aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* Add certificate chain file test.Samuel Williams2019-06-136-0/+52
|
* Skip one assertion for OpenSSL::PKey::EC::Point#mul on LibreSSLJeremy Evans2019-06-061-2/+8
| | | | | LibreSSL 2.8.0+ does not support multiple elements in the first argument.
* test/test_ssl.rb: Use TLS1.2Yusuke Endoh2019-06-051-0/+5
| | | | | | The test fails when using OpenSSL 1.1 that supports TLS1.3. To make it pass, this change restricts max_version to TLS1.2. We may need more work for TLS1.3.
* test/test_ssl.rb: Use larger keysYusuke Endoh2019-06-051-1/+1
| | | | OpenSSL 1.1.1 seems to require at least 2048 bits for CA's private keys.
* Merge pull request #217 from rhenium/ky/test-fixtures-updateYusuke Endoh2019-06-058-50/+208
|\ | | | | test: use larger keys for SSL tests
| * test: use larger keys for SSL testsky/test-fixtures-updateKazuki Yamaguchi2018-08-168-21/+186
| | | | | | | | | | | | | | | | | | | | | | Some systems enforce a system-wide policy to restrict key sizes used in SSL/TLS. Use larger ones if possible so that the test suite runs successfully. New PEM files test/fixtures/pkey/{dh-1,rsa-1,rsa-2,rsa-3}.pem are added to the tree, and SSL tests now use them instead of the fixed-size keys. Reference: https://github.com/ruby/openssl/issues/215
| * test/test_pair: fix deadlock in test_connect_accept_nonblockKazuki Yamaguchi2018-08-161-29/+22
| | | | | | | | | | | | | | Call IO.select with a timeout value and limit the number of retries to prevent stacking forever. Reference: https://github.com/ruby/openssl/issues/214
* | Add `SSLSocket#fileno` and `SSLServer#fileno`. Fixes #198.Samuel Williams2019-03-311-0/+14
| |
* | Merge branch 'maint'Kazuki Yamaguchi2018-10-181-4/+10
|\ \ | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.1.2 Ruby/OpenSSL 2.0.9 needs openssl/opensslv.h x509name: fix OpenSSL::X509::Name#{cmp,<=>}
| * \ Merge branch 'maint-2.0' into maintKazuki Yamaguchi2018-10-171-4/+10
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | * maint-2.0: Ruby/OpenSSL 2.0.9 needs openssl/opensslv.h x509name: fix OpenSSL::X509::Name#{cmp,<=>}
| | * \ Merge branch 'ky/x509name-cmp-bugfix' into maint-2.0Kazuki Yamaguchi2018-10-171-4/+10
| | |\ \ | | | |/ | | |/| | | | | | | | | * ky/x509name-cmp-bugfix: x509name: fix OpenSSL::X509::Name#{cmp,<=>}
| | | * x509name: fix OpenSSL::X509::Name#{cmp,<=>}ky/x509name-cmp-bugfixKazuki Yamaguchi2018-10-171-4/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix wrong use of X509_NAME_cmp() return value. OpenSSL::X509::Name#<=> could return 0 when the two objects aren't identical. Reported by Tyler Eckstein. CVE-2018-16395. Reference: https://hackerone.com/reports/387250
* | | | Merge branch 'maint'Kazuki Yamaguchi2018-08-083-16/+52
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: x509name: fix handling of X509_NAME_{oneline,print_ex}() return value x509name: refactor OpenSSL::X509::Name#to_s test/test_x509name: change script encoding to ASCII-8BIT reduce LibreSSL warnings openssl_missing.h: constified openssl: search winsock search winsock libraries explicitly no ID cache in Init functions test/test_ssl: fix test failure with TLS 1.3 tool/ruby-openssl-docker: update to latest versions pkey: resume key generation after interrupt
| * | | Merge branch 'maint-2.0' into maintKazuki Yamaguchi2018-08-081-0/+9
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | * maint-2.0: x509name: fix handling of X509_NAME_{oneline,print_ex}() return value x509name: refactor OpenSSL::X509::Name#to_s test/test_x509name: change script encoding to ASCII-8BIT
| | * | x509name: fix handling of X509_NAME_{oneline,print_ex}() return valueky/x509name-to-s-emptyKazuki Yamaguchi2018-08-081-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | X509_NAME_print_ex() behaves differently depending on the passed flags. When XN_FLAG_COMPAT is specified, it returns either 1 on success or 0 on error. Otherwise, it returns the byte size written or -1 on error. This means 0 return is not necessarily an error. Also, X509_NAME_oneline() return value needs to be checked as it may fail with a NULL return. Fixes: https://github.com/ruby/openssl/issues/200
| | * | test/test_x509name: change script encoding to ASCII-8BITKazuki Yamaguchi2018-08-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Allow string literals containing UTF-8 characters. (cherry picked from commit 98945c7ce8706309a6d358007f1fdb2a73711662)
| * | | Merge branch 'maint-2.0' into maintKazuki Yamaguchi2018-08-082-16/+43
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fix made in 6fcc6c0efc42 ("test/test_ssl: fix test failure with TLS 1.3", 2018-08-06) is applied to the new test cases. * maint-2.0: reduce LibreSSL warnings openssl_missing.h: constified openssl: search winsock search winsock libraries explicitly no ID cache in Init functions test/test_ssl: fix test failure with TLS 1.3 tool/ruby-openssl-docker: update to latest versions pkey: resume key generation after interrupt
| | * | test/test_ssl: fix test failure with TLS 1.3ky/openssl-1.1.1-part2Kazuki Yamaguchi2018-08-062-15/+31
| | |/ | | | | | | | | | | | | | | | SSL_connect() on the client side may return before SSL_accept() on server side returns. This will fix test failures with OpenSSL's current master.
