aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* x509name: fix OpenSSL::X509::Name#{cmp,<=>}ky/x509name-cmp-bugfixKazuki Yamaguchi2018-10-171-4/+10
| | | | | | | | | Fix wrong use of X509_NAME_cmp() return value. OpenSSL::X509::Name#<=> could return 0 when the two objects aren't identical. Reported by Tyler Eckstein. CVE-2018-16395. Reference: https://hackerone.com/reports/387250
* test/test_ssl_session: set client protocol version explicitlyky/openssl-1.1.1Kazuki Yamaguchi2018-05-111-5/+9
| | | | | | | Clients that implement TLS 1.3's Middlebox Compatibility Mode will always provide a non-empty session ID in the ClientHello. This means the "get" callback for the server-side session caching may be called for the initial connection.
* test/test_pkey_rsa: fix test failure with OpenSSL 1.1.1Kazuki Yamaguchi2018-05-111-1/+8
| | | | OpenSSL 1.1.1 raised the minimum size for RSA keys to 512 bits.
* cipher: validate iterations argument for Cipher#pkcs5_keyivgenky/cipher-pkcs5-keyivgen-validate-iterKazuki Yamaguchi2018-01-121-0/+3
| | | | | | | EVP_BytesToKey() internally converts the iteration count given as an "int" into an "unsigned int". Calling that with a negative integer will result in a hang. This is surprising, so let's validate the value by ourselves and raise ArgumentError as necessary.
* test/utils: disable Thread's report_on_exception in start_serverKazuki Yamaguchi2017-12-151-0/+12
| | | | | | | | | Those threads can purposefully raise exceptions when they call 'pend'. The report_on_exception feature can be safely disabled in this case since we use assert_join_threads that captures all exceptions raised. This is necessary to suppress warnings on Ruby 2.5, which enables the report_on_exception feature by default.
* test/test_cipher: fix test_non_aead_cipher_set_auth_data failureky/cipher-non-aead-auth-dataKazuki Yamaguchi2017-10-191-1/+1
| | | | | | A follow-up to commit bb10767b0570 ("cipher: disallow setting AAD for non-AEAD ciphers", 2017-10-18). Cipher#auth_data= raises NotImplementedError if built with OpenSSL < 1.0.1.
* cipher: disallow setting AAD for non-AEAD ciphersKazuki Yamaguchi2017-10-181-0/+7
| | | | | | | | | EVP_CipherUpdate() must not be call with the output parameter set to NULL when the cipher does not support AEAD. Check the flag of EVP_CIPHER, and raise an exception as necessary. Reference: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/83337 Reference: https://bugs.ruby-lang.org/issues/14024
* test/test_ssl_session: skip tests for session_remove_cbky/skip-session-remove-cb-testsKazuki Yamaguchi2017-10-101-18/+40
| | | | | | | | | | | | | | | | | In OpenSSL < 1.1.0, the session_remove_cb callback is called inside the global lock for CRYPTO_LOCK_SSL_CTX which is shared across the entire process, not just for the specific SSL_CTX object. It is possible that the callback releases GVL while the lock for CRYPTO_LOCK_SSL_CTX is held, causing another thread calling an OpenSSL function that tries to acquire the same lock stuck forever. Add a note about the possible deadlock to the docs for SSLContext#session_remove_cb=, and skip the relevant test cases unless the OSSL_TEST_ALL environment variable is set to 1. A deadlock due to this issue is observed: http://ci.rvm.jp/results/trunk-test@frontier/104428
* Merge pull request #153 from rhenium/ky/ssl-read-fix-leak-uninitializedKazuki Yamaguchi2017-09-241-2/+26
|\ | | | | ssl: prevent SSLSocket#sysread* from leaking uninitialized data
| * ssl: prevent SSLSocket#sysread* from leaking uninitialized dataky/ssl-read-fix-leak-uninitializedKazuki Yamaguchi2017-09-231-0/+24
| | | | | | | | | | | | Set the length of the buffer string to 0 first, and adjust to the size successfully read by the SSL_read() call later. This is needed because the buffer string may be provided by the caller.
| * test/test_pair: replace sleep with IO.selectKazuki Yamaguchi2017-09-231-2/+2
| | | | | | | | | | The sleep was to ensure that the SSLSocket#read_nonblock will get close_notify alert. A simple IO.select will suffice.
