Ed25519/Ed448 keys. [rhe: rewrote commit message] Co-authored-by: Bart de Water <bartdewater@gmail.com>
* | add OpenSSL Provider supportqwyng2023-06-171-0/+67
|/
* Fix modular square root test with LibreSSL >= 3.8Theo Buehler2023-06-051-1/+3
| | | | | | | | | | | | | | If x is a modular square root of a (mod p) then so is (p - x). Both answers are valid. In particular, both 2 and 3 are valid square roots of 4 (mod 5). Do not assume that a particular square root is chosen by the algorithm. Indeed, the algorithm in OpenSSL and LibreSSL <= 3.7 returns a non-deterministic answer in many cases. LibreSSL 3.8 and later will always return the smaller of the two possible answers. This breaks the current test case. Instead of checking for a particular square root, check that the square of the claimed square root is the given value. This is always true. Add the simplest test case where the answer is indeed non-deterministic.
* CI: Add the test/openssl/test_pkey.rb on the FIPS mode case.Jun Aruga2023-06-011-0/+7
| | | | | | | | | | | It's to test the `OpenSSL::PKey.read` in the `test/openssl/test_pkey.rb`. I added the pending status to the following tests failing on the FIPS mode case in the `test/openssl/test_pkey.rb`. * `test_ed25519` * `test_x25519` * `test_compare?`
* Drop a common logic disabling the FIPS mode in the tests.Jun Aruga2023-06-011-5/+0
| | | | We want to run the unit tests in the FIPS mode too.
* Revert "Skip OpenSSL::TestHMAC#test_dup when running with RHEL9"Hiroshi SHIBATA2023-05-191-3/+0
| | | | This reverts commit 9493d4a3bb26d1bfa7f30c2786fc6dd4451753fd.
* Implement FIPS functions on OpenSSL 3.Jun Aruga2023-05-151-4/+28
| | | | | | | | | | | | | | | | | | | | | | | | | This commit is to implement the `OpenSSL::OPENSSL_FIPS`, `ossl_fips_mode_get` and `ossl_fips_mode_set` to pass the test `test/openssl/test_fips.rb`. It seems that the `OPENSSL_FIPS` macro is not used on the FIPS mode case any more, and some FIPS related APIs also were removed in OpenSSL 3. See the document <https://github.com/openssl/openssl/blob/master/doc/man7/migration_guide.pod#removed-fips_mode-and-fips_mode_set> the section OPENSSL 3.0 > Main Changes from OpenSSL 1.1.1 > Other notable deprecations and changes - Removed FIPS_mode() and FIPS_mode_set() . The `OpenSSL::OPENSSL_FIPS` returns always true in OpenSSL 3 because the used functions `EVP_default_properties_enable_fips` and `EVP_default_properties_is_fips_enabled` works with the OpenSSL installed without FIPS option. The `TEST_RUBY_OPENSSL_FIPS_ENABLED` is set on the FIPS mode case on the CI. Because I want to test that the `OpenSSL.fips_mode` returns the `true` or 'false' surely in the CI. You can test the FIPS mode case by setting `TEST_RUBY_OPENSSL_FIPS_ENABLED` on local too. Right now I don't find a better way to get the status of the FIPS mode enabled or disabled for this purpose. I am afraid of the possibility that the FIPS test case is unintentionally skipped. I also replaced the ambiguous "returns" with "should return" in the tests.
* CI: Add OpenSSL FIPS mode case.Jun Aruga2023-05-151-0/+19
| | | | | | | | | | | | | | | | | test/openssl/fixtures/ssl/openssl_fips.cnf.tmpl: I referred to the following document for the openssl config file for FIPS mode. <https://www.openssl.org/docs/manmaster/man7/fips_module.html> - Making all applications use the FIPS module by default It seems that the `.include` syntax only requires the absolute path. So, the placeholder OPENSSL_DIR in the template file is replaced with the actual OpenSSL directory. .github/workflows/test.yml: The `TEST_RUBY_OPENSSL_FIPS_ENABLED` environment variable is set in the FIPS mode CI case. It can be used in the unit tests.
* Update test libraries from ↵Hiroshi SHIBATA2023-03-241-6/+44
| | | | https://github.com/ruby/ruby/commit/b4e438d8aabaf4bba2b27f374c787543fae07c58
* Relax error message check for OpenSSL 3.1Nobuyoshi Nakada2023-03-161-3/+1
| | | | | | | | A tentative measures fo https://github.com/ruby/openssl/issues/606. With OpenSSL 3.1.0, the error message at connection using "self-signed certificate" seems to return `SSL_R_TLSV1_ALERT_UNKNOWN_CA` instead of `SSL_R_CERTIFICATE_VERIFY_FAILED`.