* | | Merge branch 'maint'Kazuki Yamaguchi2018-05-124-6/+32
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.1.1 Ruby/OpenSSL 2.0.8 test/test_ssl_session: set client protocol version explicitly test/test_pkey_rsa: fix test failure with OpenSSL 1.1.1 extconf.rb: fix build with LibreSSL 2.7.0 cipher: validate iterations argument for Cipher#pkcs5_keyivgen test/utils: disable Thread's report_on_exception in start_server
| * | Merge branch 'maint-2.0' into maintKazuki Yamaguchi2018-05-124-6/+32
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-2.0: Ruby/OpenSSL 2.0.8 test/test_ssl_session: set client protocol version explicitly test/test_pkey_rsa: fix test failure with OpenSSL 1.1.1 extconf.rb: fix build with LibreSSL 2.7.0 cipher: validate iterations argument for Cipher#pkcs5_keyivgen test/utils: disable Thread's report_on_exception in start_server
| | * test/test_ssl_session: set client protocol version explicitlyky/openssl-1.1.1Kazuki Yamaguchi2018-05-111-5/+9
| | | | | | | | | | | | | | | | | | | | | Clients that implement TLS 1.3's Middlebox Compatibility Mode will always provide a non-empty session ID in the ClientHello. This means the "get" callback for the server-side session caching may be called for the initial connection.
| | * test/test_pkey_rsa: fix test failure with OpenSSL 1.1.1Kazuki Yamaguchi2018-05-111-1/+8
| | | | | | | | | | | | OpenSSL 1.1.1 raised the minimum size for RSA keys to 512 bits.
| | * cipher: validate iterations argument for Cipher#pkcs5_keyivgenky/cipher-pkcs5-keyivgen-validate-iterKazuki Yamaguchi2018-01-121-0/+3
| | | | | | | | | | | | | | | | | | | | | EVP_BytesToKey() internally converts the iteration count given as an "int" into an "unsigned int". Calling that with a negative integer will result in a hang. This is surprising, so let's validate the value by ourselves and raise ArgumentError as necessary.
| | * test/utils: disable Thread's report_on_exception in start_serverKazuki Yamaguchi2017-12-151-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | Those threads can purposefully raise exceptions when they call 'pend'. The report_on_exception feature can be safely disabled in this case since we use assert_join_threads that captures all exceptions raised. This is necessary to suppress warnings on Ruby 2.5, which enables the report_on_exception feature by default.
* | | Correctly verify abbreviated IPv6 SANsBrian Cunnie2018-02-061-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPv6 SAN-verification accommodates ["zero-compression"](https://tools.ietf.org/html/rfc5952#section-2.2). It also accommodates non-compressed addresses. Previously the verification of IPv6 addresses would fail unless the address syntax matched a specific format (no zero-compression, no leading zeroes). As an example, the IPv6 loopback address, if represented as `::1`, would not verify. Nor would it verify if represented as `0000:0000:0000:0000:0000:0000:0000:0001`; however, both representations are valid, RFC-compliant representations. The library would only accept a very specific representation (i.e. `0:0:0:0:0:0:0:1`). This commit addresses that shortcoming, and ensures that any valid IPv6 representation will correctly verify.