* | test/test_engine: check if RC4 is supportedKazuki Yamaguchi2017-09-241-1/+7
| | | | | | | | | | | | | | Skip test_openssl_engine_cipher_rc4 which will fail without RC4 support. It may be disabled by 'no-rc4' configure option of the OpenSSL library. Reference: https://github.com/ruby/openssl/issues/154
* | test/test_engine: suppress stderrKazuki Yamaguchi2017-09-241-20/+10
|/ | | | | | | Use ignore_stderr option of assert_separately instead of $stderr.reopen which may not work if the OpenSSL library uses a different stdio. Reference: https://github.com/ruby/openssl/issues/154
* test/test_ssl: do not run NPN tests for LibreSSL >= 2.6.1Kazuki Yamaguchi2017-09-091-0/+5
| | | | | | Similar to the previous one, LibreSSL 2.6.1 has relevant functions such as SSL_CTX_set_next_proto_select_cb(), but they are broken and do nothing.
* test/test_ssl: skip tmp_ecdh_callback test for LibreSSL >= 2.6.1Kazuki Yamaguchi2017-09-091-0/+2
| | | | | LibreSSL 2.6.1 has SSL_CTX_set_tmp_ecdh_callback() function, but it does not work.
* test/test_pair: disable compressionKazuki Yamaguchi2017-09-081-0/+1
| | | | | | | The test cases added by commit 8ed81ff4b0a8 ("test/test_pair: fix test_write_nonblock{,_no_exceptions}", 2017-09-04) can consume much memory and time if the OpenSSL supports SSL/TLS compression. Disable it explicitly.
* test/test_ssl: suppress warning in test_alpn_protocol_selection_cancelKazuki Yamaguchi2017-09-081-0/+1
| | | | Suppress "using default DH parameters" message.
* ruby.h: unnormalized Fixnum valuenobu2017-09-081-0/+1
| | | | | | | | | | * include/ruby/ruby.h (ST2FIX): fix unnormalized Fixnum value bug on mingw/mswin. [ruby-core:82687] [Bug #13877] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59765 b2dd03c8-39d4-4d8f-98ff-823fe69b080e [ky: add ST2FIX() definition to ext/openssl/ruby_missing.h, and adapt the test case to the 2.0 branch.] Sync-with-trunk: r59765
* test/test_pair: fix test_write_nonblock{,_no_exceptions}ky/fix-test-pair-write-nonblockKazuki Yamaguchi2017-09-041-30/+28
| | | | | | | | | When the previous SSLSocket#write_nonblock call does not finish writing the complete contents, SSL_shutdown() which is called through SSLSocket#close will not send a close_notify alert. As of commit e3a305063675 ssl_pair no longer uses the sync_close feature. Do not expect that SSL_read() would get ECONNRESET.
* test/test_ssl: explicitly accept TLS 1.1 in corresponding testAntonio Terceiro2017-08-261-1/+2
| | | | | | OpenSSL in Debian sid has recently disabled TLS < 1.2 by default, so in order to test that TLS 1.1 works, we need to explicitly make our test client accept it.
* test/test_pair, test/test_ssl: fix for TLS 1.3ky/maint-fix-test-with-tls13Kazuki Yamaguchi2017-08-242-176/+135
| | | | Fix test cases failing with TLS 1.3-enabled OpenSSL master.
* test/test_ssl_session: rearrange testsKazuki Yamaguchi2017-08-241-201/+196
| | | | | Use TLS 1.2 explicitly where needed, since TLS 1.3 will remove session ID based session resumption.
* test/test_ssl: move test_multibyte_read_write to test_pairKazuki Yamaguchi2017-08-242-24/+21
|
* test/test_ssl: remove test_invalid_shutdown_by_gcKazuki Yamaguchi2017-08-241-14/+0
| | | | | | | | | The very patch that added this test case made the dfree function not send close_notify alert when an SSLSocket is being GCed. Anyway, the new OSSL_GC_STRESS option added by 6ee4b285036e ("test: run test cases under GC.stress if OSSL_GC_STRESS is specified", 2016-12-04) will cover this kind of issues.
