aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | | | buffering: let #write accept multiple argumentsky/ssl-write-multiKazuki Yamaguchi2017-10-231-0/+9
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As of Ruby 2.5, IO#write accepts multiple input strings and writes them at once[1]. Follow that. [1] https://bugs.ruby-lang.org/issues/9323
* | | | | TLS Fallback Signaling Cipher Suite Valueaeris2017-11-031-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support for fallback SCSV [RFC 7507](https://tools.ietf.org/html/rfc7507). Expected behaviour is to refuse connection if the client signals a protocol with the fallback flag but the server supports a better one (downgrade attack detection).
* | | | | Merge pull request #161 from rhenium/ky/x509-implement-eqKazuki Yamaguchi2017-10-225-0/+102
|\ \ \ \ \ | | |/ / / | |/| | | x509*: implement ==
| * | | | x509req: implement X509::Request#==Kazuki Yamaguchi2017-10-121-0/+10
| | | | |
| * | | | x509crl, x509revoked: implement X509::{CRL,Revoked}#==Kazuki Yamaguchi2017-10-121-0/+27
| | | | |
| * | | | x509revoked: add missing X509::Revoked#to_derKazuki Yamaguchi2017-10-121-0/+23
| | | | |
| * | | | x509cert: implement X509::Certificate#==Kazuki Yamaguchi2017-10-121-0/+14
| | | | |
| * | | | x509attr: implement X509::Attribute#==Kazuki Yamaguchi2017-10-121-0/+17
| | | | |
| * | | | x509ext: implement X509::Extension#==Kazuki Yamaguchi2017-10-121-0/+11
| |/ / /
* | | | Merge branch 'ky/ssl-version-min-max'Kazuki Yamaguchi2017-10-221-0/+18
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | * ky/ssl-version-min-max: ssl: fix conflict of options in SSLContext#set_params Use caller with length to reduce unused strings
| * | | ssl: fix conflict of options in SSLContext#set_paramsky/ssl-version-min-maxKazuki Yamaguchi2017-10-221-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make SSLContext#set_params call #options= first. SSLContext#set_params by default disables SSL 2.0 and SSL 3.0 by calling SSLContext#min_version=. After that, it sets the SSL option flags by calling SSLContext#options=. This is problematic when built with OpenSSL before 1.1.0 because SSLContext#min_version= achieves its goal using the SSL_OP_NO_{SSL,TLS}* options. Since the subsequent SSLContext#options= call replaces the flags rather than OR together, this results in effectively disabling min_version setting in SSLContext::DEFAULT_PARAMS. The issue was first fixed in Ruby trunk tree, as part of r60310 ("fix OpenSSL::SSL::SSLContext#min_version doesn't work", 2017-10-21).
* | | | Merge branch 'maint'Kazuki Yamaguchi2017-09-244-49/+77
|\ \ \ \ | | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.0.6 test/test_engine: check if RC4 is supported test/test_engine: suppress stderr ossl.c: make legacy locking callbacks reentrant ossl.c: use struct CRYPTO_dynlock_value for non-dynamic locks ssl: prevent SSLSocket#sysread* from leaking uninitialized data test/test_pair: replace sleep with IO.select tool/ruby-openssl-docker: update test/test_ssl: do not run NPN tests for LibreSSL >= 2.6.1 test/test_ssl: skip tmp_ecdh_callback test for LibreSSL >= 2.6.1 test/test_pair: disable compression test/test_ssl: suppress warning in test_alpn_protocol_selection_cancel ruby.h: unnormalized Fixnum value test/test_pair: fix test_write_nonblock{,_no_exceptions}
| * | | Merge pull request #153 from rhenium/ky/ssl-read-fix-leak-uninitializedKazuki Yamaguchi2017-09-241-2/+26
| |\ \ \ | | | | | | | | | | ssl: prevent SSLSocket#sysread* from leaking uninitialized data
| | * | | ssl: prevent SSLSocket#sysread* from leaking uninitialized dataky/ssl-read-fix-leak-uninitializedKazuki Yamaguchi2017-09-231-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Set the length of the buffer string to 0 first, and adjust to the size successfully read by the SSL_read() call later. This is needed because the buffer string may be provided by the caller.
| | * | | test/test_pair: replace sleep with IO.selectKazuki Yamaguchi2017-09-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | The sleep was to ensure that the SSLSocket#read_nonblock will get close_notify alert. A simple IO.select will suffice.