* | | pkcs7: allow recipient's certificate to be omitted for PKCS7#decryptky/pkcs7-decrypt-without-recipients-certificateKazuki Yamaguchi2018-01-041-0/+2
|/ / | | | | | | | | | | | | | | The recipient's certificate is not mandatory for PKCS7_decrypt(). Make it possible to call OpenSSL::PKCS7#decrypt with only the private key to match the functionality. Reference: https://github.com/ruby/openssl/issues/182
* | Merge pull request #177 from rhenium/ky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-141-22/+45
|\ \ | | | | | | pkey/ec: add support for octet string encoding of EC point
| * | pkey/ec: add support for octet string encoding of EC pointky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-141-22/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new method named PKey::EC#to_octet_string that returns the octet string representation of the curve point. PKey::EC::Point#to_bn, which have already existed and is similar except that an instance of OpenSSL::BN is returned, is rewritten in Ruby. PKey::EC::Point#initialize now takes String as the second argument in the PKey::EC::Point.new(group, encoded_point) form. Also, update the tests to use #to_octet_string instead of #to_bn for better readability.
* | | Merge branch 'ky/fix-ssl-test-internal-encoding'Kazuki Yamaguchi2017-12-141-4/+6
|\ \ \ | | | | | | | | | | | | | | | | * ky/fix-ssl-test-internal-encoding: Fix test-all tests to avoid creating report_on_exception warnings
| * | | Fix test-all tests to avoid creating report_on_exception warningsky/fix-ssl-test-internal-encodingeregon2017-12-141-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * The warnings are shown by Thread.report_on_exception defaulting to true. [Feature #14143] [ruby-core:83979] * Improves tests by narrowing down the scope where an exception is expected. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61188 b2dd03c8-39d4-4d8f-98ff-823fe69b080e [ky: this effectively reverts commit 01445af367ec ("test/test_ssl: prevent changing default internal encoding", 2017-11-26). This is OK since EnvUtil.with_default_internal has been made thread-safe.] Sync-with-trunk: r61188
* | | | Merge branch 'ky/fix-ssl-test-internal-encoding'Kazuki Yamaguchi2017-11-261-9/+6
|\| | | | | | | | | | | | | | | | | | | * ky/fix-ssl-test-internal-encoding: test/test_ssl: prevent changing default internal encoding
| * | | test/test_ssl: prevent changing default internal encodingKazuki Yamaguchi2017-11-261-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In Ruby tree (not in this tree), assert_raise_with_message uses EnvUtil.with_default_internal which cannot be called simultaneously. The patch was suggested by Yusuke Endoh (mame).
* | | | Merge branch 'maint'Kazuki Yamaguchi2017-11-252-18/+47
|\ \ \ \ | | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: History.md: fix a typo x509cert, x509crl, x509req, ns_spki: check sanity of public key pkey: make pkey_check_public_key() non-static test/test_cipher: fix test_non_aead_cipher_set_auth_data failure cipher: disallow setting AAD for non-AEAD ciphers test/test_ssl_session: skip tests for session_remove_cb appveyor.yml: remove 'openssl version' line
| * | | test/test_cipher: fix test_non_aead_cipher_set_auth_data failureky/cipher-non-aead-auth-dataKazuki Yamaguchi2017-10-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | A follow-up to commit bb10767b0570 ("cipher: disallow setting AAD for non-AEAD ciphers", 2017-10-18). Cipher#auth_data= raises NotImplementedError if built with OpenSSL < 1.0.1.