* test/utils: do not use DSA certificates in SSL testsKazuki Yamaguchi2017-08-241-1/+1
| | | | | | LibreSSL 2.6.1 removed DSA support from its SSL code. Also, TLS 1.3 will not support DSA certificates. Use an RSA certificate as the client certificate in the tests, too.
* test/utils: add OpenSSL::TestUtils.openssl? and .libressl?Kazuki Yamaguchi2017-08-248-59/+49
| | | | | | Add methods that check whether the running OpenSSL is an OpenSSL or a LibreSSL, and optionally check whether the version is newer or equal to the given version number.
* test/utils: improve error handling in start_serverKazuki Yamaguchi2017-08-241-37/+39
| | | | | | start_server can hang if the given block exits before closing sockets that the block opens. While this is a carelessness of the caller, we can do a better job.
* test/utils: let server_loop close socketKazuki Yamaguchi2017-08-242-24/+15
| | | | | Close the socket by server_loop rather than by server_proc. This reduces code duplication.
* test/utils: do not set ecdh_curves in start_serverKazuki Yamaguchi2017-08-242-27/+47
| | | | | | | | | An assumption in OpenSSL::TestSSL#test_get_ephemeral_key is that the ephemeral key type is always EVP_PKEY_EC when negotiated with an ECDHE cipher suite. This is not true if X25519 is chosen. The test is passing because we happen to fix the group to P-256 in start_server, but let's make it explicit.
* test/utils: have start_server yield only the port numberKazuki Yamaguchi2017-08-243-54/+54
| | | | | | | The block passed to start_server is invoked with two arguments, the running thread object for the server and the automatically-selected port number. The first argument is completely useless and actually is not used anywhere.
* test/utils: add SSLTestCase#tls12_supported?Kazuki Yamaguchi2017-08-241-0/+4
| | | | | Add a method that returns whether the OpenSSL supports TLS 1.2 or not. This will be useful for test cases that are specific to TLS ~1.2.
* test/utils: remove OpenSSL::TestUtils.silentKazuki Yamaguchi2017-08-243-14/+5
| | | | | Use EnvUtil.suppress_warning instead. We have started to use it already, and the name 'suppress_warning' expresses what it does more clearly.
* test: fix formattingKazuki Yamaguchi2017-08-2412-164/+185
| | | | | | Fix wrong nesting in test/utils.rb. Remove unnecessary requires. Wrap the code with 'if defined?(OpenSSL::TestUtils) ~ end' and avoid class definition with modifier if.
* Backport "Merge branch 'topic/test-memory-leak'" to maintKazuki Yamaguchi2017-08-2423-296/+283
| | | | | | | | | | | | | | * topic/test-memory-leak: Enable OSSL_MDEBUG on CI builds Add OpenSSL.print_mem_leaks test: prepare test PKey instances on demand test: let OpenSSL::TestCase include OpenSSL::TestUtils Don't define main() when built with --enable-debug (cherry picked from commit 5c586acc387834ab4e09260937dc21064fc59de4) Note that fix for new test cases that use the old constants removed by this is squashed in.
* ssl: remove unsupported TLS versions from SSLContext::METHODSKazuki Yamaguchi2017-08-082-6/+4
| | | | | | | | | | | | | | | Check for all version-specific SSL methods. We do check for existence of TLSv1_1_method() and TLSv1_2_method(), but not for TLSv1_method(). This fixes compile error when OpenSSL is configured with no-tls1-method. Also check the OPENSSL_NO_TLS{1,1_1,1_2} macros for whether OpenSSL supports the corresponding versions or not. This prevents :TLSv1 from being in SSLContext::METHODS when OpenSSL is compiled with no-tls1. In particular, Debian sid has disabled TLS 1.0/1.1 support recently. The changes in ext/openssl are partial backport of 4eb4b3297a92 ("Remove support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30).
* ossl_pem_passwd_cb: handle nil from the block explicitlyky/pem-passwd-cb-get-rid-of-minlenKazuki Yamaguchi2017-07-221-0/+3
| | | | | | | | | | | There is code that returns nil in the passphrase block on purpose (to prevent OpenSSL from prompting on stdin): OpenSSL::PKey.read(File.read("file.pem")) { nil } This is working just by chance because the TypeError from StringValue() is silently ignored. Let's short circuit in that case and save raising a needless exception, as this pattern has become too common.