| * | | | test/test_engine: check if RC4 is supportedKazuki Yamaguchi2017-09-241-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Skip test_openssl_engine_cipher_rc4 which will fail without RC4 support. It may be disabled by 'no-rc4' configure option of the OpenSSL library. Reference: https://github.com/ruby/openssl/issues/154
| * | | | test/test_engine: suppress stderrKazuki Yamaguchi2017-09-241-20/+10
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | Use ignore_stderr option of assert_separately instead of $stderr.reopen which may not work if the OpenSSL library uses a different stdio. Reference: https://github.com/ruby/openssl/issues/154
| * | | test/test_ssl: do not run NPN tests for LibreSSL >= 2.6.1Kazuki Yamaguchi2017-09-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | Similar to the previous one, LibreSSL 2.6.1 has relevant functions such as SSL_CTX_set_next_proto_select_cb(), but they are broken and do nothing.
| * | | test/test_ssl: skip tmp_ecdh_callback test for LibreSSL >= 2.6.1Kazuki Yamaguchi2017-09-091-0/+2
| | | | | | | | | | | | | | | | | | | | LibreSSL 2.6.1 has SSL_CTX_set_tmp_ecdh_callback() function, but it does not work.
| * | | test/test_pair: disable compressionKazuki Yamaguchi2017-09-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The test cases added by commit 8ed81ff4b0a8 ("test/test_pair: fix test_write_nonblock{,_no_exceptions}", 2017-09-04) can consume much memory and time if the OpenSSL supports SSL/TLS compression. Disable it explicitly.
| * | | test/test_ssl: suppress warning in test_alpn_protocol_selection_cancelKazuki Yamaguchi2017-09-081-0/+1
| | | | | | | | | | | | | | | | Suppress "using default DH parameters" message.
| * | | ruby.h: unnormalized Fixnum valuenobu2017-09-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * include/ruby/ruby.h (ST2FIX): fix unnormalized Fixnum value bug on mingw/mswin. [ruby-core:82687] [Bug #13877] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59765 b2dd03c8-39d4-4d8f-98ff-823fe69b080e [ky: add ST2FIX() definition to ext/openssl/ruby_missing.h, and adapt the test case to the 2.0 branch.] Sync-with-trunk: r59765
| * | | test/test_pair: fix test_write_nonblock{,_no_exceptions}ky/fix-test-pair-write-nonblockKazuki Yamaguchi2017-09-041-30/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the previous SSLSocket#write_nonblock call does not finish writing the complete contents, SSL_shutdown() which is called through SSLSocket#close will not send a close_notify alert. As of commit e3a305063675 ssl_pair no longer uses the sync_close feature. Do not expect that SSL_read() would get ECONNRESET.
* | | | test/test_asn1: fix possible failure in test_utctimeKazuki Yamaguchi2017-09-051-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL function ASN1_TIME_adj() internally uses gmtime() to convert time_t into struct tm. Not all platforms handle negative time_t value. Reference: https://github.com/ruby/ruby/commit/609103dbb5fb182eec12f052226c43e39b907682#commitcomment-24056418
* | | | test/test_fips: skip if setting FIPS mode failsKazuki Yamaguchi2017-09-041-6/+13
| | | |
* | | | Merge pull request #144 from rhenium/ky/x509name-fix-parse-opensslKazuki Yamaguchi2017-09-031-20/+15
|\ \ \ \ | | | | | | | | | | x509name: update regexp in OpenSSL::X509::Name.parse
| * | | | x509name: update regexp in OpenSSL::X509::Name.parseky/x509name-fix-parse-opensslKazuki Yamaguchi2017-09-031-20/+15
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | Allow the attribute value to contain ',', just as the openssl utility's parse_name() function does. Fixes: https://github.com/ruby/openssl/issues/39
* | | | Merge pull request #143 from rhenium/ky/x509name-to-utf-8Kazuki Yamaguchi2017-09-031-1/+38
|\ \ \ \ | |/ / / |/| | | Add X509::Name#to_utf8 and #inspect
| * | | x509name: add OpenSSL::X509::Name#to_utf8Kazuki Yamaguchi2017-09-031-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The existing #to_s does not interact well with distinguished names containing multi-byte UTF-8 characters since the OpenSSL function X509_NAME_print_ex() escapes bytes with MSB set by default. Unfortunately we can't fix it without breaking backwards compatibility. It takes options as a bit field that is directly passed to X509_NAME_print_ex(). Let's add a new method instead. Fixes: https://github.com/ruby/openssl/issues/26
| * | | test/test_x509name: change script encoding to ASCII-8BITKazuki Yamaguchi2017-09-031-1/+1
| | | | | | | | | | | | | | | | Allow string literals containing UTF-8 characters.