| * | | cipher: disallow setting AAD for non-AEAD ciphersKazuki Yamaguchi2017-10-181-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EVP_CipherUpdate() must not be call with the output parameter set to NULL when the cipher does not support AEAD. Check the flag of EVP_CIPHER, and raise an exception as necessary. Reference: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/83337 Reference: https://bugs.ruby-lang.org/issues/14024
| * | | test/test_ssl_session: skip tests for session_remove_cbky/skip-session-remove-cb-testsKazuki Yamaguchi2017-10-101-18/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In OpenSSL < 1.1.0, the session_remove_cb callback is called inside the global lock for CRYPTO_LOCK_SSL_CTX which is shared across the entire process, not just for the specific SSL_CTX object. It is possible that the callback releases GVL while the lock for CRYPTO_LOCK_SSL_CTX is held, causing another thread calling an OpenSSL function that tries to acquire the same lock stuck forever. Add a note about the possible deadlock to the docs for SSLContext#session_remove_cb=, and skip the relevant test cases unless the OSSL_TEST_ALL environment variable is set to 1. A deadlock due to this issue is observed: http://ci.rvm.jp/results/trunk-test@frontier/104428
* | | | Merge pull request #173 from rhenium/ky/kdf-hkdfKazuki Yamaguchi2017-11-251-0/+42
|\ \ \ \ | | | | | | | | | | kdf: add HKDF support
| * | | | kdf: add HKDF supportky/kdf-hkdfKazuki Yamaguchi2017-11-221-0/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.1.0 supports HKDF through the EVP API. Add OpenSSL::KDF.hkdf as a wrapper around that. Reference: https://github.com/ruby/openssl/issues/172
* | | | | Merge branch 'ky/x509-implement-eq'Kazuki Yamaguchi2017-11-222-8/+16
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * ky/x509-implement-eq: test/test_x509crl: fix random failure test/test_x509cert: fix flaky test
| * | | | | test/test_x509crl: fix random failureky/x509-implement-eqKazuki Yamaguchi2017-11-221-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similarly to the previous one, avoid querying the current time multiple times. Fixes: e4727829837a ("x509crl, x509revoked: implement X509::{CRL,Revoked}#==", 2017-10-12)
| * | | | | test/test_x509cert: fix flaky testKazuki Yamaguchi2017-11-221-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specify the notBefore and notAfter fields explicitly to prevent occasional failure. Fixes: 432a9f3455f5 ("x509cert: implement X509::Certificate#==", 2017-10-12)
* | | | | | Merge branch 'ky/ssl-add-certificate'Kazuki Yamaguchi2017-11-223-6/+123
|\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge GitHub Pull Request #167. * ky/ssl-add-certificate: test/test_ssl: fix test_security_level ssl: add SSLContext#add_certificate test/utils: remove a pointless .public_key call in issue_cert test/envutil: port assert_warning from Ruby trunk
| * | | | | | test/test_ssl: fix test_security_levelky/ssl-add-certificateKazuki Yamaguchi2017-11-221-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix test_security_level using SSLContext#add_certificate. It immediately sets the certificate to the SSL_CTX, so it is affected by the security level setting.
| * | | | | | ssl: add SSLContext#add_certificateKazuki Yamaguchi2017-11-221-0/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new method to add a certificate, a corresponding private key, and extra CA certificates at once. This has two advantages over the existing {cert,key,extra_cert_chain} attributes: 1. We can notice the problem with the certificate and/or the private key. Since the existing attributes are simple instance variables, they aren't set to the SSL_CTX until #setup which usually happens on the first connection. 2. For the same reason, existing attributes allowed only one certificate for a context, even though OpenSSL itself is capable of handling multiple certificates and selecting the most appropriate one according to the cipher suite selected. The documentation for the existing attributes are updated to recommend using #add_certificate.
| * | | | | | test/utils: remove a pointless .public_key call in issue_certKazuki Yamaguchi2017-11-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PKey::EC#public_key works differently from other PKey types, making TestUtils.issue_cert unusable for creating ECDSA certificates. Actually, the #public_key does not have any effect on any other PKey types. So just remove it.
| * | | | | | test/envutil: port assert_warning from Ruby trunkKazuki Yamaguchi2017-11-221-0/+23
| | |/ / / / | |/| | | | | | | | | | | | | | | | EnvUtil.verbose_warning used by assert_warning is also ported.
* | | | | | Drop support for LibreSSL 2.4Kazuki Yamaguchi2017-11-221-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | LibreSSL 2.4 reached its EOL in 2017-09.
* | | | | | Merge pull request #169 from rhenium/ky/pkey-rsa-sign-pssKazuki Yamaguchi2017-11-141-0/+33
|\ \ \ \ \ \ | | | | | | | | | | | | | | [v2] Add RSA sign_pss() and verify_pss() methods
| * | | | | | Add RSA sign_pss() and verify_pss() methodsky/pkey-rsa-sign-pssPeter Karman2017-11-131-0/+33
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support Probabilistic Signature Scheme for RSA key signing. [ky: the patch was originally submitted as GitHub Pull Request #76. finish keyword arguments handling, update docs, and fix tests.]
* | | | | | Merge pull request #162 from rhenium/ky/ssl-write-multiKazuki Yamaguchi2017-11-131-0/+9
|\ \ \ \ \ \ | |_|_|_|/ / |/| | | | | buffering: let #write accept multiple arguments
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-27 07:44:32 +0000