* Skip OpenSSL::TestHMAC#test_dup when running with RHEL9Hiroshi SHIBATA2023-01-311-0/+3
|
* Merge pull request #593 from ruby/update-envutilKazuki Yamaguchi2023-01-055-288/+1167
|\ | | | | Update the latest version of EnvUtil
| * Stop AutoRunner with test-unitHiroshi SHIBATA2023-01-041-0/+1
| |
| * Added CoreAssertionsHiroshi SHIBATA2023-01-043-1/+786
| |
| * Import the latest version of envutil.rbHiroshi SHIBATA2023-01-042-287/+380
| |
* | Do not require test file in a forked process in testsAndrew Konchin2023-01-042-23/+15
|/
* Merge branch 'maint-3.0'Kazuki Yamaguchi2022-12-241-5/+5
|\ | | | | | | | | * maint-3.0: test/openssl/test_pkey.rb: allow failures in test_s_generate_parameters
| * test/openssl/test_pkey.rb: allow failures in test_s_generate_parametersky/pkcs7-certs-emptyKazuki Yamaguchi2022-12-241-5/+5
| | | | | | | | | | | | | | Commit f2e2a5e5ed8e ("test/openssl/test_pkey.rb: allow failures in test_s_generate_parameters", 2022-12-23) was completely bogus. The problem in OpenSSL 3.0.0-3.0.5 is that errors from the callback are sometimes silently suppressed.
* | Merge branch 'maint-3.0'Kazuki Yamaguchi2022-12-234-0/+23
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.0: Ruby/OpenSSL 3.0.2 Fix build with LibreSSL 3.5 Fix operator precedence in OSSL_OPENSSL_PREREQ and OSSL_LIBRESSL_PREREQ Ruby/OpenSSL 2.2.3 ts: use TS_VERIFY_CTX_set_certs instead of TS_VERIFY_CTS_set_certs ocsp: disable OCSP_basic_verify() workaround on LibreSSL 3.5 test/openssl/test_pkey.rb: allow failures in test_s_generate_parameters pkey/ec: check private key validity with OpenSSL 3 Actions - update workflow to use OpenSSL 1.1.1, actions/checkout@v3 pkey/ec: fix ossl_raise() calls using cEC_POINT instead of eEC_POINT raise when EC_POINT_cmp or EC_GROUP_cmp error instead of returning true
| * Merge pull request #580 from rhenium/ky/pkey-ec-fix-checkKazuki Yamaguchi2022-12-233-0/+18
| |\ | | | | | | pkey/ec: check private key validity with OpenSSL 3
| | * pkey/ec: check private key validity with OpenSSL 3ky/pkey-ec-fix-checkJoe Truba2022-12-233-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The behavior of EVP_PKEY_public_check changed between OpenSSL 1.1.1 and 3.0 so that it no longer validates the private key. Instead, private keys can be validated through EVP_PKEY_private_check and EVP_PKEY_pairwise_check. [ky: simplified condition to use either EVP_PKEY_check() or EVP_PKEY_public_check().]
| * | test/openssl/test_pkey.rb: allow failures in test_s_generate_parametersKazuki Yamaguchi2022-12-231-0/+5
| |/ | | | | | | | | | | | | The root cause has been fixed by OpenSSL 3.0.6, but Ubuntu 22.04's OpenSSL package has not backported the patch yet. Reference: https://github.com/ruby/openssl/issues/492
* | Merge pull request #558 from kateinoigakukun/katei/fix-no-sock-supportKazuki Yamaguchi2022-12-233-3/+3
|\ \ | | | | | | Undefine `OpenSSL::SSL` for no socket platforms
| * | test/openssl/test_ssl.rb: do not run SSL tests if not availableKazuki Yamaguchi2022-12-233-3/+3
| | |
* | | ssl: disable NPN support on LibreSSLky/libressl-3.7.0Kazuki Yamaguchi2022-12-231-15/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As noted in commit a2ed156cc9f1 ("test/test_ssl: do not run NPN tests for LibreSSL >= 2.6.1", 2017-08-13), NPN is known not to work properly on LibreSSL. Disable NPN support on LibreSSL, whether OPENSSL_NO_NEXTPROTONEG is defined or not. NPN is less relevant today anyway. Let's also silence test suite when it's not available.
* | | test/openssl/test_asn1.rb: remove pend for unsupported LibreSSL versionsKazuki Yamaguchi2022-12-231-8/+3
| | | | | | | | | | | | | | | | | | | | | | | | Commit af895bc5596b ("asn1: avoid truncating OID in OpenSSL::ASN1::ObjectId#oid", 2016-12-15) added this test case. The OBJ_obj2txt() issue was fixed by LibreSSL 2.5.1 (released in 2017) and is no longer relevant today.