* | | | ssl: rework SSLContext#ssl_version=Kazuki Yamaguchi2017-09-031-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reimplement SSLContext#ssl_version= as a wrapper around SSLContext#min_version= and #max_version=. SSLContext#ssl_version= used to call SSL_CTX_set_ssl_version() which replaces the SSL method used for the connections created from the SSL context. This is mainly used for forcing a specific SSL/TLS protocol version. As of OpenSSL 1.1.0, however, use of the version-specific SSL methods such as TLSv1_method() is deprecated. Follow the current recommendation -- to use the generic SSL method always and to control the supported version range by SSL_CTX_set_{min,max}_proto_version(). Actually, we have already started doing a similar thing when the extension is compiled with OpenSSL 1.1.0. OpenSSL::SSL::SSLContext::METHODS, which contained the possible names of SSL methods, is not useful anymore. It is now deprecate_constant-ed.
* | | | ssl: add SSLContext#min_version= and #max_version=Kazuki Yamaguchi2017-09-032-77/+179
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add methods that set the minimum and maximum supported protocol versions for the SSL context. If the OpenSSL library supports, use SSL_CTX_set_{min,max}_proto_version() that do the exact thing. Otherwise, simulate by combining SSL_OP_NO_{SSL,TLS}v* flags. The new methods are meant to replace the deprecated #ssl_version= that cannot support multiple protocol versions. SSLContext::DEFAULT_PARAMS is also updated to use the new SSLContext#min_version=.
* | / Merge branch 'maint'Kazuki Yamaguchi2017-08-2631-669/+731
|\| | | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This also restores 'if defined?(OpenSSL)-end' wrapping the test code. They have been removed erroneously by commit 4eb4b3297a92 ("Remove support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30). * maint: test/test_ssl: explicitly accept TLS 1.1 in corresponding test ssl: remove useless call to rb_thread_wait_fd() test/test_pair, test/test_ssl: fix for TLS 1.3 test/test_ssl_session: rearrange tests test/test_ssl: move test_multibyte_read_write to test_pair test/test_ssl: remove test_invalid_shutdown_by_gc test/utils: do not use DSA certificates in SSL tests test/utils: add OpenSSL::TestUtils.openssl? and .libressl? test/utils: improve error handling in start_server test/utils: let server_loop close socket test/utils: do not set ecdh_curves in start_server test/utils: have start_server yield only the port number test/utils: add SSLTestCase#tls12_supported? test/utils: remove OpenSSL::TestUtils.silent test: fix formatting Rakefile: let sync:to_ruby know about test/openssl/fixtures cipher: update the documentation for Cipher#auth_tag= Backport "Merge branch 'topic/test-memory-leak'" to maint ssl: do not call session_remove_cb during GC
| * test/test_ssl: explicitly accept TLS 1.1 in corresponding testAntonio Terceiro2017-08-261-1/+2
| | | | | | | | | | | | OpenSSL in Debian sid has recently disabled TLS < 1.2 by default, so in order to test that TLS 1.1 works, we need to explicitly make our test client accept it.
| * test/test_pair, test/test_ssl: fix for TLS 1.3ky/maint-fix-test-with-tls13Kazuki Yamaguchi2017-08-242-176/+135
| | | | | | | | Fix test cases failing with TLS 1.3-enabled OpenSSL master.
| * test/test_ssl_session: rearrange testsKazuki Yamaguchi2017-08-241-201/+196
| | | | | | | | | | Use TLS 1.2 explicitly where needed, since TLS 1.3 will remove session ID based session resumption.
| * test/test_ssl: move test_multibyte_read_write to test_pairKazuki Yamaguchi2017-08-242-24/+21
| |
| * test/test_ssl: remove test_invalid_shutdown_by_gcKazuki Yamaguchi2017-08-241-14/+0
| | | | | | | | | | | | | | | | | | The very patch that added this test case made the dfree function not send close_notify alert when an SSLSocket is being GCed. Anyway, the new OSSL_GC_STRESS option added by 6ee4b285036e ("test: run test cases under GC.stress if OSSL_GC_STRESS is specified", 2016-12-04) will cover this kind of issues.
| * test/utils: do not use DSA certificates in SSL testsKazuki Yamaguchi2017-08-241-1/+1
| | | | | | | | | | | | LibreSSL 2.6.1 removed DSA support from its SSL code. Also, TLS 1.3 will not support DSA certificates. Use an RSA certificate as the client certificate in the tests, too.