* ossl_pem_passwd_cb: relax passphrase length constraintKazuki Yamaguchi2017-07-221-0/+8
| | | | | | The minimum passphrase length of 4 bytes is only a limitation of PEM_def_callback() which isn't relevant here. Commit f38501249f33 introduced this bug.
* bio: do not use the FILE BIO method in ossl_obj2bio()Kazuki Yamaguchi2017-07-111-0/+9
| | | | | | | | | | | | | | | Read everything from an IO object into a String first and use the memory buffer BIO method just as we do for String inputs. For MSVC builds, the FILE BIO method uses the "UPLINK" interface that requires the application to provide OPENSSL_Applink() function. For us, the "application" means ruby.exe, in which we can't do anything. As a workaround, avoid using the FILE BIO method at all. Usually private keys or X.509 certificates aren't that large and the temporarily increased memory usage hopefully won't be an issue. Fixes: https://github.com/ruby/openssl/issues/128
* test/test_ssl: allow 3DES cipher suites in test_sslctx_set_paramsKazuki Yamaguchi2017-06-271-1/+1
| | | | | | Fedora's OpenSSL seems to enable 3DES cipher suites by DEFAULT. Fixes: https://github.com/ruby/openssl/issues/127
* x509store: clear error queue after calling X509_LOOKUP_load_file()Kazuki Yamaguchi2017-06-141-0/+23
| | | | | | | | | | | X509_LOOKUP_load_file(), which ends up calling X509_load_cert_crl_file() internally, may leave error entries in the queue even when it returns non-zero value (which indicates success). This will be fixed by OpenSSL 1.1.1, but can be worked around by clearing the error queue ourselves. Fixes: https://bugs.ruby-lang.org/issues/11033
* Merge branch 'topic/test-ssl-fix-typo' into maintKazuki Yamaguchi2017-05-041-1/+1
|\ | | | | | | | | * topic/test-ssl-fix-typo: test/test_ssl: fix typo in test_sysread_and_syswrite
| * test/test_ssl: fix typo in test_sysread_and_syswritetopic/test-ssl-fix-typoKazuki Yamaguchi2017-03-231-1/+1
| | | | | | | | | | The test case for second argument of OpenSSL::SSL::SSLSocket#sysread is not testing the behavior correctly because of a typo.
* | test/test_x509store: skip OpenSSL::TestX509Store#test_set_errorsKazuki Yamaguchi2017-04-281-0/+1
|/ | | | | | | X509_STORE_add_{cert,crl}() will no longer fail with 'cert already in hash table' if they are called twice, since the (unreleased) next version of OpenSSL. Don't test that if we are built with OpenSSL >= 1.1.0.
* Fix typosSHIBATA Hiroshi2017-02-141-1/+1
|
* test/test_pkey_ec: do not use dummy 0 orderKazuki Yamaguchi2017-02-031-1/+1
| | | | | | | Ubuntu trusty's OpenSSL package 1.0.1f-1ubuntu2.22 has backported an OpenSSL commit f54be179aa4c that makes EC_GROUP_set_generator() call BN_MONT_CTX_set() which can segfault if an invalid value (== 0) is given. Avoid it.
* x509: fix OpenSSL::X509::Name#eql?Kazuki Yamaguchi2017-01-281-0/+10
| | | | | | | | Commit 34e7fe34ee32 ("Use rb_obj_class() instead of CLASS_OF()", 2016-09-08) incorrectly inverted the result. Fix it, and add a test case for this. Fixes: 34e7fe34ee32 ("Use rb_obj_class() instead of CLASS_OF()")
* test/envutil: fix assert_raise_with_messageKazuki Yamaguchi2017-01-241-0/+5
| | | | Import mu_pp method from Ruby trunk.
* Fix for ASN1::Constructive 'each' implementationCorey Bonnell2016-12-291-0/+7
|
* Merge pull request #88 from yogo1212/generalizedtime_formatKazuki Yamaguchi2016-12-101-0/+8
|\ | | | | asn1: handle GENERALIZEDTIME without seconds
| * asn1: handle GENERALIZEDTIME without secondsLeon M. George2016-12-091-0/+8
| |
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-01 23:12:36 +0000