* | | test/openssl/test_asn1.rb: skip failing tests on LibreSSL 3.6.0Kazuki Yamaguchi2022-12-231-3/+6
|/ / | | | | | | | | | | | | | | | | | | | | LibreSSL 3.6.0 expects the seconds part in UTCTime and GeneralizedTime to be always present. LibreSSL 3.6.0 release note [1] says: > - The ASN.1 time parser has been refactored and rewritten using CBS. > It has been made stricter in that it now enforces the rules from > RFC 5280. [1] https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.0-relnotes.txt
* | Allow empty string to OpenSSL::Cipher#updateYusuke Nakamura2022-11-241-6/+0
| | | | | | | | | | | | For some reasons, plaintext may be empty string. ref https://www.rfc-editor.org/rfc/rfc9001.html#section-5.8
* | Use SHA256 instead of SHA1 where needed in tests.Jarek Prokop2022-10-188-40/+43
| | | | | | | | | | Systems such as RHEL 9 are moving away from SHA1 disabling it completely in default configuration.
* | add BN#mod_sqrtBen Toews2022-10-171-0/+6
| |
* | Merge pull request #536 from cdelafuente-r7/add_keylog_cbKazuki Yamaguchi2022-09-201-0/+48
|\ \ | | | | | | Add support to SSL_CTX_set_keylog_callback()
| * | Add support to SSL_CTX_set_keylog_callbackChristophe De La Fuente2022-09-201-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - This callback is invoked when TLS key material is generated or received, in order to allow applications to store this keying material for debugging purposes. - It is invoked with an `SSLSocket` and a string containing the key material in the format used by NSS for its SSLKEYLOGFILE debugging output. - This commit adds the Ruby binding `keylog_cb` and the related tests - It is only compatible with OpenSSL >= 1.1.1. Even if LibreSSL implements `SSL_CTX_set_keylog_callback()` from v3.4.2, it does nothing (see https://github.com/libressl-portable/openbsd/commit/648d39f0f035835d0653342d139883b9661e9cb6)
* | | Merge branch 'maint-3.0'Kazuki Yamaguchi2022-09-084-0/+57
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.0: Ruby/OpenSSL 3.0.1 Ruby/OpenSSL 2.2.2 Ruby/OpenSSL 2.1.4 Make GitHub Actions happy on 2.1/2.2 branches test/openssl/test_cipher: skip AES-CCM tests on OpenSSL <= 1.1.1b pkey/ec: check existence of public key component before exporting pkey: restore support for decoding "openssl ecparam -genkey" output pkey: clear error queue before each OSSL_DECODER_from_bio() call pkey/dsa: let PKey::DSA.generate choose appropriate q size hmac: use EVP_PKEY_new_raw_private_key() if available x509*: fix error queue leak in #extensions= and #attributes= methods Check if the option is an Hash in `pkey_ctx_apply_options0()`
| * | Merge pull request #541 from rhenium/ky/pkey-ec-export-segfault-regressionKazuki Yamaguchi2022-09-081-0/+2
| |\ \ | | | | | | | | pkey/ec: check existence of public key component before exporting
| | * | pkey/ec: check existence of public key component before exportingky/pkey-ec-export-segfault-regressionKazuki Yamaguchi2022-09-021-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | i2d_PUBKEY_bio() against an EC_KEY without the public key component trggers a null dereference. This is a regression introduced by commit 56f0d34d63fb ("pkey: refactor #export/#to_pem and #to_der", 2017-06-14). Fixes https://github.com/ruby/openssl/pull/527#issuecomment-1220504524 Fixes https://github.com/ruby/openssl/issues/369#issuecomment-1221554057
| * | | Merge pull request #540 from rhenium/ky/pkey-read-prefer-keysKazuki Yamaguchi2022-09-081-0/+23
| |\ \ \ | | | | | | | | | | pkey: restore support for decoding "openssl ecparam -genkey" output
| | * | | pkey: restore support for decoding "openssl ecparam -genkey" outputky/pkey-read-prefer-keysKazuki Yamaguchi2022-09-021-0/+23
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Scan through the input for a private key, then fallback to generic decoder. OpenSSL 3.0's OSSL_DECODER supports encoded key parameters. The PEM header "-----BEGIN EC PARAMETERS-----" is used by one of such encoding formats. While this is useful for OpenSSL::PKey::PKey, an edge case has been discovered. The openssl CLI command line "openssl ecparam -genkey" prints two PEM blocks in a row, one for EC parameters and another for the private key. Feeding the whole output into OSSL_DECODER results in only the first PEM block, the key parameters, being decoded. Previously, ruby/openssl did not support decoding key parameters and it would decode the private key PEM block instead. While the new behavior is technically correct, "openssl ecparam -genkey" is so widely used that ruby/openssl does not want to break existing applications. Fixes https://github.com/ruby/openssl/pull/535
| * | | Merge pull request #539 from rhenium/ky/pkey-dsa-generate-fix-qKazuki Yamaguchi2022-09-021-0/+19
| |\ \ \ | | | | | | | | | | pkey/dsa: let PKey::DSA.generate choose appropriate q size
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-31 03:35:44 +0000