| * test/utils: add OpenSSL::TestUtils.openssl? and .libressl?Kazuki Yamaguchi2017-08-248-59/+49
| | | | | | | | | | | | Add methods that check whether the running OpenSSL is an OpenSSL or a LibreSSL, and optionally check whether the version is newer or equal to the given version number.
| * test/utils: improve error handling in start_serverKazuki Yamaguchi2017-08-241-37/+39
| | | | | | | | | | | | start_server can hang if the given block exits before closing sockets that the block opens. While this is a carelessness of the caller, we can do a better job.
| * test/utils: let server_loop close socketKazuki Yamaguchi2017-08-242-24/+15
| | | | | | | | | | Close the socket by server_loop rather than by server_proc. This reduces code duplication.
| * test/utils: do not set ecdh_curves in start_serverKazuki Yamaguchi2017-08-242-27/+47
| | | | | | | | | | | | | | | | | | An assumption in OpenSSL::TestSSL#test_get_ephemeral_key is that the ephemeral key type is always EVP_PKEY_EC when negotiated with an ECDHE cipher suite. This is not true if X25519 is chosen. The test is passing because we happen to fix the group to P-256 in start_server, but let's make it explicit.
| * test/utils: have start_server yield only the port numberKazuki Yamaguchi2017-08-243-54/+54
| | | | | | | | | | | | | | The block passed to start_server is invoked with two arguments, the running thread object for the server and the automatically-selected port number. The first argument is completely useless and actually is not used anywhere.
| * test/utils: add SSLTestCase#tls12_supported?Kazuki Yamaguchi2017-08-241-0/+4
| | | | | | | | | | Add a method that returns whether the OpenSSL supports TLS 1.2 or not. This will be useful for test cases that are specific to TLS ~1.2.
| * test/utils: remove OpenSSL::TestUtils.silentKazuki Yamaguchi2017-08-243-14/+5
| | | | | | | | | | Use EnvUtil.suppress_warning instead. We have started to use it already, and the name 'suppress_warning' expresses what it does more clearly.
| * test: fix formattingKazuki Yamaguchi2017-08-2412-164/+185
| | | | | | | | | | | | Fix wrong nesting in test/utils.rb. Remove unnecessary requires. Wrap the code with 'if defined?(OpenSSL::TestUtils) ~ end' and avoid class definition with modifier if.
| * Backport "Merge branch 'topic/test-memory-leak'" to maintKazuki Yamaguchi2017-08-2423-296/+283
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * topic/test-memory-leak: Enable OSSL_MDEBUG on CI builds Add OpenSSL.print_mem_leaks test: prepare test PKey instances on demand test: let OpenSSL::TestCase include OpenSSL::TestUtils Don't define main() when built with --enable-debug (cherry picked from commit 5c586acc387834ab4e09260937dc21064fc59de4) Note that fix for new test cases that use the old constants removed by this is squashed in.
* | Merge branch 'maint'Kazuki Yamaguchi2017-08-084-7/+25
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.0.5 ssl: fix compile error with OpenSSL 1.0.0 ssl: remove unsupported TLS versions from SSLContext::METHODS Add msys2 library dependency tag in gem metadata ossl_pem_passwd_cb: handle nil from the block explicitly ossl_pem_passwd_cb: do not check for taintedness ossl_pem_passwd_cb: relax passphrase length constraint appveyor.yml: test against Ruby 2.4 Rakefile: install_dependencies: install only when needed bio: do not use the FILE BIO method in ossl_obj2bio() bio: prevent possible GC issue in ossl_obj2bio() test/test_ssl: allow 3DES cipher suites in test_sslctx_set_params
| * ssl: remove unsupported TLS versions from SSLContext::METHODSKazuki Yamaguchi2017-08-082-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check for all version-specific SSL methods. We do check for existence of TLSv1_1_method() and TLSv1_2_method(), but not for TLSv1_method(). This fixes compile error when OpenSSL is configured with no-tls1-method. Also check the OPENSSL_NO_TLS{1,1_1,1_2} macros for whether OpenSSL supports the corresponding versions or not. This prevents :TLSv1 from being in SSLContext::METHODS when OpenSSL is compiled with no-tls1. In particular, Debian sid has disabled TLS 1.0/1.1 support recently. The changes in ext/openssl are partial backport of 4eb4b3297a92 ("Remove support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30).
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-25 11:50:39 +0000